Automation with Scalable & Secure SSH
summary
Proposes replacing long-lived SSH keys with SSH certificates signed by role-specific CAs to scale access to thousands of hosts, using principals and CA fingerprints trusted in sshd. Demonstrates role-based CAs for SRE/dev/ansible, certificate force-command and extensions like no-agent-forwarding and source-address binding, certificate revocation via revoked_keys, and one-day validity rotation. Integrates with Ansible by signing control-node identities; demo shows Docker PS restricted access and Ansible ping succeeding after signing, proving the workflow works.
AI-written summary · about
chapters (12)
- 0:00Introduction to SSH automation
- 1:03Why SSH certificates matter
- 3:53SSH certificates explained
- 6:20Configuring SSH to trust CA
- 7:45Security extensions and controls
- 9:33Certificate validity and logging
- 10:39Revoking certificates
- 11:24Role-based certificate strategy
- 12:49Indefinite keys security risks
- 13:54Ansible with SSH certificates
- 16:24Live SSH certificate demo
- 21:32Demo troubleshooting and fixes
related talks
29mSSH Certificates: a way to scale SSH access
41mA better way to SSH: Introducing SSH certificates
44mEngineering Secure SSH Access for Engineers- 44mEngineering Secure SSH Access for Engineers
28mManaging SSH Access without Managing SSH Keys
11mIf You’re Not Using SSH Certificates You’re Doing SSH Wrong
32mKeys or Certs for SSH Access? Why should I care?
45mZero Trust SSH