How to properly manage SSH keys for server access

Re:How to properly manage SSH keys for server access by amerine on Saturday September 26, 2020 @05:09PM (#24602138)

I think that you’re overreacting a tiny bit. One area that the OPs solution allows is rapid onboarding, quick/automatable generation for machine to machine roles and the ability to actually do some RBAC(if that matters to you). To make their system fail safe, they do the exact same thing you are except only making sure to synchronize the block-list.

I don’t know about you, but at least at my org, waiting for tens of thousands of machines to sync an authorized keys file when doing a ton of onboarding or a very very selective off-boarding... I’d rather minimize the amount of machines I touch and doing that via an authorized_keys push via ansible is untenable at scale or volume.

[ Parent | on HN ]

Re:How to properly manage SSH keys for server access by daneel_w on Saturday September 26, 2020 @09:21PM (#24603465)

I'm just taking the article's main point at face value. Certificates help with enabling access quickly (fast onboarding) but revocation needs every server to be informed about the change, since OpenSSH doesn't do OCSP.

If a single file change is untenable at scale or volume, how does your organization manage version deployments, or even something small like an emergency reconfiguration, without collapsing or having to cope until "patch tuesday"? What you describe sounds untenable to me.

[ Parent | on HN ]