Hacker News Reader

Actually, there is third option, AuthorizedKeysCommand, which I like the most for small to medium business.

A program, script or any executable, which outputs (prints in stdout) authorized_keys style formatted data. This data can be pulled from any source.

Thus, if public keys are stored in LDAP and script pulls keys for active users only, public key can be easily revoked by disabling corresponding user account.

View on HN

Hey that's interesting!

I still think it's harder to do this than it is to use certs, since you'll need to build some tooling to securely distribute keys. But that would vary by environment, for sure, and it's conceptually simpler for folks who don't know how certificates work I guess.

Do you know when AuthorizedKeysCommand was added to sshd? Is it available in most distros?

It's too bad there isn't a RevokedKeysCommand! That would make certificate revocation a lot more flexible. I wonder how hard it would be to add.

Reply on news.ycombinator.com