Doesn't remove all keys
Opened this issue · 1 comments
Something I noticed when cleaning up my keys here on Github is that gh-auth remove .... only removes the keys that the API reports the user had, not necessarily all of the keys in the authorized_keys file that are associated with that user.
For example, if you have 3 auth keys on your Github account, are added to a server, remove one of the keys from your account and then are removed from the server with gh-auth remove ..., only 2 keys will be removed from the authorized_keys file.
Does this pose a potential security issue? I would guess not, since you should only be adding people that you trust, but if someone wanted to be sneaky and try to have access to the server after you've removed them, I feel like this could be a problem.
@alexlafroscia Good point! Thank you. Since we're sticking the GitHub usernames in the keys file now, it might be a good idea to key off that instead.