Lesson 4.41: SSH certificates instead of authorized_keys
authorized_keys files grow forever: keys of people who left, of laptops that were replaced, of test machines nobody remembers, copied to every server. OpenSSH certificates replace them with one trusted certificate authority. The CA signs a user's public key for named accounts (principals) and a short validity, servers trust the CA instead of individual keys, and a revocation list handles the rare stolen laptop. In the lab you count the key sprawl on a Northwind server, create a user CA, issue eight-hour certificates, configure sshd to trust them and revoke one.
19 min
You will learn to
- Explain the problems of authorized_keys at scale
- Create a user CA and sign keys with principals and validity
- Read a certificate with ssh-keygen -L
- Configure TrustedUserCAKeys and AuthorizedPrincipalsFile
- Revoke a certificate with a KRL
Key terms
- User CA
- A key pair whose signature servers trust instead of individual user keys.
- SSH certificate
- A user's public key signed by the CA together with a key ID, serial, principals and validity.
- Principal
- A name in the certificate that an account must accept for the login to work.
- Validity
- The time window in which the certificate works.
- AuthorizedPrincipalsFile
- Per-account file of principals the server accepts for that account.
- KRL
- Key revocation list: certificates or keys sshd must refuse even if they're still valid.
← Offboarding an account safely · All lessons · Kernel settings that drift: sysctl precedence →