Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#41

Post by mheiber »

majewsky wrote: post #40
mheiber wrote: post #39

It baffles me that nobody seems to have mentioned Hashicorp's Vault yet: https://www.vaultproject.org https://github.com/hashicorp/vault It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backe…

> https://www.vaultproject.org That link doesn't work. The correct one is https://www.vaultproject.io

Absolutely, thank you. I'm on mobile right now and was too lazy to check the reference m(

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#42

Post by travisby »

Pyxl101 wrote: post #27
sp0ck wrote: post #14

LDAP as a public key service and servers configured via PAM to use that as source for pub keys. Nothing to distribute. Delete key from LDAP and second later user can't log on any machine. We are analysing teleport ssh suite for possible migration direction. SSL is different story :)

Can anyone log into hosts if LDAP is down? Is that a concern? Is there an easy way to mitigate the concern if you wanted to? Interested in exploring this solution, but worried about the availability risk.

tl;dr: Yes! There's some caching mechanism, _providing_ the user has already logged into the host. Also there seems to be some replication that could help.

in my homelab I'm running RedHat IdM (which is their downstream version of _freeipa_). It's some value-add on top of LDAP on the server side, and sssd on the client side. My IdM runs in a VM on a server that isn't always powered on, and I'm still able to login thanks to sssd being configured to cache.. something. Clearly I haven't played with it as much as I should :).

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#44

Post by travisby »

voltagex_ wrote: post #31
jon-wood wrote: post #24

Earlier quoted context omitted.

Appending .keys to your Github user profile URL returns SSH keys. Hugely useful in organisations that are using Github for code management already.

Is there any danger to adding keys to the Github account that are used elsewhere?

In 99% of cases, no, but longer answer:

Depends on the type and number of bits in the key.

If you create an ssh key that is already broken (say you managed to generate a... 512 byte RSA key), then an attacker would know what key he needs to generate before he attempts to authenticate with your server (or github).

But in practice public keys are meant to be public... very public. Like GPG keys! Here's a debian signing key https://ftp-master.debian.org/keys/archive-key-7.0.asc .

We can even verify that it's an RSA key with 4096... exactly what you could (should?) use to generate SSH keys. Effectively posting your public ssh key in the wild is as safe as debian posting their public signing key :)

``` pub rsa4096/0x8B48AD6246925553 2012-04-27 [SC] [expires: 2020-04-25] Key fingerprint = A1BD 8E9D 78F7 FE5C 3E65 D8AF 8B48 AD62 4692 5553 uid [ unknown] Debian Archive Automatic Signing Key (7.0/wheezy) sub rsa4096/0x85215E51ADD6B7E2 2012-04-27 [E] [revoked: 2014-03-17] ```

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#46

Post by ReligiousFlames »

monkeysphere for personal ssh private keys stored in gpg

chef and hashicorp vault

Another neat thing to deploy into dns is sshfp records so there's almost never ssh fingerprint verification prompts for deployed hosts. Alternatively, ssh host fingerprints can be deployed to LDAP.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#47

Post by Tharkun »

buschtoens wrote: post #19

We don't. As much as I hate do admit it, but I belong to the small Linux minority in my otherwise Windows only business.

We don't either, and we're mostly a Linux shop.

We only have ~10 employees. About half of them are technical staff with some access to certain systems (git, mostly). Only two users have global root access.

Vault (which was mentioned somewhere in these comments) looks interesting, but at our current scale it looks like it might be overkill.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#48

Post by Tharkun »

voltagex_ wrote: post #31
jon-wood wrote: post #24

Earlier quoted context omitted.

Appending .keys to your Github user profile URL returns SSH keys. Hugely useful in organisations that are using Github for code management already.

Is there any danger to adding keys to the Github account that are used elsewhere?

"It depends".

I dislike that Github doesn't explicitly mention that it publishes your public keys, because they can be used to figure out your identity across multiple services. I believe someone a while back posted a demo on HN, where you could SSH in and it would greet you with "hello $yourname", which it derived from your github keys.

My advice: if you use different (user)names for different services, you should probably consider using different SSH keys for them as well. That is, if you don't want those two identities to be tied together.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#49

Post by aren »

voltagex_ wrote: post #30
gingerjoos wrote: post #7

Earlier quoted context omitted.

We've been using Foxpass for more than a year now and can definitely recommend. We have Amazon Machine Images with the required packages installed and configured; we use the web interface to grant/revoke access to users and add SSH keys. So each user logs in as themselves. Aren has been awesome with responding to emails and helping us set it up too.

How does it handle sudoers?

I didn't mention it in the original post, but Foxpass also has an LDAP endpoint so it can manage users and groups on your linux machines.

This means you can set up a linux group with sudo capabilities (sudo or wheel, usually) in /etc/sudoers. Then using Foxpass you can manage the membership of that group by adding users on a permanent or temporary basis.

Post reply on HN