OpenSSH Certificate Authorities by Tim Fletcher

OpenSSH is installed on nearly every virtual machine, physical server and IoT device. OpenSSH is a critical systems administration tool, used to manage everything from the server in the shed to continent spanning collections of systems.

Logging in to OpenSSH quickly and security is normally done with keys, sometimes using strong passwords and hardware key storage but all too often left lying about on laptops.

Managing the list of keys and permissions for an organisation of more than a handful of people rapidly gets challenging, tracking who has used which key to do what even more so.

Using the CA feature of OpenSSH it is possible to remove all this complexity, and leverage OpenSSH to enforce your central policies and provide you with strong audit trails.

Would you like to be able to issue an ssh certificate that allows Joe the new engineer to only login to the systems he’s managing, only valid for a week, and stop him forwarding ports to dodge your firewall? Would you like to be able to do that without touching any of the systems he’s managing?

Would you like a way for your 2 on call engineers to login for 5 minutes to that one critical system, but only if they both agree it’s a good idea without waking you up at 3am?

About FLOSS Spring Conference: The Spring Conference is the UK’s longest running event supporting systems and network administrators. But as FLOSSUK has evolved to support open networks, software, hardware and data so our primary conference has become open to submissions on these areas.
About FLOSSUK: Floss stands for Free and Libre Open Source Software, however as an organisation we also support Open Technology and Open Data so we like to think our name can also mean Free and Libre Open Source Systems. The term Libre is used because the meaning of Free in English is ambiguous. It can mean both free as in gratis – ‘a free lunch’ and the freedom to take what is already known and given and be able to build upon it. Libre means ‘at Liberty’ it means to use, to change, to build upon not to be in receipt without gratis.

[hienlong]

"How do I sign a user's key" slide. Is that command done on host side, client side, or CA server?