Do you use - Universal SSH Key Manager, ManageEngine Key Manager Plus, Cyberark Solution, or any other tool? Tips please.
Ask HN: How do you manage SSH keys and SSL certificates in your company?
1–10 of 114 posts
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#2My company Foxpass (YC S15) has a product to manage SSH keys. It serves as access control too -- the keys are only available on the hosts where a user should have access.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#3We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ servers are updated.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#4Maybe we're old school, but we use autofs and nfs to mount homedirs and ssh keys on demand. Puppet handles host ssh keys across machine rebuilds. It works well, no need to replace it IMHO.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#5At my previous company, we used Puppet to distribute both. SSH public keys were part of a developer's intranet profile, and SSL certificates were managed on a central repo.
Updates to either would be passed on to Puppet and distributed automatically across 1400 machines.
(Edit for typo)
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#6SSL certs are managed by AWS certificate manager and all VMs are deployed via elastic beanstalk or exist as Lambda functions. No SSH access is enabled across any of our infrastructure.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#7My company Foxpass (YC S15) has a product to manage SSH keys. It serves as access control too -- the keys are only available on the hosts where a user should have access. https://www.foxpass.com/
We've been using Foxpass for more than a year now and can definitely recommend. We have Amazon Machine Images with the required packages installed and configured; we use the web interface to grant/revoke access to users and add SSH keys. So each user logs in as themselves.
Aren has been awesome with responding to emails and helping us set it up too.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#8SSH keys - OpenPGP smartcards (E.G yubikeys)
SSL Certs - vault PKI (internal) AWS ACM (external)
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#9We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys.
Everyone puts their hsm keys on their github account (and removes all others).
We fetch the keys for each user from github on system init. e.g.
When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#10We use CFengine 3 to manage personal accounts and ssh keys on servers. As CFengine continuously checks and converges configuration, if someone set bad permissions on their ssh file or remove the authorization it is automatically corrected before five minutes have elapsed.