Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

github.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#11

Post by theomega »

vegardx wrote: post #7

You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native after you've pushed your keys using either aws-cli or mssh. It has more or less the same benefits that SSM has, and you can use the same method with ProxyCommand to establish authentication before connecting. You can also chain it using Proxy…

Doesn't that still require the instance to have a public IP? I think the original solution doesn't even need a public IP.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#12

Post by vegardx »

theomega wrote: post #11
vegardx wrote: post #7

You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native after you've pushed your keys using either aws-cli or mssh. It has more or less the same benefits that SSM has, and you can use the same method with ProxyCommand to establish authentication before connecting. You can also chain it using Proxy…

Doesn't that still require the instance to have a public IP? I think the original solution doesn't even need a public IP.

No, but it requires you to either have some kind of peering, Client VPN Endpoint or a bastion host. I prefer a VPN or bastion host, since you add another layer of authentication in between. With Client VPN Endpoint you can also limit network access on a per-user basis to further lock down things.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#13

Post by bkmeneguello »

tilolebo wrote: post #10

Hasn't this been solved by using SSH certificates instead of keys?

I've been using SSH certificates for a while with great success. The only downside, in relation to SSM, is to have to manage your keys an CA, but it worth to avoid vendor lock-in.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#14

Post by nostrebored »

leg100 wrote: post #8

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: gcloud compute ssh GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address. [1]: https://cloud.google.com/compute/docs/instances/managing-ins... [2]: https://cloud.g…

Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#15

Post by dkersten »

nostrebored wrote: post #14
leg100 wrote: post #8

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: gcloud compute ssh GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address. [1]: https://cloud.google.com/compute/docs/instances/managing-ins... [2]: https://cloud.g…

Session manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM service and a websocket connection is established from the machine you need to remote into. A cool solution.

I assume it also logs the access in the SSM audit logs.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#16

Post by williamdclt »

Very funny, we received a ticket from a security audit a week ago asking us to get rid of our bastion and use SSM instead. Having never heard of SSM, being in a rush to a deadline and lacking skills with ops, we kinda panicked. 10min later, we had found the SSM interface in the AWS console, found it extremely easy to use and had deleted our bastion :)

Note: the README says "I found myself in a situation where I couldn't easily copy a file from my machine to the server". Note that you can use S3 for that (`aws s3 cp ...`), though you should be careful with permissions on your S3 bucket

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#17

Post by ses1984 »

leg100 wrote: post #8

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: gcloud compute ssh GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address. [1]: https://cloud.google.com/compute/docs/instances/managing-ins... [2]: https://cloud.g…

I'm pretty sure this only works if you use images with Google's sauce added, which means your instances run Google daemons that do things like network, user, and ssh config.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#19

Post by leg100 »

ses1984 wrote: post #17
leg100 wrote: post #8

Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: gcloud compute ssh GCP takes care of generating a key pair. The GCP linux images configure OpenSSH and PAM to check you have relevant IAM permissions. IAP [2] is used in place of a bastion if the instance doesn't have an external IP address. [1]: https://cloud.google.com/compute/docs/instances/managing-ins... [2]: https://cloud.g…

I'm pretty sure this only works if you use images with Google's sauce added, which means your instances run Google daemons that do things like network, user, and ssh config.

Correct albeit no Google daemons, just OpenSSH server, PAM and NSS configurations:

https://cloud.google.com/compute/docs/oslogin/#how_os_login_...

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#20

Post by marcinzm »

tilolebo wrote: post #10

Hasn't this been solved by using SSH certificates instead of keys?

SSM doesn't require you to manage keys or have a bastion/vpn/public access. It'll also log access attempts, in some cases log commands, and ties into IAM permissions (ie: these people can't access prod but can access test, etc.).
Post reply on HN