undefined | Better HN

0 pointsswiftcoder7y ago0 comments

SSH is even worse in many corporate environments, because you also have to cross an SSH gateway to transit into from the corp fabric into the prod fabric.

At AWS this meant we had to hop to a different gateway for each region, and then onto the (stateless) production host which was recreated from scratch on every deployment... There's no way a human was going to keep all those keys straight, and everyone just disabled SSH host verification.

0 comments

2 comments · 1 top-level

rocqua7y ago· 1 in thread

This actually seems like the right use-case for SSHFP records. They allow for storing the SSH key fingerprint in a DNSSEC secured zone.

Normally this is considered rather weak, because of the reliance on DNSSEC. However, in this case I think its a very easy to take step that'll be miles better than just trusting everything.

The stronger alternative is Certificate-based SSH, but that is a lot of hassle. As it requires setting up a CA, handling revocation, and actually distributing the certificates.

toast07y ago

It depends on how transient your servers are, but you can get pretty good mileage out of a checked in known_hosts file.

j / k navigate · click thread line to collapse