nix for local machine config, Terraform for VM wrangling, and Ansible to orchestrate it all
Comment on What is the best trategie to refresh ssh keys?
solrize@lemmy.ml 3 days ago
Do you think they are compromised? Generally you have to invalidate the public keys in any .ssh_hosts file that accepts them, and create new ones instead. I generally install .ssh_hosts on remote machines using an ansible playbook. I don’t have any automation to cycle them but I guess I would also do that with ansible if I thought it were needed.
Ansible may be old school by now, but it works for me. Maybe the cool kids are using something newer now. I want to look into nix or guix one of these days.
4am@lemmy.zip 3 days ago
amateurcrastinator@lemmy.world 2 days ago
Can you expand a little bit on that please?
Anekdoteles@feddit.org 2 days ago
Wouldn’t automation based on your approach be really easy? Like correct me if I’m wrong, but I assume you just need a chron job executing ssh-keygen on your localhost, adding the new pub to ansible, rolling out and removing the old, right?
solrize@lemmy.ml 1 day ago
It’s possible but I haven’t felt the need, and it’s another thing that can go wrong. If I think my key may have been compromised I have much bigger problems. I should assume my whole machine is pwned and trojan’d, so I should replace the disk and reinstall everything.
I can see some benefit in using a special token to hold the key instead of just generating it on my laptop. One of these days.
ratatouille@feddit.org 3 days ago
Not compromised. But my key is around 20 years old. I’m a family admin and support my family since then with Linux and some selfhostung services.
Meanwhile I need an identity provider or something else and in any case ssh feels like a more of a pain to manage.
solrize@lemmy.ml 3 days ago
Are you running a planet-wide server farm from your 20 year old key or what? Just a few machines? If you want to regenerate your key and fixes the knownhosts files and it’s not too much hassle, then go ahead and do it. Do something else later if you want something fancier. Yes there are some hardware key encaapsulation approaches possible, some people like to use jump hosts as gateways (the remote hosts firewall block access to anything but the jump host) etc. Also people rely in part on virtual LSN security in their data centers or ISP’s.
If it’s just a few personal machines you’re probably overthinking this. I just don’t store secret keys on any remote machines, but use ssh-keygen on my laptop and ssh -A from there.
slazer2au@lemmy.world 3 days ago
Ansible is not old-school. Shame on the person telling you that.
B0rax@feddit.org 3 days ago
Man, I really need to learn ansible…
slazer2au@lemmy.world 3 days ago
Learn Linux TV on YouTube has an awesome series on it.