Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

github.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#32

Post by nodefortytwo »

vegardx wrote: post #7

You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native after you've pushed your keys using either aws-cli or mssh. It has more or less the same benefits that SSM has, and you can use the same method with ProxyCommand to establish authentication before connecting. You can also chain it using Proxy…

Shameless plug for a tool I build for ec2-instance-connect: https://github.com/nodefortytwo/amz-ssh

I think the advantage of not having to have a public bastion is pretty nice though. I think i'd consider SSM over ec2-instance-connect

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#33

Post by pquerna »

marcinzm wrote: post #29
vegardx wrote: post #27

Earlier quoted context omitted.

It has to use an existing system account, yes. You do lose a lot of auditing abilities this way, since you cannot capture the content. For me this is more about establishing a secure way to grant people access to instances, without something like LDAP or SSH CA. LDAP sends passwords in cleartext over an encrypted channel, I don't like the idea of someone else on the host I'm connecting to being able to read my passwo…

Thanks for the links, Teleport seems especially interesting. Yeah, we are required by contractual obligations to log these things or at least sudo commands. Don't disagree that it's less than useful but only so many things you can argue about. The logging we can do with auditd but we need unique instance users for that to be useful.

(disclaimer, I was a founder of ScaleFT - acquired by Okta)

This is exactly why many customers use Okta's Advanced Server Access: https://www.okta.com/products/advanced-server-access/

It does certificates as a credentialing mechanism, but also full separate accounts, lifecycle management of accounts and sudo files.

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#35

Post by jbergknoff »

We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials.

Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an instance (turning on agent forwarding, etc.) or SCP files back and forth, all the same way that I'd do it with a regular host. But that host doesn't need to be exposed to inbound SSH traffic!

I was also able to get the ProxyCommand working in a Docker container, so I don't have to install the AWS CLI or the SSM plugin on my (Linux) host system, with an .ssh/config entry like this:

  Host i-*
    ProxyCommand docker run -i --rm -v $PWD:$PWD -w $PWD -u 1000:1000 -v ~/.aws:/tmp/.aws -e HOME=/tmp -e AWS_PROFILE  ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'
A few problems in practice:

* We often use our bastions to do port forwarding, e.g. to connect to an RDS instance inside VPC. As far as I know, we can't accomplish this with just SSH over SSM, so we still keep our bastions.

* User management: SSH over SSM doesn't do any user or key management for you (which makes sense). It establishes the SSH connection and you're on your own from there. We use Keymaker [1] to dynamically create user accounts on the EC2 instances, and populate SSH keys according to the user's IAM profile. This works fine, but maybe there's room for simplification.

* Connecting based on instance ids (`ssh i-...`) can be awkward. It would be amazing if we could alias these somehow, like set up a CNAME that points to `i-...`. I wasn't able to get OpenSSH to follow a CNAME and then use the ProxyCommand. Maybe it's possible, though.

[1] https://github.com/kislyuk/keymaker

Re: Show HN: Managing SSH Access to AWS EC2 Instances Using SSM

#36

Post by ReidZB »

jbergknoff wrote: post #35

We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an instance (turning on agent forwarding, etc.) or SCP files back and forth, all the same way that I'd do it with a regular host. But that host doesn't need to be exposed to inbound SSH traffic! I was also able to get the ProxyCommand working in a…

I haven't used it or looked into what it supports, but I did remember this announcement which may interest you: "New – Port Forwarding Using AWS System Manager Session Manager": https://aws.amazon.com/blogs/aws/new-port-forwarding-using-a...

To make the ProxyCommand setup a little easier, perhaps you could use `aws ec2 describe-instances` with the appropriate filter? For example, the article I linked uses:

    INSTANCE_ID=$(aws ec2 describe-instances \
                   --filter "Name=tag:Name,Values=$INSTANCE_NAME" \
                   --query "Reservations[].Instances[?State.Name == 'running'].InstanceId[]" \
                   --output text)
to grab the instance ID from the Name tag. You could set up a shell script as a ProxyCommand to do this automatically, although beware that ProxyCommand's %h will always lowercase the input...
Post reply on HN