Hacker News Reader

Comment by 0xdeadb00f | Hacker News Reader

> Users are exposed to key material and encouraged to reuse keys across devices. Keys are trusted permanently, so mistakes are fail-open.

What? This just sounds like you're doing it all wrong then blaming the tools.

Maybe I'm just thinking about it from my POV as a mainly hobbyist user of SSH, but I rotate my keys (not as frequently as I should, but I do), and I remove old ones from .authorized_keys files and I use different keypairs for different servers sometimes too. I never copy keys to other devices - I ssh-keygen on every device, and add my pub key to the authorized_keys file manually.

It isn't even "hard" to do it this way. Sure, it doesn't "scale" for big corps - but I don't need it to scale, so I'm not "doing SSH wrong" by not using certificates.

View on HN

I decided that I wanted to automate my rotation, so I built a shell script to do it, then wrote about it.

If you Google "ssh key rotation" you will find my article as a "featured snippet."

I don't think that I need a CA, as I only have personal and admin keys (two sets) and I'm flipping these once a quarter. Plus, I don't have expired entries in my authorized_keys (do CA users ever clean out authorized_keys?), and these are very clean as I see them regularly.

https://www.linuxjournal.com/content/ssh-key-rotation-posix-...

It's more effort than I would like. I should not be bothered with updating hidden config files containing data that is mostly not human readable. I want to prove my identity once and let the system take care of the rest.

Well that's fair enough, but I take issue more with the title of the post telling me I do "ssh wrong", because I can't be bothered to setup a CA and fuck around with certificates.

To me, setting up a CA is more effort than I would like.

It becomes feasible when you have a larger number of key pairs that are supposed to have access to the same set of machines. I did it as a private person because I'm an SSH nomad, using several clients with different key pairs each.

I agree with you, for a regular user with a single client device (or two) its not worth it.

It's very much a use-case and risk driven decision. A company should be using Teleport, which is a lot more than just certificates (but they do use certs). For your personal VPS or GitHub account, nobody is going to go out of their way to get your SSH keys.

The biggest "you're doing it wrong" I see is people who disable host key verification because their servers' IPs change constantly. Do you want MITM?! Because this is how you get MITM! Might as well use Telnet for connections.

Reply on news.ycombinator.com