Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#11

Post by fjallstrom »

we use the public keys from existing github accounts in our organisation. a little cronjob runs daily on all servers to fetch all keys. http://labs.earthpeople.se/2016/04/controlling-ssh-access-wi...

no idea how secure this is or what implications this could have but it's easy and works well for our use case.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#12

Post by deepsun »

I would prefer to not manage them at all. Let my cloud provider care about SSL (AWS already provides it).

I don't even want anyone (including me) to have access to our SSL certificates. There's no lock-in, I can always change my mind and buy new SSL certs somewhere else.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#13

Post by cheeze »

revicon wrote: post #6

SSL certs are managed by AWS certificate manager and all VMs are deployed via elastic beanstalk or exist as Lambda functions. No SSH access is enabled across any of our infrastructure.

What has your experience been with AWS Certificate Manager?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#14

Post by sp0ck »

LDAP as a public key service and servers configured via PAM to use that as source for pub keys. Nothing to distribute. Delete key from LDAP and second later user can't log on any machine. We are analysing teleport ssh suite for possible migration direction. SSL is different story :)

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#15

Post by [deleted] »

deepsun wrote: post #12

I would prefer to not manage them at all. Let my cloud provider care about SSL (AWS already provides it). I don't even want anyone (including me) to have access to our SSL certificates. There's no lock-in, I can always change my mind and buy new SSL certs somewhere else.

[deleted]

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#17

Post by drinchev »

janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#18

Post by grogenaut »

cheeze wrote: post #13
revicon wrote: post #6

SSL certs are managed by AWS certificate manager and all VMs are deployed via elastic beanstalk or exist as Lambda functions. No SSH access is enabled across any of our infrastructure.

What has your experience been with AWS Certificate Manager?

Cert manager is only for a subset of the aws offerings and I don't think it works for EC2 instances. I know it covers cloudfront, which means it covers static websites under https (CF fronted S3), Api Gateway (which is CF under the covers for the most part), so also Lambda apis. A seperate but same thing covers ELB. I'm not sure that it covers ALB yet.

That said for these services it works very well, except there are some issues with it lagging on sending confirmation emails that just make you retry.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#20

Post by grogenaut »

SSH: Daily key generation and rotation with a 2FA registration system. Keys come from this local daemon, once per ui session / 12 hours. Port knocking to get through bastions. All bastions and config done via enterprise managed setup. You're not on a managed machine, you're not on prod/vpn/ssh/etc.

SSL: AWS KMS style solution which predates it on internal, and new system built on KMS. These systems are merging as KMS takes a lot of the load off. Then it's down to building a key distribution system. All secrets actually stored in this type of system. Devs rarely access secrets directly. Lots of nice "client" wrappers which look like DynamoDBClient, or Mysql driver but actually fetch passwords on a 5 minute rotation from the secret store so a rotation means push new key, wait 5 minutes, pull old keys. Secrets preferably never hit disk.

Not a big fan of vault because it wants to connect in to your hosts to manage and rotate passwords.

Post reply on HN