Managing SSH Access without Managing SSH Keys
summary
Replaces long-lived private keys with ephemeral certificates signed by a central casher CA that authenticates via Google OAuth, issues keys generated in memory and installs them in the SSH agent, and embeds a username and restrictions in each cert. Servers trust only the CA public key, revocation happens via a KRL polled every ~4–5 minutes, and certs default to a 20-hour lifetime. Result: hundreds of roaming keys shrink to about 30 active certs and access can be revoked or expires without rebuilding images.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:49Security of Interactive and Automated Access Management Using Secure Shell
- 5:08Managing Ssh Keys
- 12:19Enabling Certificates
- 19:39Key Master
related talks
41mA better way to SSH: Introducing SSH certificates
45mZero Trust SSH
32mKeys or Certs for SSH Access? Why should I care?
23mAutomation with Scalable & Secure SSH
44mEngineering Secure SSH Access for Engineers
11mIf You’re Not Using SSH Certificates You’re Doing SSH Wrong
29mSSH Certificates: a way to scale SSH access- 44mEngineering Secure SSH Access for Engineers