Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#31

Post by voltagex_ »

jon-wood wrote: post #24
desdiv wrote: post #22

Earlier quoted context omitted.

A comment above, https://news.ycombinator.com/item?id=14321901 , does a similar thing as you, except they use the Github API to fetch the list of usernames. I don't know your use case, but maybe this is useful to you too. > https://github.com/sneak.keys How do you do that? I mistook you for a Github employee at first.

Appending .keys to your Github user profile URL returns SSH keys. Hugely useful in organisations that are using Github for code management already.

Is there any danger to adding keys to the Github account that are used elsewhere?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#32

Post by subway »

voltagex_ wrote: post #29
Pyxl101 wrote: post #27

Earlier quoted context omitted.

Can anyone log into hosts if LDAP is down? Is that a concern? Is there an easy way to mitigate the concern if you wanted to? Interested in exploring this solution, but worried about the availability risk.

In a Windows environment you mitigate this with multiple Directory servers. Users can log onto machines if the credentials are cached, I think. Unsure how PAM handles this on Linux.

Various PAM module handle it differently.

The hotness these days is `sssd`, which transparently tries multiple directory servers (be they AD, IPA, or straight LDAP).

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#33

Post by nicklaw5 »

janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

We also use Ansible for managing SSH keys, though we only have around 20 servers to maintain. We are a small team and dont have a huge staff turnover so managing keys is not huge issue so far. As we grow, however, this procesure may need to be revisited.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#35

Post by subway »

For SSH:

I'm a fan of public key distribution via directory service (LDAP) with failover/caching via sssd. Private key storage on a smartcard (Yubikey in my case)

SSL: It depends on where it's being deployed -- AWS apps use ACM, situations where I need to access the secret from within a running system image (gce/ec2) generally uses the platform's kms long with their object store.

Can't help but notice this account only has two posts, both asking about commercial solutions folks use for secret management. I'm gonna take a stab in the dark and say this is market research?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#36

Post by janvdberg »

drinchev wrote: post #17
janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

Yes, we run it once/only when things (people) change.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#38

Post by yarpyarp23 »

jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

WTF does "all data encrypted at rest with X25519, in motion with TLS" mean?

Why would you mention a public key agreement protocol while mentioning storage at rest, and how on earth do you compare it against TLS? You're comparing apples and watermelon seeds.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#39

Post by mheiber »

It baffles me that nobody seems to have mentioned Hashicorp's Vault yet:

https://www.vaultproject.org https://github.com/hashicorp/vault

It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backends to delegate granular access for all of these features.

It's been an absolutely eye-opener for somebody like me who's used to managing SSH keys/PKIs (what a pain) and I wouldn't want to use anything else right now.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#40

Post by majewsky »

mheiber wrote: post #39

It baffles me that nobody seems to have mentioned Hashicorp's Vault yet: https://www.vaultproject.org https://github.com/hashicorp/vault It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backe…

> https://www.vaultproject.org

That link doesn't work. The correct one is https://www.vaultproject.io

Post reply on HN