Hacker News new | ask | show | jobs
by markmaglana 1686 days ago
It doesn't address the Trust On First Use (TOFU) issue.
3 comments
zdw 1686 days ago
A SSH Certificate Authority signing host keys handles that, but requires additional setup.
link
franga2000 1686 days ago
A quick and dirty way to do this is by syncing the known hosts file between all your clients. Make it writable by only the IT staff in charge of provisioning new systems and have them add the pubkeys during provisioning.
link
csdvrx 1685 days ago
Add SSHP records to your DNS entries, and use DNSSEC or, if you can't, DoH (DNS over HTTPS)
link