Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#51

Post by dgl »

sneak wrote: post #9

We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.

Sounds like you've gone to a lot of effort to use a HSM (good) but then put all your trust in github.

At least github supports two factor auth, but you're still placing trust in a third party.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#52

Post by serkanh »

mheiber wrote: post #39

It baffles me that nobody seems to have mentioned Hashicorp's Vault yet: https://www.vaultproject.org https://github.com/hashicorp/vault It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backe…

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#53

Post by ytta »

jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

I thought about doing something like this in the past, did you find this to be relatively profitable? Was it something that a lot of people wanted?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#54

Post by PeterisP »

Kiro wrote: post #16

The sysadmin just adds each employee's key to the servers. From reading this thread it sounds like bad practice?

This works up to some point. It works if you have a small number of servers, a small number of people, and 'who can access what' is simple and obvious, but as soon as one of these conditions is exceeded, it becomes unmanageable.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#55

Post by blakesterz »

janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

Do you use Ansible for SSL as well? How do you store the keys?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#57

Post by inopinatus »

Last time I did ssh key distribution on a global scale it was with cvs, cron, and makefiles. Self-generation of key with gated registration to central repository, auth'd via k5, distributed via cvsup (remember that?). Automatic expiry according to configurable policy. Two-person-rule for root trust and policy changes. We also modified sshd for better key usage auditing.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#60

Post by throwaway18917 »

blakesterz wrote: post #55
janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

Do you use Ansible for SSL as well? How do you store the keys?

Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally).

I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.

Post reply on HN