SSH: Best practices

Re:SSH: Best practices by aris_ada on Sunday February 07, 2016 @04:22PM (#11054915)

Have each team member generate his own key. Copy everyone's key in a folder and have a script to generate an authorized_keys file. Use puppet or chef (or anything else) to dispatch the authorized_keys on every server.

A single shared key is a security disaster waiting to happen.

[ Parent | on HN ]

Re:SSH: Best practices by throwaway2048 on Monday February 08, 2016 @02:53AM (#11056858)

did you read the article? ssh certificates with revokation are a much more workable solution

[ Parent | on HN ]

Re:SSH: Best practices by aris_ada on Monday February 08, 2016 @03:02AM (#11056885)

I wrote the article.

[ Parent | on HN ]

Re:SSH: Best practices by Piskvorrr on Tuesday February 09, 2016 @09:57AM (#11065665)

There's the up-front cost of setting them up, and perhaps tool support (pubkey/agent auth is widely supported; X.509...not so much).

[ Parent | on HN ]

Re:SSH: Best practices by throwaway2048 on Tuesday February 09, 2016 @12:04PM (#11066767)

ssh certificates are not x.509, though they are designed around a PKI.

[ Parent | on HN ]

Re:SSH: Best practices by Piskvorrr on Wednesday February 10, 2016 @07:41AM (#11072321)

Thanks for the correction.

[ Parent | on HN ]