Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#71

Post by dkhenry »

drinchev wrote: post #17
janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

You can have Ansible generate the authorized_keys file from a list of public key files, then when that list changes ansible will detect that the file has changed and will copy over the new file.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#72

Post by markpeek »

jen20 wrote: post #65
serkanh wrote: post #52

Earlier quoted context omitted.

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

Agreed on an SSH Certificate Authority being a good solution. Another open source project (disclaimer: I'm affiliated with it) which provides approval controls is available here: https://github.com/cloudtools/ssh-cert-authority

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#73

Post by billyhoffman »

rvanlaar wrote: post #56

I have a similar problem. Keeping check of which certificates are about to expire. I built an MVP to help with that: https://captaincert.net/

Your "Account" link is failing, and also returning a verbose debugging output for Django...

https://captaincert.net/accounts/login/?next=/account/

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#74

Post by mi100hael »

jen20 wrote: post #65
serkanh wrote: post #52

Earlier quoted context omitted.

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

One other handy feature that we're using is the ability for Vault to set user IDs in the signed key ID field which then get logged by sshd on the remote host. That way we can still audit who exactly logged in if using a single user on the remote host.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#75

Post by stephenr »

Pyxl101 wrote: post #27
sp0ck wrote: post #14

LDAP as a public key service and servers configured via PAM to use that as source for pub keys. Nothing to distribute. Delete key from LDAP and second later user can't log on any machine. We are analysing teleport ssh suite for possible migration direction. SSL is different story :)

Can anyone log into hosts if LDAP is down? Is that a concern? Is there an easy way to mitigate the concern if you wanted to? Interested in exploring this solution, but worried about the availability risk.

Apart from the caching stuff mentioned in other replies, this is why you have multiple ldap servers in a HA replication setup.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#76

Post by revicon »

cheeze wrote: post #13
revicon wrote: post #6

SSL certs are managed by AWS certificate manager and all VMs are deployed via elastic beanstalk or exist as Lambda functions. No SSH access is enabled across any of our infrastructure.

What has your experience been with AWS Certificate Manager?

It's been pretty seamless. We use it for our static website on S3 and for our elastic load balancer on elastic beanstalk. I'm guessing in a year all the other cloud providers will follow suit with similar offerings now that heroku and AWS both provide SSL certs out of the box.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#77

Post by [deleted] »

ytta wrote: post #53
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

I thought about doing something like this in the past, did you find this to be relatively profitable? Was it something that a lot of people wanted?

[deleted]

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#78

Post by scurvy »

stephenr wrote: post #75
Pyxl101 wrote: post #27

Earlier quoted context omitted.

Can anyone log into hosts if LDAP is down? Is that a concern? Is there an easy way to mitigate the concern if you wanted to? Interested in exploring this solution, but worried about the availability risk.

Apart from the caching stuff mentioned in other replies, this is why you have multiple ldap servers in a HA replication setup.

Yeah running multiple servers is easy and the daemons are very mature at this point. LDAP daemons aren't crash prone. I haven't had an LDAP outage in over 10 years.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#79

Post by captn3m0 »

sneak wrote: post #9

We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.

>Everyone puts their hsm keys on their github account (and removes all others).

How do you ensure that nobody adds another key? I don't think github gives organizations visibility into key changes in user accounts.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#80

Post by uiri »

rocmcd wrote: post #68

Regarding SSH keys, for anyone using Github organizations, we created a service called GitWarden[1] for automatic syncing of local user accounts/SSH keys with organization teams. This makes it very easy to manage users across your entire infrastructure directly through the Github UI, and have any team changes (add/remove members) reflected locally in near real-time. It also makes it incredibly easy for users to login…

Is there any logging of which ssh key is used? I don't think that I would be comfortable having access to work material from a personal machine, assuming the company is large enough to issue work desktops/laptops.
Post reply on HN