Re:Protecting SSH Keys with macOS Secure Enclave
by andix on Wednesday November 11, 2026 @10:54AM
(#50454868)
The other option is to have device-bound keys and a script to sync them to all ssh servers you want to access.
Relying on a small set of ssh keys for a longer time is anyway not that great, it's best to have some mechanism to cycle them.
I wouldn't use any automated sync tool for that, just a script that ssh's into all the servers and replaces/edits authorized_keys if something changes.
I would never use something like this (https://github.com/shoenig/ssh-key-sync). It basically gives Github or someone who compromised Github access to all your systems.
Relying on a small set of ssh keys for a longer time is anyway not that great, it's best to have some mechanism to cycle them.
I wouldn't use any automated sync tool for that, just a script that ssh's into all the servers and replaces/edits authorized_keys if something changes.
I would never use something like this (https://github.com/shoenig/ssh-key-sync). It basically gives Github or someone who compromised Github access to all your systems.