This is completely solved by SSH certificates. You still have the same private k...

lelanthran · 2026-04-25T08:58:24 1777107504

> The target machines then just need to put the CA cert in the authorized_keys files.

The word "just" is doing a lot of work there. You update authorized_keys every hour for your entire fleet?

winstonwinston · 2026-04-25T11:04:24 1777115064

No, the ssh CA model works like this: servers trust one CA, and the CA signs user keys. No more distributing individual public keys to every machine.

It is the user machine that needs new certificate signed by the CA once the short-lived one expires.

lelanthran · 2026-04-25T13:19:59 1777123199

Understood. Not a bad idea.

pyvpx · 2026-04-25T09:52:35 1777110755

Sounds like a job for dnssec and sshfp records

Ahh, now you have three problems…hrm

kkl · 2026-04-25T18:14:56 1777140896

SSH CAs are not incompatible with my argument! An SSH CA can sign short-lived certificates for just-in-time generated keys.

azophy_2 · 2026-04-27T07:53:16 1777276396

shameless plug: if your are looking for software that does basically this, you can try my open source project: https://github.com/azophy/sshifu

Its still early, but my aim for this project is to be the simplest/easiest "SSH login via SSO" available on the market. open for feedback & suggestion