<html><head></head><body><div>Hey,</div><div><br></div><div>On Tue, 2022-12-13 at 14:47 +0100, Diego Zuccato wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>What's the recommended way to deploy (or re-deploy) security-sensitive </div><div>objects (just to say one: private ssh key to avoid client warnings when <br></div><div>redeploying a server)?<br></div></blockquote><div><br></div><div>For things like ssh host keys I have a command that we run which copies them into the NFSROOT, and then a cron job that runs every minute that removes "expired" files from the NFSROOT. Given our NFSROOT is on a restricted network I feel that is sufficient.</div><div><br></div><div>I know someone who had GPG encrypted tarballs, but that required entering a passphrase during the build process.</div><div><br></div><div>Another option for ssh which I am considering is using PKI for it. Then servers and clients just need to trust a CA.</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"></blockquote><div><br></div><div>Cheers,</div><div>Andrew</div><div><span><pre>-- <br></pre><pre>Andrew Ruthven, Wellington, New Zealand
andrew@etc.gen.nz |
Catalyst Cloud: | This space intentionally left blank
https://catalystcloud.nz |
</pre></span></div></body></html>