5 ms·
This is definitely the premise of what I was going for with the post. I'm a firm believer in the idea that short-lived certificates which expire by default are
by webvictim 6y ago
This is definitely the premise of what I was going for with the post. I'm a firm believer in the idea that short-lived certificates which expire by default are one of the best ways to provide access to infrastructure, and enforcing that access comes from a limited list of bastions gives you an easy choke point to withdraw access as desired when you need to.
- sytringy05 6y agoIsn't there a netflix ssh CA that does this?
- V-eHGsd_ 6y agoyes, it's called bless. https://github.com/Netflix/bless https://github.com/Netflix/bless there's also cashier https://github.com/nsheridan/cashier https://github.com/nsheridan/cashier