Hacker News Reader

Comment by peterwwillis | Hacker News Reader

So now you just need to distribute your CA certificate everywhere

As opposed to writing down the key signature of your server's host keys on a card in your wallet? You only need to look at it the first time you connect to the server, and it's a lot less of a pain in the ass than trying to install custom CA certs on every machine you SSH from.

View on HN

If you have one server, that sounds great. If you have 60, it does not.

For the love of god why have 60 servers with ssh available open to the world? Ssh through trusted gateway machine! Then you need a single signature you trust and you can firewall off the rest of your hardware.

For the love of god why would you assume this has anything to do with "open to the world"? When I proxy through the trusted ssh gateway to the firewalled servers (using ssh ProxyCommand), I still like my client to verify the signature.

I would assume that if your internal network is "trusted", then the risk of a MitM is low enough that you wouldn't have to check the signature. I agree that an extra layer of validation is always a nice thing to have, but everyone has different levels of acceptable inconvenience with regards to security.

You could store the signatures on one server, and import them in bulk. Then you still just need to write down the one signature.

Yes, there are many ways you can work around the problem of ssh needing manual inspection of individual host keys, and the method you propose is pretty reasonable. But building the verification into the infrastructure is a very sensible and nice way of handling it, and lets everyone throw out their individual ad-hoc solutions to this problem.

Or if you're running windows you can use group policy and windows PKI to get it done automatically. But I haven't found out how to do the same thing under a nix environment.

If you have 60 servers you are hopefully using some kind of configuration automation, like puppet or chef...?

Yes, but in my experience, doing that for client machines (where you need to check the fingerprints) is pretty atypical.

Reply on news.ycombinator.com