OpenID Coming to SSH

Re:OpenID Coming to SSH by mdaniel on Tuesday March 25, 2025 @11:50AM (#43472741)

If I were still using SSH, maybe[1] but I'm thankful that I haven't used SSH in several years. I guess I also dodged a bullet by getting out before the Vault rug pull, since that would have made my life painful

1: although I don't think I'm the target audience for trail-blazing SSH auth; am a much, much bigger fan of just using X509 CA auth using short-term certs; it's much easier to reason about IMHO

[ Parent | on HN ]

Re:OpenID Coming to SSH by EthanHeilman on Tuesday March 25, 2025 @01:30PM (#43473766)

OpenPubkey does support X.509 using an X.509 extension.

[ Parent | on HN ]

Re:OpenID Coming to SSH by ale42 on Tuesday March 25, 2025 @05:56PM (#43476447)

Out of curiosity, what are you using now? Or do you mean you don't need remote terminals any more because you work on other stuff?

[ Parent | on HN ]

Re:OpenID Coming to SSH by mdaniel on Tuesday March 25, 2025 @10:09PM (#43478127)

All SSM, all the way. I even gravely considered using their IAM Anywhere capabilities to jump onto Azure or GCP instances, before that project was overcome by events

I'm cheating you a little bit, though, because for the most part once a VM gets kubelet on it, I'm off to the races. Only in very, very, very bad circumstances does getting on the actual Node help me

I also recently have started using <https://docs.aws.amazon.com/systems-manager/latest/userguide...> to even get sequestered cluster access via $(aws ssm start-session --document-name AWS-StartPortForwardingSessionToRemoteHost) although the "bootstrapping" problem of finding the instance-id to feed into --target is a pain. I wish they offered https://docs.aws.amazon.com/systems-manager/latest/userguide... in the spirit of "yeah, yeah, just pick one" versus making me run $(aws ec2 describe-instances --filter | head -n1) type thing

[ Parent | on HN ]