6 ms·
The main advantage of certificates is that you are able to do that from the CA without touching the target machine.
by blueflow 6mo ago
The main advantage of certificates is that you are able to do that from the CA without touching the target machine.
- lokar 6mo agoExactly. This is really useful in larger organizations where you may want more complex rules on access. For example, you can easily build "break glass" or 2nd party approved access on demand. You can put whatever logic you need in a CA front-end. You can also make all the certs short-lived (and only store them in ram).
- TZubiri 6mo agoThe way I've been doing that is with Shamir Secret Sharing and encrypting keys until glass-breaking is necessary.
- lokar 6mo agogenerating tons of keys? or just broad keys? What I've done is generate a cert for the host(s) the user needs, for the time-span they need (subject to authorization logic).
- pphysch 6mo agoCerts may still be the right approach, but OpenSSH also supports an AuthorizedKeysCommand which could be a secure HTTPS request to a central server to pull down a dynamically generated authorized_keys file content for the particular user and host. If your endpoints can securely and reliably reach a central server, this gives you maximum control (your authorized_keys HTTPS server can have any custom business logic you want) without having to deal with certs/CAs.
- anilakar 6mo agoAnd when your or someone else's infra down to such a degree that you need SSH access, you do not want to depend on being able to touch that machine first. The same is true with custom AuthorizedKeysCommands that phone home.