News for hackers. Stuff that matters.

A comment on We need better support for SSH host certificates. Parent comment

Re:We need better support for SSH host certificates by simiones on Monday March 27, 2023 @06:16AM (#35324846)
At work, we switched to Step CA [1] about 2 years ago. The workflow for our developers looks like:

  1. `ssh client-hosts-01`

  2. Browser window opens prompting for AzureAD login

  3. SSH connection is accepted
How is that simple, compared to `ssh -i .ssh/my-cert.rsa someone@destination --> connection is accepted, here's your prompt` ?
[ Parent | on HN ]
Re:We need better support for SSH host certificates by lucideer on Monday March 27, 2023 @06:21AM (#35324887)
The former is discoverable: it doesn't require developers having ANY knowledge of command switches (no matter how basic) nor following a set of out-of-band instructions; the "how to" is included within the workflow.
[ Parent | on HN ]
Re:We need better support for SSH host certificates by sokoloff on Monday March 27, 2023 @06:53AM (#35325074)
ssh-add (once per session) gives users back that incredible convenience. If you wanted to rotate certs, you’d have to add each new one, of course.
[ Parent | on HN ]
Re:We need better support for SSH host certificates by the8472 on Monday March 27, 2023 @09:04AM (#35326171)
The server could display that info when a user tries to log in via interactive authentication.
[ Parent | on HN ]
Re:We need better support for SSH host certificates by Aeolun on Monday March 27, 2023 @09:10AM (#35326233)
This is simple because it doesn’t require you to take any specific actions to make new/different hosts accessible.

If you deactivate someone in AD, poof, all their access is magically gone, instead of having to remove their public key from every server.

[ Parent | on HN ]
Re:We need better support for SSH host certificates by mynameisvlad on Monday March 27, 2023 @10:47AM (#35327371)
It’s the exact same command as a regular SSH prompt and it generates and uses the cert. that seems very simple.

Your command is disingenuous in that it only works if the certificate has already been issued to you. If you were to include issuance, your command would very much turn non-simple.

[ Parent | on HN ]
Re:We need better support for SSH host certificates by dijit on Wednesday March 29, 2023 @03:08AM (#35353683)
If I'm reading it right then there's a non-insignificant amount of setup necessary for the proposed approach anyway, generating and sharing a public key is much easier even for the customer/client.
[ Parent | on HN ]
Re:We need better support for SSH host certificates by shrx on Monday March 27, 2023 @12:30PM (#35328740)
What if you're ssh-ing from a headless client, like a raspberry pi or a VPS?
[ Parent | on HN ]
Re:We need better support for SSH host certificates by WastingMyTime89 on Monday March 27, 2023 @05:41PM (#35333061)
Then it doesn’t work but their developers are ssh-ing from their work laptops so it doesn’t matter. Something doesn’t have to be a solution for all use cases to be a good solution.
[ Parent | on HN ]