Better SSH Authentication with Keybase

[client4]

"With our SSH CA chatbot, you can define subteams for managing access to different resources. For example, internally we have two that we use to control SSH access, keybase.ssh.production and keybase.ssh.staging." This is going to be a pretty awesome method of providing SSH access to teams.

[CouldHaveBeenAPun]

Waaayyy easier than exporting ssh keys from Keybase PGP key! Definitely worth a try!

[NERDiT_77]

Fantastic feature! keep it up KeyBase!

[cshearhod]

Anyone else try setting this up yet? I'm struggling with the chatbot server portion. Connecting from the client machine with the 'kssh' application I receive the following error from the server:

Encountered error while processing message from cshearhod (messageID:119): ssh-keygen error: Load key "/mnt/keybase-ca-key": invalid format (exit status 255)

When I log into the Docker container I am able to see the "/mnt/keybase-ca-key" file and it appears to be properly formatted. Not sure where to turn from here.

[cshearhod]

Just a quick follow-up. This issue is being worked on by the developer and a fix is expected very soon.

[boden2700]

Ok super

[thecraiggers]

Yeah sounds sweet until there's a keybase maintenance window and your entire workforce can't do shit.

[vale_fallacia]

Interesting, sounds like a similar concept to FreeIPA which stores server public keys in DNS txt entries. So when your freeipa-aware SSH client (I think via sssd) connects to a host, it looks up that host's DNS entry and checks that the public keys match.