L2hhdGNoZXQv
Re:Most of what you read on the internet is written by insane people (...
on Friday January 01, 2021 @01:03PM (#25605140)
Upvoting, maybe.
Re:Linux Hardening Guide
on Thursday December 31, 2020 @10:09AM (#25593314)
> If you access many machines, how will you know when one is compromised? How will you prevent an attacker from logging in as you?
Even better is to use SSH certificates. That way you don't have to deal with authorized (usually permanent) keys.
Once the SSH CA is installed in the host, the client can generate temporary asymmetric keys and sign them with the CA key before every connection.
There are a few ways to set up this scenario, here's one using Vault:
https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...