I want to write an SSH agent that knows what user/host you're trying to connect to, but the protocol doesn't provide that. So I just had a ridiculous idea. What if I make a FUSE filesystem that materializes listening UNIX sockets on the fly, and set IdentityAgent to <fs>/%r@%h
-
ACK I question the viability of the audit. You can know when I request a given key. But you have now way to know if I keep a copy.
Check out SSH certs. You can expire them, or specify which command they can be used with.
That is not how SSH agents work. You do not request the key, you request to sign something with it. Every single use has to go through the agent. That's the entire point!
-
-
And since the idea is that each server gets a unique key, there's no possibility of requesting a key for one server and using it with another one.
-
Did you find any good solution for this? I saw your email about using an extension in the agent protocol
End of conversation
New conversation -
-
-
Okay. I’ve not delved into key / agent operations. Do check out SSH certs.
-
Certs are great when you have a well-integrated homogeneous infrastructure, but require significant configuration on both sides. I want something that can work on the basic premise of "stick a key into your authorized_keys" that we're all familiar with for ad-hoc SSH.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.