Chris Siebenmann
∂irac·ẅitch☾˚
@thatcks Oh? No love for SSH certificates?
This is my sad face when people sing the praises of SSH certificates and a SSH CA as a replacement for personal SSH keypairs.
-
-
-
@mistofvongola I consider them extremely dangerous because they have the old SSL CA problem: you can never be sure what's been issued.
-
@thatcks They're can be nice in an org (where this can be advertised) and can help when people ignoring host key checks are the norm. :/ - View other replies
-
@mistofvongola It would be neat if you could require both explicitly listed *and* signed by an organizational CA, but I don't think you can.
-
@thatcks Took me a minute to find it in the man page, but I think what you're looking for is AuthorizedPrincipalsFile. -
@mistofvongola I don't think that option works for this. I believe principle names aren't SSH key IDs, they're -n key signing arguments.
-
@thatcks Oh yes, you're right. That was my misunderstanding of the manual at a glance. Sorry about that!
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.