Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#101

Post by true_tuna »

edgan wrote: post #97
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

LDAP with caching using SSSD is a better solution. I just implemented it to replace using a configuration management tool. I use the configuration management tool to setup the LDAP server, and LDAP for authentication. But would take the configuration management tool over your toool. Your tool is too niche.

Fox pass has a nice hosted ldap solution which includes ssh key management.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#102

Post by mbubb »

janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

This works pretty well - we manage ~ 300 severs in a similar manner. One wrinkle is that I ask the new user to add their keys to their github account (ie github.com/.keys ) which gives them the ability to add/del keys and jira me to update their user.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#103

Post by mmalone »

jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

  > paranoid levels of security

  > # paste this into your terminal
  > # and get started in seconds..
  > curl -# https://usrfy.io/signup | sudo -sE
:O

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#104

Post by grogenaut »

Tharkun wrote: post #84
grogenaut wrote: post #20

SSH: Daily key generation and rotation with a 2FA registration system. Keys come from this local daemon, once per ui session / 12 hours. Port knocking to get through bastions. All bastions and config done via enterprise managed setup. You're not on a managed machine, you're not on prod/vpn/ssh/etc. SSL: AWS KMS style solution which predates it on internal, and new system built on KMS. These systems are merging as KMS…

Interesting. What kinds of tools are you using for your SSH setup?

in house. you may be able to figure out where I work from my history which would explain why.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#105

Post by jacques_chester »

At Pivotal we're building CredHub for managing SSH keys, TLS certs, as well as passwords and arbitrary values.

It's specifically being built for particular systems to consume, and slowly generalised as it goes. The first consumer is BOSH. Typical BOSH deployments can have dozens or even hundreds of sensitive credentials to manage. Across a large company it quickly escalates into the thousands.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#107

Post by jamiesonbecker »

mmalone wrote: post #103
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

> paranoid levels of security > # paste this into your terminal > # and get started in seconds.. > curl -# https://usrfy.io/signup | sudo -sE :O

This brings up a more complex debate.

In order to be effective, signatures have to come from a root of trust. Where are you forming a trust basis for a signature in the curl? The GPG sigs built into your package manager are signed by the packager and form a cascading tree of trust, and the TLS certifcate authority system is also supposed to form a foundation for trust. (Sigs are on the file, but where do you get the packager's first signature in this place? curl from https piped into sudo doesn't decrease the CA trust model and a sig on the file as well doesn't add anything, since the sig would be easily replaced by anyone with the wherewithal to mod the original file.

Instead, that sig would be security theater, much like an EV-TLS cert. (Not that security theater can't still be valuable from a marketing perspective from people who think that checking sigs on an https site is still valuable.)

While there can be security value in sigs, it doesn't come into play in these circumstances without starting from a position of a signed sig from somewhere, and ultimately the smart and paranoid will still curl to a file and actually read the script. Actually, ultimately, if you are in a security sensitive situation, you are probably not in the cloud at all, or on dedicated instances, and then you should avoid SaaS and cloud software altogether and look at an on-premise solution like Userify Express/AWS/Enterprise, as then you will have that crucial foundation of trust in your initial purchase and you can tightly control that environment.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#108

Post by jamiesonbecker »

ytta wrote: post #53
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

I thought about doing something like this in the past, did you find this to be relatively profitable? Was it something that a lot of people wanted?

No, it's a terrible space. Pick something less noisy and with fewer competitors. Like log management. ;)

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#109

Post by jamiesonbecker »

fragmede wrote: post #98
_hyn3 wrote: post #90

Earlier quoted context omitted.

Excellent question.. yes, we actually remove the account and pkill any existing sessions owned by the user. The OS might reuse UID's if it wishes. This will cleanly work over NFS as well. (On the server side as well, as long as the NFS server respects POSIX file locking semantics.) The agent (shim) is only a few hundred lines of readable Python that just scripts standard Linux commands, so it plays nicely with other…

> The OS might reuse UID's if it wishes. If the software doesn't manage UIDs internally then this is a recipe for disaster because keeping UIDs in sync is a PITA. It's a waste of time to do manually, but an even bigger waste of time to have to fight with the OS to get it right. If you're using NFS then you're screwed.

Usernames are one-for-one correlations with UID, so just don't allow users to personally owning files outside of their /home (they shouldn't according to FHS/LSB/POSIX/etc).

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#110

Post by blue6249 »

true_tuna wrote: post #99
jen20 wrote: post #65

Earlier quoted context omitted.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

You have to build a new ssh CA for each class of server. There's no mechanism for granting access by host name. This becomes unmanageable fast.

You can represent that pretty easily with principals. Just make sure that each host has itself listed as a principal and generate keys that contain that same string. It's pretty common to have a set of increasingly general principals (I.e. Hostname, cluster, tier, root@everywhere).
Post reply on HN