ef.gy is a personal technical blog on server software, SSH hardening, nginx, PostgreSQL, and privacy-minded tinkering.
HN commenters link its posts on SSH certificates, SSD write endurance, and why FastCGI is pointless in favor of reverse proxying HTTP.
Ok, thank you both. Makes a lot of sense. It's not what I need, but that's fine :-)
I've not really looked hard at (open)ssh and kerberos before - as far as I can tell, (open)ssh doesn't support kerberos fully - that is - it's not possible to simply use kerberos to authenticate both client and server to each other?
> When you say "simply automating the signing of ssh server certs", what differences do you mean from this? Because that's what this is -- automating the signing of ssh server certs.
I suppose the fact that you already have an x509 (and kerberos) infrastructure was one thing I didn't "expect" - ideally either one of those should be enough to identify server/services and users to each other -- I absolutely see the sense in leveraging that to automate ssh server cert generation - but it strikes me as a roundabout/complex way of solving the trust issue. Then again, composing a few simple tools might be better than trying to secure/get something like https://tools.ietf.org/html/rfc6187 to work...
In essence this places trust in the x509 infrastructure - I'm always a bit skeptical of schemes (most of which I must admit I've thought up myself at one time or another) that end up being "ad-hoc kerberos with public keys". They all feel straightforward on paper, but then I remember how many issues there were with getting kerberos to the place it is today, that is to say create an actually secure system...
I suppose strictly speaking, this is automating the signing of…
I was referring to the release announcement back in 2014 or so which I'm unfortunately not able to find (there was more than a bit snarkiness towards CGI programming).
I'm aware what FastCGI is ;) Btw. if you're interested in native HTTP I'd be looking into nghttp2 rather than FastCGI and OBSD's httpd.
Edit: see also https://ef.gy/fastcgi-is-pointless and https://news.ycombinator.com/item?id=9202039 (previous discussion of OBSD's httpd)
OpenSSH supports server verification via certificates. So one can sign all his installations with common trusted certificate and do not reinvent the wheel. Certificate authentication may be applied both for client and server.
Related readings:
https://ef.gy/hardening-ssh
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-using_openssh_certificate_authentication
Why bother with FastCGI? Why not just use reverse proxy HTTP instead? Why introduce yet another protocol when HTTP works fine?
I didn't write this, but I agree with it - https://ef.gy/fastcgi-is-pointless
after pushing "over SSH" i see only importing a private key.
please note that i am talking about SSH certificate,
not SSL certificate. https://ef.gy/hardening-ssh
For Windows there is CrystalDiskInfo[1]
[1] https://crystalmark.info/en/software/crystaldiskinfo/
Also relevant: https://ef.gy/statistics:ssd-write-endurance