SSH certificates: the better SSH experience

Re:SSH certificates: the better SSH experience by anyfoo on Friday April 03, 2026 @11:16AM (#47627648)

A big problem I have with ssh carts is that they are not universally supported. For me, there is always some device or daemon (for example tinyssh in the initramfs of my gaming pc so that I can unlock it remotely) that only works with “plain old ssh keys”. And if I have to distribute and sync my keys onto a few hosts anyway, it takes away the benefits.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by TZubiri on Friday April 03, 2026 @01:33PM (#47629565)

Might actually be a positive instead of a negative. Gaming use-cases should have not any effect on security policies, these should be as separate as possible, different auth mechanisms for your gaming stuff and your professional stuff ensures nothing gets mixed.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by nagaiaida on Friday April 03, 2026 @11:12PM (#47635299)

remote unlock is also useful when you're not gaming so that feels like the wrong aspect to focus on

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by anyfoo on Saturday April 04, 2026 @07:57AM (#47638248)

Hah? It being my gaming machine has nothing to do with the problem. It’s also my FPGA development machine, though it gets used less for that. It only happens to be the only Linux workstation in my home (the others are Macs or OpenBSD).

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by TZubiri on Saturday April 04, 2026 @08:29AM (#47638467)

If you care about security, I recommend investing into a separate computer for developing hardware and software and another for downloading games on.

You can setup your security any way you like, but nothing beats an air gap in terms of security and simplicity.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by namibj on Friday April 03, 2026 @03:08PM (#47630778)

Upgrade to a better one in initramfs?

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by AceJohnny2 on Friday April 03, 2026 @06:18PM (#47633072)

Adding to this: while certs are indeed well-supported by OpenSSH, it's not always the SSH daemon used on alternate or embedded platforms.

For example, OpenWRT used Dropbear [1] instead, which does not support certs. Also, Java programs that implement SSH stuff, like Jenkins, may be doing so using Apache Mina [2] which, though the underlying library supports certs, it is buggy [3] and requires the application to add the UX to also support it.

[1] https://matt.ucc.asn.au/dropbear/dropbear.html

[2] https://mina.apache.org/sshd-project/

[3] I've been dealing for years with NullPointerExceptions causing the connection to crash when presented with certain ed25519 certificates.

[ Parent | on HN ]

Re:SSH certificates: the better SSH experience by briHass on Friday April 03, 2026 @11:36PM (#47635434)

You can just replace dropbear with openssh on OpenWRT. That was one of the first things I did, since DropBear also doesn't support hardware backed (sk) keys. Just move it to 2222 and disable the service.

I reenabled DB on that alt port when I did the recent major update, just in case, but it wasn't necessary. After the upgrade, OpenSSH was alive and ready.

[ Parent | on HN ]