Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

github.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#21

Post by mdekkers »

sz4kerto wrote: post #7

Genuine question: what functionality does this provide that e.g. Ansible doesn't? With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a f…

Nice. I do the same, with Saltstack. I manage all my users' access, including account creation and removal, password setting, and key management. Easy peasy.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#22

Post by teekert »

xg15 wrote: post #6

Slightly off-topic: I've seen a few references to the Asterix A38 scene in open source projects recently and it always seems to be a sure sign the developers are german. Is this actually a german-only thing?

No idea but I'm dutch and this used to be one of my favorite movies, so it could also have been a dev from the Netherlands. I love indeed how it describes bureaucracy but I used to really love that Chef that keeps bringing food enthusiastically.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#23

Post by recentdarkness »

xg15 wrote: post #6

Slightly off-topic: I've seen a few references to the Asterix A38 scene in open source projects recently and it always seems to be a sure sign the developers are german. Is this actually a german-only thing?

Asterix Andy Obelix are big in Germany At least in my childhood:-D But it is French

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#25

Post by AdrianoKF »

edem wrote: post #24

Fun fact: there is a ship by this name: https://www.a38.hu/en/

Not sure if the ship was named after it as well, but Permit A38 references a scene from an Asterix and Obelix animated film (https://en.wiktionary.org/wiki/Passierschein_A38; https://www.youtube.com/watch?v=GI5kwSap9Ug). The comic series by René Goscinni and animated films were very popular in Europe, probably not so much in the US.

Permit A38 refers to a scene where the protagonists are referred multiple times within a overly beaurocratic Roman administrative office, so it has become sort of synonymous with a Sysiphean task in German language (at least in limited circles).

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#26

Post by lima »

sz4kerto wrote: post #7

Genuine question: what functionality does this provide that e.g. Ansible doesn't? With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a f…

It doesn't. A bit faster maybe.

Ansible is perfect for deploying SSH keys.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#27

Post by vertex-four »

tr0ut wrote: post #10
sz4kerto wrote: post #8

Earlier quoted context omitted.

If you're managing large amount of servers and don't want to update configs on the servers themselves then use e.g. OpenLDAP.

There is a security issue with using AD/OpenLDAP. That being passwords. An example is you can debug/trace the SSH process and see(log) passwords in clear text. Now of course this is both a trust and a escalated privilege issue. But a lot harder(impossible) with keys.

There's various methods to put SSH keys in LDAP. LDAP is an extensible database, so you can add a schema to attach SSH keys to a user (various schemas exist) - and the AuthorizedKeysCommand in your sshd_config can be hooked up to any program which can retrieve keys for a given user from anywhere (again, various programs exist).

As an example already put together: https://github.com/jirutka/ssh-ldap-pubkey

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#28

Post by jmcnulty »

sz4kerto wrote: post #7

Genuine question: what functionality does this provide that e.g. Ansible doesn't? With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a f…

You're much better off using AuthorizedKeysCommand as vertex-four suggested, and ditch passwords completely. It just needs to return the SSH public key of the login user. You can get that from any backend you like. If you have an LDAP server, great. But it doesn't have to be anything fancy; you could pull the user's key off a web server!

Distributing accounts and SSH keys via any configuration management system is clunky by comparison, and scales badly when you get to many hundreds of users and thousands of servers.

Post reply on HN