News for hackers. Stuff that matters.

A comment on The default OpenSSH key encryption is worse than plaintext. Parent comment

Re:The default OpenSSH key encryption is worse than plaintext by simias on Friday August 03, 2018 @04:35PM (#17683404)
If I use an ssh key to connect to computers owned by multiple organizations and I can't control how those servers are configured can I still use an SSH CA? For instance I use my key to connect to my servers but also computers at work, super short lived sessions when I'm debugging some embedded device through SSH (those tend to be wiped/replaced a lot so I keep having to ssh-copy-id my key to them), github and other "cloud" hosts etc... Does SSH CA make sense in such a configuration?

I'm currently using a yubikey to hold my key (in the GnuPG smartcard applet) so I felt pretty confident security-wise but now you're making me doubt.

[ Parent | on HN ]
Re:The default OpenSSH key encryption is worse than plaintext by e12e on Saturday August 04, 2018 @02:26PM (#17687921)
> If I use an ssh key to connect to computers owned by multiple organizations and I can't control how those servers are configured can I still use an SSH CA?

Not really. In general you need the same level of access for setting up the sshd host key, for setting up/enabling sshca: the server must trust the ca pub cert, and there's some configuration needed wrt principals (although AFAIK you can/should embed most of that in the certificate).

[ Parent | on HN ]