Member
This. Also known as bastion. In Brazil we call this "pular no meio" which is not a technical term but describes the feeling perfectly.
One warning: now your jump host is your crown jewel. Backup the keys, monitor it, patch it first.
Smallstep is good but the documentation assumes you know what a provisioner is. I did not. Took me three hours.
Ended up using teleport's tsh for the team features and ignored the rest of the platform. Worked fine for six months until we outgrew it.
This thread went from "I share passwords" to "use a hardware token and a jump host" in twelve replies. Classic.
Member OP
Ok so summary for me: stop sharing passwords, each person makes a key, put the public bits on the servers, maybe a jump host later when we hire more people. And test from the control panel console first so I dont lock myself out.
Does that sound right?
Yes. And run
ssh -v user@hostOne more thing: make a second key for your business partner and keep the passphrase different. If one of you gets phished you do not both fall.