There is no good answer if you can’t set up a system that can manage temporary access for your disparate employees.
You can escrow the keys you need off a master and set up hardware devices like yubikeys with word-based passwords unless you want to teach people how to use gpg (you don’t). Then you can put them in tamper evident bags and mail them. You can send unlock passwords once receipt has been confirmed.
Order a laptop with enough USB port types for the systems being used by remote employees in addition to an aegis secure thumb drive. Pull the hard drive and wireless card from the laptop and boot from a Linux live CD for all of the escrow. You can make a local git repo on the thumb drive for version control and store the master as well as stubs, pubs, and private keys. Hell, put the key card passwords in a file on there. Wgaf- that aegis device is going to self-encrypt and format itself if you get the password wrong enough times.
This is all fun and good, but it doesn’t scale. What do you do when you have 20,30,40 employees? What happens when you hire Frank, the non-techie? That’s the guy that needs this the most.
I guess a middle ground is to email out instructions for people to generate key pairs with passwords, have them send in their public keys, and start using something like sssd for ldap based auth where you can store their public keys in their user attributes.
Anyway, it’s still a problem we’re all interested in a push-button answer to.
Order a laptop with enough USB port types for the systems being used by remote employees in addition to an aegis secure thumb drive. Pull the hard drive and wireless card from the laptop and boot from a Linux live CD for all of the escrow. You can make a local git repo on the thumb drive for version control and store the master as well as stubs, pubs, and private keys. Hell, put the key card passwords in a file on there. Wgaf- that aegis device is going to self-encrypt and format itself if you get the password wrong enough times.
This is all fun and good, but it doesn’t scale. What do you do when you have 20,30,40 employees? What happens when you hire Frank, the non-techie? That’s the guy that needs this the most.
I guess a middle ground is to email out instructions for people to generate key pairs with passwords, have them send in their public keys, and start using something like sssd for ldap based auth where you can store their public keys in their user attributes.
Anyway, it’s still a problem we’re all interested in a push-button answer to.