It's actually 2 factors in our setup, the ssh certificate is created using MFA (and have a short lifetime), and the pubkey is the users own private key. This prevents getting into the system if you have control of the MFA setup (which is handled by another team) or getting into the system without MFA :-) Op wo 3 feb. 2021 om 23:43 schreef asymptosis <asymptosis@xxxxxxxxxx>: > > >But I want to have a rule that one of those 2 pubkeys *must* be a > >certificate, so the user uses 1 certificate and 1 normal pubkey > >instead of 2 normal pubkeys. > > Ah, I see. I'm not sure about that, perhaps it cannot be done. > > What's the reason for doing this? You don't increase security by imposing more layers of the same factor. Security is increased by imposing multiple factors, such as requiring a key and restricting logins to only whitelisted IP addresses. A key and a cert are both basically the same type of factor (something-you-have). _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
