Setup Key Expiration regression about netbird HOT 4 OPEN

Also confirmed on v2.1.3 of netbirdio/dashboard image

from netbird.

Hi @timwsuqld, this was an intentional change to have some kind of key rotation for security reasons.
We can discuss if we allow users to have unlimited time keys again as it is the users own risk to decide if he wants that.

from netbird.

@pascal-fischer I'm not asking for unlimited time keys, just the ability to have keys longer than 1 year. We had been using 2 years as the sweetspot to allow rotation, without lots of additional work (rotating the keys requires recreating our deployment packages). Ultimately, we trust our key storage system, so 2 years is a good risk place for us. This is a regression, as we had already been given the ability to create them at 2 years, which has now been removed. I understand changing the UI to just be days, that actually makes it closer to the underlying API, a simple solution is to just allow up to ~750 days is instead of 365.

To be clear, we do try and rotate yearly, but this can't always happen, so having keys last 2 years gives us enough overlap when building our deployment packages.

from netbird.

Just tossing my 2 cents in here as well, being able to set long-lasting keys (including unlimited time) would be massively appreciated. IMO it should be up to the user/admin to work out a balance between risk and operational practicality.

I do appreciate the desire for security though, so perhaps a compromise could work? Some kind of warning and confirmation for long-lasting keys? A nagging indicator if the key is X days old?

Only commenting because I'm absolutely loving my evaluation of Netbird so far but the limited key lifetime is a major deal breaker for getting the rest of my org on board. Being able to set an unlimited time and then managing the rotating and revoking of keys manually would be ideal

from netbird.