New comment by L2hhdGNoZXQv in "Most of what you read on the internet is written by insane people (2018)"

L2hhdGNoZXQv — Fri, 01 Jan 2021 18:03:29 +0000

Upvoting, maybe.

New comment by L2hhdGNoZXQv in "Linux Hardening Guide"

L2hhdGNoZXQv — Thu, 31 Dec 2020 15:09:49 +0000

> If you access many machines, how will you know when one is compromised? How will you prevent an attacker from logging in as you?

Even better is to use SSH certificates. That way you don't have to deal with authorized (usually permanent) keys.

Once the SSH CA is installed in the host, the client can generate temporary asymmetric keys and sign them with the CA key before every connection.

There are a few ways to set up this scenario, here's one using Vault: