Re:Show HN: Krypton for Teams – Simple SSH Key Storage for D...
by 4kevinking on Tuesday April 24, 2018 @05:05PM
(#16916576)
The SSH key stored in Krypton can be signed just like a local key-pair. The public key is stored in ~/.ssh/id_krypton.pub and SSH will look for the cert at ~/.ssh/id_krypton-cert.pub.
[ Parent
| on HN ]
Re:Show HN: Krypton for Teams – Simple SSH Key Storage for D...
by tptacek on Tuesday April 24, 2018 @05:07PM
(#16916597)
Right, but that's a long-lived durable SSH credential. Part of the point of modern SSH access management is not to have any of those anymore.
Re:Show HN: Krypton for Teams – Simple SSH Key Storage for D...
by 4kevinking on Tuesday April 24, 2018 @05:18PM
(#16916700)
Yes in this case the Krypton SSH key pair is long-lived, but the certificate issued to it by the server would be short-lived.
How are users authenticating to this 2FA CA in the first place? Instead of using username/password and 2FA, users could authenticate to the CA using Krypton and then use the issued certificate for short-lived access.
If Krypton using a long-lived SSH keypair is a non-starter, automatic key rotation could be added down the line (sort of like being forced to change your password but this would be automated).