Installing the ephemeral SSH key demonstrator

The previous article explained ephemeral SSH keys. This is the concrete demonstrator: a Mac runs the certificate issuer, a Rocky Linux VM is the production host, and a normal ssh login uses a one-day certificate held only in the Mac’s ssh-agent. Mac: issuer Rocky Linux: target host ──────────────────────────────────────────── ───────────────────────────────────── ski serve sshd ├── user CA private key ├── public user-CA key ├── local identity and group data ├── local authorization.toml └── issues a short-lived certificate └── ski-authorize helper │ ▲ │ agent forwarding during issuance │ certificate login ▼ │ ssh-agent on the Mac ─────────────────────────────────────────┘ ephemeral private key + certificate The CA private key, issuer database, and user private key remain on the Mac. The Rocky VM receives only the CA public key and its own local authorization policy. Its login path does not contact the issuer. This is a demonstrator, not a production deployment guide. In a real setup,…