Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#81

Post by [deleted] »

ytta wrote: post #53
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

I thought about doing something like this in the past, did you find this to be relatively profitable? Was it something that a lot of people wanted?

[deleted]

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#82

Post by ruffrey »

drinchev wrote: post #17
janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

For a file, specify state=absent

http://docs.ansible.com/ansible/file_module.html

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#83

Post by [deleted] »

captn3m0 wrote: post #79
sneak wrote: post #9

We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.

>Everyone puts their hsm keys on their github account (and removes all others). How do you ensure that nobody adds another key? I don't think github gives organizations visibility into key changes in user accounts.

[deleted]

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#84

Post by Tharkun »

grogenaut wrote: post #20

SSH: Daily key generation and rotation with a 2FA registration system. Keys come from this local daemon, once per ui session / 12 hours. Port knocking to get through bastions. All bastions and config done via enterprise managed setup. You're not on a managed machine, you're not on prod/vpn/ssh/etc. SSL: AWS KMS style solution which predates it on internal, and new system built on KMS. These systems are merging as KMS…

Interesting. What kinds of tools are you using for your SSH setup?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#85

Post by ineiti »

We were working on a more decentralized solution here: https://github.com/dedis/cothority/tree/master/cisc - unfortunately the update is still 1 month away...

This system uses a set of untrusted nodes that form a permissioned blockchain. Updating the chain requires a threshold of keys stored in the first block. The private keys are distributed over laptops/phones.

A person can have multiple devices that accept/deny new keys, while the servers check periodically for updates and can verify the new ssh-keys are legit by verifying the signatures.

I did a small demo at HotPETs 2016: https://www.securityweek2016.tu-darmstadt.de/fileadmin/user_...

I also hope to have it running again, soon. If anybody is interested, don't hesitate to contact us at linus.gasser@epfl.ch

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#86

Post by fragmede »

jen20 wrote: post #65
serkanh wrote: post #52

Earlier quoted context omitted.

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

Using an SSH Certificate Authority is also my recommendation, but be aware that it's relatively new, so associated tooling with it is not super mature yet. In particular, the user still needs some bits in order to login, and whether they generate it themselves and send it off to get signed, or the bits are generated for them on the backend and the user simply needs to receive them, there's a management aspect to it that isn't a totally solved problem with open source tools.

It's not a difficult problem, mind you, but there was custom code written that runs on developer laptops (OS X and Ubuntu) to support this workflow.

(Despite being a very similar looking string of bytes as more traditional pub/private keys, it's different in the SSH-Agent protocol, so don't assume all ssh-agent-looking daemons support it.)

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#87

Post by fragmede »

jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

> their account is removed

Are you actually removing the unix account? How do you manage uids? How do you prevent reuse? How about over NFS?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#89

Post by bretpiatt »

bluecmd wrote: post #88

We used ScaleFT for Dreamhack ( https://www.scaleft.com/blog/how-dreamhack-used-scaleft-to-s... ) and it was very easy to work with. A very good product if your company simply wants something that works.

Another happy ScaleFT customer at Jungle Disk https://www.jungledisk.com/blog/2016/07/13/behind-the-scene-...

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#90

Post by _hyn3 »

fragmede wrote: post #87
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

> their account is removed Are you actually removing the unix account? How do you manage uids? How do you prevent reuse? How about over NFS?

Excellent question.. yes, we actually remove the account and pkill any existing sessions owned by the user. The OS might reuse UID's if it wishes. This will cleanly work over NFS as well. (On the server side as well, as long as the NFS server respects POSIX file locking semantics.) The agent (shim) is only a few hundred lines of readable Python that just scripts standard Linux commands, so it plays nicely with other tools -- even other logging or user management tools, PAM modules, etc. Also, the shim won't touch any user accounts that it didn't create (tagged in the comment field), so existing system or backup accounts are safe and won't ever be touched.

Here's the source code: https://github.com/userify/shim/blob/master/shim.py#L161

Post reply on HN