Using certificates for SSH authentication
Using certificates for SSH authentication
Posted Nov 9, 2022 15:58 UTC (Wed) by Cyberax (✭ supporter ✭, #52523)In reply to: Using certificates for SSH authentication by grawity
Parent article: Using certificates for SSH authentication
Anything that uses a trusted third party to produce and validate authentication tokens looks like Kerberos.
Kerberos is something that JustDoesn'tWork(tm). Quite simply. It can go wrong in many, many different ways that are impossible to debug. For example, I once spent a week debugging Putty only to find out that it linked with Heimdall Kerberos libraries instead of MIT Kerberos.
And Kerberos is also very hard to set up. And there's also very little support for 2FA in common tools like kinit. Etc.
Additionally, Kerberos requires constant connection to the KDC, while SSH CAs just need to be able to put the CA root certificate on machines once (it can even be baked-in during the image creation). You don't need to enroll instances individually (although it might be a good idea, for machine certs).