Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys • Hacker News Board

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet.

An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication:

https://www.digitalocean.com/community/tutorials/how-to-crea...

This still requires the generation of certificates for users but it doesn't require updating the key material on the servers themselves. Having short-lived user certificates then gives the admin an easy way to revoke access to a server without changing any keys there by simply not issuing a new certificate to the user (and in urgent cases to also revoke the certificate as well before it expires, which requires intervention on the server though).

I really hope that OpenSSH keeps improving their (still largely incomplete) PKI implementation, as I think it's a great feature for larger organizations.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#5

Post by mjlee » Sun, Mar 18, 2018, 10:31 PM UTC

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

I love vault's functionality around this: https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...

Along with something like Packer to bake the cert right into the image.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#6

Post by xg15 » Sun, Mar 18, 2018, 10:48 PM UTC

Slightly off-topic: I've seen a few references to the Asterix A38 scene in open source projects recently and it always seems to be a sure sign the developers are german. Is this actually a german-only thing?

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#7

Post by sz4kerto » Sun, Mar 18, 2018, 11:16 PM UTC

Genuine question: what functionality does this provide that e.g. Ansible doesn't?

With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a file... hm.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#8

Post by sz4kerto » Sun, Mar 18, 2018, 11:17 PM UTC

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

If you're managing large amount of servers and don't want to update configs on the servers themselves then use e.g. OpenLDAP.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#9

Post by tr0ut » Sun, Mar 18, 2018, 11:35 PM UTC

sz4kerto wrote: post #7

Genuine question: what functionality does this provide that e.g. Ansible doesn't? With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a f…

Can you post an example of this? Link works too.

Re: Show HN: SSH Permit A38 – Central Managment and Deployment for SSH Keys

#10

Post by tr0ut » Sun, Mar 18, 2018, 11:38 PM UTC

sz4kerto wrote: post #8

ThePhysicist wrote: post #4

Very interesting project, I've been confronted with this kind of problem (managing SSH access for a large number of users) several times and don't think there's a perfect solution for it yet. An alternative (but also imperfect) solution that I've relied on in the past is using certificate-based authentication: https://www.digitalocean.com/community/tutorials/how-to-crea... This still requires the generation of certif…

If you're managing large amount of servers and don't want to update configs on the servers themselves then use e.g. OpenLDAP.

There is a security issue with using AD/OpenLDAP. That being passwords. An example is you can debug/trace the SSH process and see(log) passwords in clear text.

Now of course this is both a trust and a escalated privilege issue. But a lot harder(impossible) with keys.