[old-gregg]

Author here. I mentioned a couple of other benefits in the post, namely TTL (time to live) and the ability to have fine-grained role-based access control. Your servers should use certificate-based auth too, to join a production environment. Then you won't have the trust-on-first-use issue, because server authentication simply compares the CA of a client & server and you don't have the dreadful "are you sure [y/N]" question when connecting to a box for the first time.

Basically, certificates rule the world everywhere, but due to rough UX, they haven't seen broad adoption for SSH. That's until now, hopefully :)

[1] https://en.wikipedia.org/wiki/Trust_on_first_use

[glram]

Thanks for the follow-up! I've always thought the TOFU thing was a huge issue: it's hard to verify the first time and rotating server certs is a nightmare.

Are there any products/tools that make this easier? I've noticed that this isn't common even within companies with robust security infrastructure.

[outworlder]

> Are there any products/tools that make this easier

You just read an article by Gravitational, authors of Teleport. Check them out.

The opensource product is pretty full featured, the commercial version has a few features companies usually need (I believe SSO is one of them). Now instead of having people submit a ticket, send the keys, yada yada, you can just point someone to the portal and they can just use teleport credentials (or if you have the feature, the corp credentials). And the session is recorded. You can also use the command line – and it still gets recorded.

Disclaimer: We use Teleport in our company. I pitched after finding out about them here in HN. We still have bastion hosts, which now automation automatically deploys teleport and they show up in a single place.

[jamieweb]

My own solution to this is to store the server key fingerprints in a public Git repository, which can then be pulled from on all devices that need to be able to connect.

This works nicely for my own personal setup with a few servers. It may be possible to scale this to a larger environment with multiple users too.

Then main benefit is that whenever a server is rebuilt (which can be quite regularly when using infra-as-code/infra automation), I don't have to go and manually update every single client that needs to be able to connect.

https://www.jamieweb.net/blog/managing-your-ssh-known_hosts-...

[old-gregg]

I'm one of the maintainers of https://github.com/gravitational/teleport

Another one to look at is https://github.com/Netflix/bless

Also, if you want to stick with what you have (most likely OpenSSH), we wrote an OpenSSH guide: https://gravitational.com/blog/how-to-ssh-properly/