The default OpenSSH key encryption is worse than plaintext

Re:The default OpenSSH key encryption is worse than plaintext by old-gregg on Friday August 03, 2018 @05:06PM (#17683617)

> consider that long-lived SSH credentials are an anti-pattern.

Exactly. Consider switching to auto-expiring SSH certificates. You can build your own certificate management using a few open tools or switch to Teleport [1] which is 100% certificate based and doesn't even support keys. Disclaimer: I am one of the contributors.

[1] https://github.com/gravitational/teleport

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by nerdponx on Friday August 03, 2018 @06:26PM (#17684118)

Thanks for this. I will happily check out your tool, but what are some of the other solutions in this area?

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by lvh on Friday August 03, 2018 @06:42PM (#17684202)

There’s also BLESS and Hashicorp Vault. I have a penchant for Teleport.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by pvg on Saturday August 04, 2018 @12:42AM (#17685415)

Oh! Teleport does look pretty decent now that I've forced myself to look at it after going through this thread.

I mention this mostly for the sort of people like me who read 'SSH CA' and their eyes roll into the backs of their heads and they start rocking and making saliva bubbles at thought of PAM modules and LDAP servers and so on. But this doesn't look nearly as bad. Go ssh implementation sounds like a nice ancillary bonus.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by thenewwazoo on Saturday August 04, 2018 @03:49PM (#17688197)

It’s probably pretty rotted by now but I wrote a version of this while I worked at Microsoft called ALTAR that’s backed by Azure services.

[ Parent | on HN ]