sercanto/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

darwin/keys/ma27: rotate once again

Browse source 
It turns out that when using PIV rather than OpenPGP for SSH
(`yubikey-agent` in this case), you cannot change the touch policy for
enrolled keys[1].

However, it turns out that the default (`always` - touching the key for
each SSH auth) is pretty annoying when running remote builds or making
SSH signatures, so I had no choice but to rotate the keys once again.

It's not urgent at all to get this key deployed, I'm only filing this
patch now to check every box on my "SSH rotation checklist" so I don't
forget about it. Happy holidays 🎉

Finally, sorry for the additional noise!

[1] https://docs.yubico.com/yesdk/users-manual/application-piv/pin-touch-policies.html#touch-policies
This commit is contained in:
Maximilian Bosch 2023-12-24 13:57:20 +01:00 • committed by zowoq
parent 634400ade2
commit f333f4e99d
1 changed files with 2 additions and 2 deletions

4
modules/darwin/community-builder/keys/ma27
View file

@ -1,2 +1,2 @@
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOKGR4pnQ48JkGNoX6lZnBHPPR2XPw7CpDxzD/25SH1PhRl8a1prl9wVs6UVOY4Jf380EdICO9CWcO9Gdmcetj0= ma27@yk53
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBSfK2kLF1CprfwHsmUgb5JkBmfobIOGKWjeWqZaJrtaokCC++K4geY5VqzZK4xM2QkUIA+HvVotLNQpZnvI44s= ma27@yk72
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKm1DlPcQoJqhyPp1S9qf0aU509Jk6xMDuK/OhrAyhaf7EzfnlaskOTdkwaHbj/yLuZrxfMvX/BxVARWwZOolkM= ma27@yk53
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF2naBi6O8+L8U4gfn4of2HycJNaUbO+VM6334hxa77Klldkqs9gUICy7bZDsNQXzas9VPmkBiOhInPO0W8ew0A= ma27@yk72