Hi All, I wanted to ask what the best practice is (or what people usually do) when it comes to SSH key management for Guix systems deployed in the cloud.
In a nutshell, consider a cloud server that's been instantiated out of a Guix system image. Suppose that the image comes with a predefinded (passwordless) user and an authorised SSH key for remote access. On first access, the user is asked to verify and accept the server's SSH fingerprint, and rightfully so to protect against MITM attacks. Is there any mechanism that would allow to access the server without having to trust-on-first-use the server's fingerprint? In other words, once the server SSH key has been generated, is there any standard/common way to have the fingerprint published (or somehow "phoned home")? In the context of cloud-init, I think this is achieved via the Phone Home moduleā°. I believe Terraform and other orchestration tools also provide their own solution to this. Am I missing anything macroscopic here? Is there any similar SSH phone-home service under Guix? If not, would there be interest around such a service or potentially to have this functionality as part of the SSH service? A cheap (but convoluted) option would be to have the SSH fingerprint saved in /etc/issue. Some cloud providers allow the possibility to connect to the machine via a web console. A user would be able to use the web console to retrieve the key. A bit of a hack, to be honest. Any idea or comment welcome. Thanks, cheers, Fabio. - 0 https://cloudinit.readthedocs.io/en/latest/reference/modules.html#phone-home -- Fabio Natali https://fabionatali.com
