Lion Cipher Lab
Replace authorized_keys sprawl with an SSH certificate authority and short-lived certs
- Cyber / Security Engineer
- Advanced
- ~75 min
- Free · no account required
Why it matters
Classic SSH access falls apart at scale. Every server keeps its own authorized_keys file, every user's public key has to be copied onto every box, keys never expire on their own, and revoking one person means editing files everywhere at once. On top of that, the first time a client connects it gets the "authenticity of host can't be established" prompt and users just type yes. SSH certificates fix both ends: a certificate authority you control signs short-lived user certs (so a server trusts a person without ever storing their key) and host certs (so the server proves who it is and the…
What you'll learn
- SSH certificate authorities
- Signing short-lived user certificates
- Signing host certificates to kill the TOFU prompt
- sshd_config trust: TrustedUserCAKeys, HostCertificate, RevokedKeys
- Certificate revocation with a KRL
- Judgment: when an SSH CA pays off vs authorized_keys
Steps in this lab
- The problem: authorized_keys does not scale
- Stand up two boxes and feel the BEFORE pain
- Create the USER CA — the root of trust for people
- Tell the server to trust the CA — and delete authorized_keys
- Sign a SHORT-LIVED user certificate and log in with no authorized_keys
- Prove that short-lived really means short-lived
- Kill the TOFU prompt with a HOST certificate
- Revocation, and the judgment that matters