> * enforcing SSH key authentication
That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.
That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.
And 2 or even 3 factor should maybe be on the list (key+pw, key+totp, key+pw+totp).
For keys, it's in theory possible to ease management with using ssh certificates and a CA - anyone know of a convenient way to manage totp secrets across multiple servers and users?