Engineering Secure SSH Access for Engineers
summary
Compares authentication methods and concludes OpenSSH certificate-based auth is the best fit for deployed embedded devices, with a demo workflow: generate CA and client keys, sign client keys to create short-lived certs, add CA public key to sshd via TrustedUserCAKeys. Shows a patched OpenSSH adding SSH certificates with host-bound critical options to bind certs to device IDs and a compile-time way to skip time checks, and recommends signing server + Vault for scale and auditing.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 6:40SSH security for embedded devices
- 11:00Password authentication limits
- 13:30Public key authentication challenges
- 15:41GSSAPI in embedded contexts
- 17:20Certificate-based authentication
- 23:07SSH certificates in embedded use
- 29:57Host certificates and TOFU risks
- 31:04PAM authentication alternatives
- 32:13Q&A
related talks
44mEngineering Secure SSH Access for Engineers
32mKeys or Certs for SSH Access? Why should I care?
23mAutomation with Scalable & Secure SSH
11mIf You’re Not Using SSH Certificates You’re Doing SSH Wrong
29mSSH Certificates: a way to scale SSH access
41mA better way to SSH: Introducing SSH certificates
28mManaging SSH Access without Managing SSH Keys
45mZero Trust SSH