In our new stuff at aws we are storing public SSH keys in IAM and using a slightly modified version of https://github.com/widdix/aws-ec2-ssh to authenticate / synchronise users. So far it looks like it ticks all boxes for us.
Ask HN: How do you manage SSH keys and SSL certificates in your company?
61–70 of 114 posts
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#62We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…
How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.
There are two states that we're talking about.
* Ensure that the following key is present.
* Ensure that only the following keys are present.
You can accomplish the second one with the 'exclusive' flag.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#63FreeIPA
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#64Earlier quoted context omitted.
How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.
There are two states that we're talking about. * Ensure that the following key is present. * Ensure that only the following keys are present. You can accomplish the second one with the 'exclusive' flag. http://docs.ansible.com/ansible/authorized_key_module.html
There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed.
That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#65It baffles me that nobody seems to have mentioned Hashicorp's Vault yet: https://www.vaultproject.org https://github.com/hashicorp/vault It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backe…
So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.
A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use.
This model is described in an excellent post by Facebook from a while back [1].
(Disclaimer: I used to work at HashiCorp, and put this model into production there, though the Vault support for issuing short-lived certificates was added after I left)
[1]: https://code.facebook.com/posts/365787980419535/scalable-and...
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#66Earlier quoted context omitted.
So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.
A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…
As a follow up - I would now also take a _very_ serious look at Teleport [1] for managing SSH.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#67monkeysphere for personal ssh private keys stored in gpg chef and hashicorp vault Another neat thing to deploy into dns is sshfp records so there's almost never ssh fingerprint verification prompts for deployed hosts. Alternatively, ssh host fingerprints can be deployed to LDAP.
> Another neat thing to deploy into dns is sshfp records
For those wondering, [1] provides a bit of a background on SSHFP records. You can only skip host-key checking entirely if it's served with DNSSEC, although that might be easier if you're running internal DNS.
How do you have your system working? Its something I've fiddled with briefly, but ultimately gave up on for now.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#68Regarding SSH keys, for anyone using Github organizations, we created a service called GitWarden[1] for automatic syncing of local user accounts/SSH keys with organization teams. This makes it very easy to manage users across your entire infrastructure directly through the Github UI, and have any team changes (add/remove members) reflected locally in near real-time. It also makes it incredibly easy for users to login, as they just use their Github username and any SSH key from their Github profile. There's a full demonstration in one of our blog posts here[2] for anyone interested.
This is a new service we recently launched, so any feedback would be greatly appreciated! My email is in my profile, if you would like to reach me directly.
[1] https://gitwarden.com [2] https://gitwarden.com/blog/2017/05/04/first-steps-with-gitwa...
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#69Earlier quoted context omitted.
Is there any danger to adding keys to the Github account that are used elsewhere?
"It depends". I dislike that Github doesn't explicitly mention that it publishes your public keys, because they can be used to figure out your identity across multiple services. I believe someone a while back posted a demo on HN, where you could SSH in and it would greet you with "hello $yourname", which it derived from your github keys. My advice: if you use different (user)names for different services, you should p…
Wrong solution.
The main problem that Fhilippo pointed out with the service is that ssh by default gives all keys present inn your keyring, or all keys named id_{rsa,dsa,ecdsa}. What should be done is to never present ALL your keys, but turn on "IdentitiesOnly yes" in your SSH config.
Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?
#70I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…
Can it verify or enforce that ssh secret keys are password protected?