I have many servers that shares a common
TrustedUserCAKeys. I want to sign a user certificate so it grants some access on specific servers instead of all of them.
For example, the following command generates a certificate that can be used to log in as root on all servers:
ssh-keygen -s ca -I example -n root id_rsa.pub
I tried the following command, but it generates a certificate that's ... useless.
ssh-keygen -s ca -I example -n root@server1 id_rsa.pub
I intended to generate a certificate that can only sign in as root on server1, but not root on any other server. I've made sure that
server1 is the FQDN on that server (or the complete content of
/etc/hostname). Is there a way to achieve this without touching
sshd_config on any host?