OpenSSH: client bug CVE-2016-0777

Re:OpenSSH: client bug CVE-2016-0777 by jethro_tell on Thursday January 14, 2016 @04:08PM (#10904488)

Even with central management, I don't know that I want to have 2500 keys floating around even if I have a management stack in place. That seems like an attack vector all in its own. Changing a key every other day on a 90 day rotation with 50 boxes. And fifty boxes isn't even that much. That's like 2 racks.

Even with config management this won't scale past about 2 or 3 people and 10-20 boxes.

Central auth is an option I guess but I think the better way to go would be a 2 factor with the key and hotp.

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by xorcist on Thursday January 14, 2016 @04:50PM (#10904814)

It's not that bad, it's part of the user data and should be provisioned the same way.

OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.

[ Parent | on HN ]

Re:OpenSSH: client bug CVE-2016-0777 by jethro_tell on Thursday January 14, 2016 @05:13PM (#10905082)

The suggestion was not PKI though. I'd be happy with that. I already have a PKI in place. The suggestion was for a 1 key per box.

[ Parent | on HN ]