UNIX for Advanced & Expert Users

Hi Gurus,

I am stuck with a problem here for which I need your expert advice.
I need to generate an SSH key in my Sun OS machine which should expire in 2 years. I usually generate the keys using ssh-keygen -t dsa but the keys generated like this would be non-expiring.

I checked for the man pages for ssh-keygen but could not find an option for expiring the key. Another option I could find was to use ssh-add -t xh option which will expire the key in x hrs. Is this the route I should take ? I want to confirm this first since I need to do this in production environment.

Thanks,
Sabari Nath S

Hi Nathsaba,

You are correct with the "ssh-add -t" solution - I think the expirey information is kept with the sshd.

Regards

Dave

I am also thinking of having keys expired in a certain time.
I think that using ssh-add -t n is not what @nathsaba was looking for in the first place, because it's expiring the key added to the agent, not the key itself. The key can be added again after the specified -t n.

To have keys itself expiring I think the only way is to write some script that is keeping track of when keys are added to another server, and then delete the key and the key entries at all servers that have it added in the authorized_keys.
So until anyone else come up with a better idea I will use these scripts.