OpenSSH introduces options to penalize undesirable behavior

Re:OpenSSH introduces options to penalize undesirable behavior by magmastonealex on Friday June 07, 2024 @02:21PM (#40611396)

There is a revocation system in place (the RevokedKeys directive in the sshd configuration file, which seems to be system-wide rather than configured at the user-level. At least, that’s the only way I’ve used it)

I agree with the sentiment though, it is far less extensive than traditional X.509 certificate infrastructure.

[ Parent | on HN ]

Re:OpenSSH introduces options to penalize undesirable behavior by upon_drumhead on Monday June 10, 2024 @04:14PM (#40638362)

when I said revocation system, I intended to convey something similar to Online Certificate Status Protocol, rather then a hardcoded list that needs to be synchronized between all the physical servers.

You are correct though, you can keep a list and deploy it to all the nodes for revocation purposes.

It's unfortunate that there's no RevokedKeysCommand to support building something like OCSP.

[ Parent | on HN ]