Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

github.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#11

Post by snuxoll »

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

FreeIPA - I wish more people knew about this. You can tie a public SSH key to a user (users can also self-register them) and it is automatically recognized on all hosts joined to the IPA domain, if you want to limit who has access to what the integrated RBAC facilities are there to handle that as well.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#12

Post by detaro »

tr0ut wrote: post #10
sz4kerto wrote: post #8

Earlier quoted context omitted.

If you're managing large amount of servers and don't want to update configs on the servers themselves then use e.g. OpenLDAP.

There is a security issue with using AD/OpenLDAP. That being passwords. An example is you can debug/trace the SSH process and see(log) passwords in clear text. Now of course this is both a trust and a escalated privilege issue. But a lot harder(impossible) with keys.

You can put keys in LDAP.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#13

Post by trashcan »

tr0ut wrote: post #9
sz4kerto wrote: post #7

Genuine question: what functionality does this provide that e.g. Ansible doesn't? With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a f…

Can you post an example of this? Link works too.

Relevant documentation: http://docs.ansible.com/ansible/latest/authorized_key_module...

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#14

Post by tptacek »

What's the advantage to this over setting up an SSH CA?

https://code.facebook.com/posts/365787980419535/scalable-and...

If you're in AWS, you can also look at Bless, which is Lambda-hosted and mints short-lived certificates with a command-line client:

https://github.com/Netflix/bless

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#15

Post by chrisweekly »

snuxoll wrote: post #11
ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

FreeIPA - I wish more people knew about this. You can tie a public SSH key to a user (users can also self-register them) and it is automatically recognized on all hosts joined to the IPA domain, if you want to limit who has access to what the integrated RBAC facilities are there to handle that as well.

Cool! Thanks for the tip! :)

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#16

Post by manigandham »

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

Have you looked at ScaleFT? https://www.scaleft.com

They apply BeyondCorp style management for both server and web access.

There is also Teleport by Gravitational: https://gravitational.com/teleport/

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#17

Post by bhaak »

xg15 wrote: post #6

Slightly off-topic: I've seen a few references to the Asterix A38 scene in open source projects recently and it always seems to be a sure sign the developers are german. Is this actually a german-only thing?

It resonates highly with the kind of bureaucracy that Germans have to put up with.

Therefore it wouldn't surprise me if this scene is most popular with Germans and others nationalities only regard it as a funny, exaggerated sequence. Whereas for Germans it hits close to home.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#18

Post by subway »

tr0ut wrote: post #10
sz4kerto wrote: post #8

Earlier quoted context omitted.

If you're managing large amount of servers and don't want to update configs on the servers themselves then use e.g. OpenLDAP.

There is a security issue with using AD/OpenLDAP. That being passwords. An example is you can debug/trace the SSH process and see(log) passwords in clear text. Now of course this is both a trust and a escalated privilege issue. But a lot harder(impossible) with keys.

If you're using straight passwords, sure, an ssh key (ideally in a directory) is going to beat a password-only login, but that ssh key is still subject to credential theft. I'm in the process of migrating an environment off of ssh-key authentication over to password+otp based kerberos (FreeIPA, though AD makes this easy too). A single password+otp login gets an 8 hour (non-renwable, in this environment) ticket. At the end of those 8 hours, users have to obtain another ticket with a password+otp. What's particularly nifty about this scheme is that it's useful for not only ssh access, but internal https services as well.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#19

Post by aren »

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

We (Foxpass, https://www.foxpass.com/) are a YCS15 company offering a SaaS (or on-prem) service to handle SSH key management & rotation, plus user and group management.

With our API, some customers are creating dynamic access rules (for example, an on-caller might have 'sudo' during their on-call week, but not at other times).

Like a hosted FreeIPA, but more powerful.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#20

Post by toomuchtodo »

tptacek wrote: post #14

What's the advantage to this over setting up an SSH CA? https://code.facebook.com/posts/365787980419535/scalable-and... If you're in AWS, you can also look at Bless, which is Lambda-hosted and mints short-lived certificates with a command-line client: https://github.com/Netflix/bless

If you’re in AWS, wouldn’t SSM agents on instances be preferable to SSH access? That provides for both access control (IAM for user access, SSM documents for constraining command execution authority) and auditing/logging of executed commands (CloudTrail).

This does not work for interactive terminal use cases, but does work (in my experience) if you’re targeting immutable instances. It also has the lovely side effect that you can create scheduled tasks within the AWS control plane (if that’s your cup of tea).

Example SSM client: https://github.com/itsdalmo/ssm-sh

Disclaimer: I’m implementing this in a large enterprise environment.

Post reply on HN