SSH key management for Guix cloud machines

[Fabio Natali <me@fabionatali.com>]

Hi All,

I wanted to ask what the best practice is (or what people usually do)
when it comes to SSH key management for Guix systems deployed in the
cloud.

In a nutshell, consider a cloud server that's been instantiated out of a
Guix system image. Suppose that the image comes with a predefinded
(passwordless) user and an authorised SSH key for remote access.

On first access, the user is asked to verify and accept the server's SSH
fingerprint, and rightfully so to protect against MITM attacks.

Is there any mechanism that would allow to access the server without
having to trust-on-first-use the server's fingerprint?

In other words, once the server SSH key has been generated, is there any
standard/common way to have the fingerprint published (or somehow
"phoned home")?

In the context of cloud-init, I think this is achieved via the Phone
Home module⁰. I believe Terraform and other orchestration tools also
provide their own solution to this.

Am I missing anything macroscopic here? Is there any similar SSH
phone-home service under Guix? If not, would there be interest around
such a service or potentially to have this functionality as part of the
SSH service?

A cheap (but convoluted) option would be to have the SSH fingerprint
saved in /etc/issue. Some cloud providers allow the possibility to
connect to the machine via a web console. A user would be able to use
the web console to retrieve the key. A bit of a hack, to be honest.

Any idea or comment welcome.

Thanks, cheers,

Fabio.


- 0 https://cloudinit.readthedocs.io/en/latest/reference/modules.html#phone-home


-- 
Fabio Natali
https://fabionatali.com