As I have obtained a YubiKey 5, I decided to utilize it for my SSH access as an extra layer of security. Since YubiKey 5 and up support ed25519-sk keys, I'd like to replace my current ed25519 with the new one:
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIImpM6x/HDnRKSFmu8i0RmVlJ32Wem77JOOBJltpJzI7AAAABHNzaDo= itgi@C285
Additional information (in case it's required):
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add new key generated with a security key | operations/puppet | production | +1 -0 | |
| [DNM] Remove old ssh key | operations/puppet | production | +0 -1 |
Please note that not all of our servers have -sk support yet, it's only on systems running Bullseye or newer.
Aha! Yeah I was wondering about that earlier. Will this suffice for running scripts on the maint machines and occasionally performing tasks on stat machines?
Change 921356 had a related patch set uploaded (by Itamar Givon; author: Itamar Givon):
[operations/puppet@production] Add new key generated with a security key
Change 921359 had a related patch set uploaded (by Itamar Givon; author: Itamar Givon):
[operations/puppet@production] [DNM] Remove old ssh key
Seeing now that the maint and stat machines are still on buster. Don't mind stalling it until an upgrade to bullseye.
Since we are not sure how much longer it will take for T329360 and because this ticket would now sit in "stalled" and be checked by a different person on clinic duty each week, how about this:
a) we add the new key in parallel to the old key right now, knowing it won't work yet, but we can still call the ticket resolved.. since why not.. it will then work in the future whenever.. and then you can ask for the old key to be removed after confirming
b) we close this as declined but when the time comes you simply click on "reopen". since.. that's easy.. right.. and nothing has to be recreated.. but it keeps people from checking on the status repeatedly.
Alright! thanks. Well, then let's pick option b). I close this as Declined but it really means "just for now" and once you see this is ready, please just click "reopen" and it should continue as normal. Cheers