How often should I rotate my SSH keys?

• sekey

  4 2,419 0.0 Rust

  Use Touch ID / Secure Enclave for SSH Authentication!

  

Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https://github.com/sekey/sekey)

• sharkey

  2 391 5.4 Go

  Sharkey is a service for managing certificates for use by OpenSSH

  

> Still, I'd really like to see an article about how you set that up, especially if it targets smaller enterprise customers.

https://github.com/square/sharkey

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• bless

  6 2,729 0.0 Python

  Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function

  

• openssh-sk-winhello

  7 181 0.0 C

  A helper for OpenSSH to interact with FIDO2 and U2F security keys through native Windows Hello API

My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also.

[1] https://github.com/tavrez/openssh-sk-winhello

• secretive

  23 6,864 7.4 Swift

  Store SSH keys in the Secure Enclave

Secretive also does this, and works on any Mac with the T2. I use it for all my ssh keys these days. It’s super slick!

https://github.com/maxgoedjen/secretive

• authorized_keys

  1 1 0.0 Shell

  Scripts to manage many-to-many SSH access

Definitely not appropriate for protecting Real Infrastructure, but for my handful of personal machines I put my authorized keys in a Google Doc and configure hosts to download it using `AuthorizedKeysCommand`.

I have a hardware-backed "doomsday key" to use if the Google Doc stops working.

Writeup and script at https://github.com/mmdriley/authorized_keys

• stateless-workstation-config

  1 22 6.4 Jinja

  This is how I configure a fresh Ubuntu installation for serving me as a workstation.

> An even more robust approach is to use some kind of hardware token that can sign short-lived ssh keys, and teach all your servers how to deal with those. That’s neat, but it’s hard to deploy (needs custom ssh settings).

Ahem, no. I use Yubikeys for a few years now. They are literally braindead to use, and works out of the box in recent Ubuntu. Here is an Absible role to get started: https://github.com/cristiklein/stateless-workstation-config/...

Stop making excuses and start protecting your SSH keys!

Disclaimer: I'm not compensated in any way by Yubico, but their product is so darn good that I really want people to start using it.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• thoughts

  3 3 0.0

  Just my public thoughts, think of it like a blog I never update

If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use.

I wrote about my endeavour with this approach just few days ago [1].

[1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...

Suggest a related project