- 30comments
- 17comments
- 514comments
- 126comments
- 1comments
- 211comments
- 73comments
- 162comments
- 30comments
- 66comments
- 136comments
- 227comments
- 7comments
- 86comments
- 21comments
- 49comments
- 52comments
- —discuss
- 23comments
- 37comments
- 35comments
- 9comments
- 6comments
- 363comments
- 46comments
- —discuss
- 104comments
- 34comments
- 39comments
- 38comments
Disclaimer: I code-review OpenSSH yearly.
Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server.
But then again, I could be wrong.
Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.
And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.
Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that.
https://egbert.net/blog/articles/ssh-openssh-certificates.ht...
You can use a self-hosted identity provider with OPKSSH. OPKSSH is just the protocol and the software that plugs an identity provider into SSH. Lots of people use it with authentik instances they run themselves.
SSH certificates are fantastic. OPKSSH wouldn't work without them.
Will check it out.