Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable.
Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. That definitely makes sense if you're at the "cattle not pets" level of servers where you don't care which server this is, and it can start to make sense even at the scale I grew up with where servers have themed names, so really by the time "All the servers" seems like a genuinely annoying problem, you ought to be rolling out certificates. Once upon a time I'd have argued that some of the other tricks to do centralised key auth are good, but I think on balance you should just go with certificates. FIDO is cheaper, although obviously if you already have OpenPGP you don't care about that.
Posted by tialaramex on Oct 5, 2021, 11:19 PM
Tags
Related issues
- Legit what one of our clients problem was.
- sounds painful, just searched on "how can i get ms office running in linux using wine" and the results included a containerised windows v...
- Appreciate MCP server availability, will help integrate with Claude.
- Maybe a different take, but as someone that manages a large public API that allows anonymous access, IPv6 has been a nightmare to try and...
- Why is there no write through unionfs in Linux?
- > why is there no in-memory kafka server that I can use for simple testing purposes https://github.com/embeddedkafka/...
Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments
hackernews (Sysadmin)
Legit what one of our clients problem was.
sounds painful, just searched on "how can i get ms office running in linux using wine" and the results included a containerised windows v...
Appreciate MCP server availability, will help integrate with Claude.
Maybe a different take, but as someone that manages a large public API that allows anonymous access, IPv6 has been a nightmare to try and...
Why is there no write through unionfs in Linux?
> why is there no in-memory kafka server that I can use for simple testing purposes https://github.com/embeddedkafka/...
> why is there no in-memory kafka server that I can use for simple testing purposes.
I went from daily driving mac and being very used to the desktop environment, and i am really hating everything i've tried in Linux.
Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable.
Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. That definitely makes sense if you're at the "cattle not pets" level of servers where you don't care which server this is, and it can start to make sense even at the scale I grew up with where servers have themed names, so really by the time "All the servers" seems like a genuinely annoying problem, you ought to be rolling out certificates. Once upon a time I'd have argued that some of the other tricks to do centralised key auth are good, but I think on balance you should just go with certificates. FIDO is cheaper, although obviously if you already have OpenPGP you don't care about that.
Comments (0)
No comments yet. Start the discussion.