Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#91

Post by jamiesonbecker »

TheCondor wrote: post #70
jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

Can it verify or enforce that ssh secret keys are password protected?

This wouldn't be possible unless we generated or held the private keys. You cannot tell if the key is password protected from the public key alone.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#92

Post by bsabrin »

fragmede wrote: post #86
jen20 wrote: post #65

Earlier quoted context omitted.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

Using an SSH Certificate Authority is also my recommendation, but be aware that it's relatively new, so associated tooling with it is not super mature yet. In particular, the user still needs some bits in order to login, and whether they generate it themselves and send it off to get signed, or the bits are generated for them on the backend and the user simply needs to receive them, there's a management aspect to it t…

ScaleFT uses a certificate based approach and issues short lived certain for SSH and RDP. Also has a policy engine to set additional access controls.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#93

Post by agrinman »

We just release Kryptonite (https://krypt.co), an HSM for your SSH private key on your phone.

The private key never leaves your phone. Pair your phone with your computer to create a secure channel (channel is encrypted + signed with session keys only known to your computer and phone). Every time you SSH, the computer calls out to your phone over this channel and asks you to approve a signature.

SSH logins with simple push notification approvals. Code is public: https://github.com/kryptco.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#94

Post by rvanlaar »

billyhoffman wrote: post #73
rvanlaar wrote: post #56

I have a similar problem. Keeping check of which certificates are about to expire. I built an MVP to help with that: https://captaincert.net/

Your "Account" link is failing, and also returning a verbose debugging output for Django... https://captaincert.net/accounts/login/?next=/account/

Thank you for taking the time to look around and report back.

These two issues are known. The next step is notifying users via e-mail of expiring certs. Then the account button will be functional.

We're validating the value proposition. I've a real need for this application, but we're trying to see if others have the same need.

Would you like to be notified when the account and reminder functionality goes live?

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#95

Post by rocmcd »

uiri wrote: post #80
rocmcd wrote: post #68

Regarding SSH keys, for anyone using Github organizations, we created a service called GitWarden[1] for automatic syncing of local user accounts/SSH keys with organization teams. This makes it very easy to manage users across your entire infrastructure directly through the Github UI, and have any team changes (add/remove members) reflected locally in near real-time. It also makes it incredibly easy for users to login…

Is there any logging of which ssh key is used? I don't think that I would be comfortable having access to work material from a personal machine, assuming the company is large enough to issue work desktops/laptops.

Not currently, but that's a great point that we haven't considered yet.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#96

Post by cloudposse »

We use the Github API to retrieve public keys and teams to manage membership. Using this app to provision users on servers automatically and serve public keys. Read more here: https://github.com/cloudposse/github-authorized-keys

It supports caching to etcd (incase GitHub API is unavailable).

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#97

Post by edgan »

jamiesonbecker wrote: post #23

I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…

LDAP with caching using SSSD is a better solution. I just implemented it to replace using a configuration management tool. I use the configuration management tool to setup the LDAP server, and LDAP for authentication. But would take the configuration management tool over your toool. Your tool is too niche.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#98

Post by fragmede »

_hyn3 wrote: post #90
fragmede wrote: post #87

Earlier quoted context omitted.

> their account is removed Are you actually removing the unix account? How do you manage uids? How do you prevent reuse? How about over NFS?

Excellent question.. yes, we actually remove the account and pkill any existing sessions owned by the user. The OS might reuse UID's if it wishes. This will cleanly work over NFS as well. (On the server side as well, as long as the NFS server respects POSIX file locking semantics.) The agent (shim) is only a few hundred lines of readable Python that just scripts standard Linux commands, so it plays nicely with other…

> The OS might reuse UID's if it wishes.

If the software doesn't manage UIDs internally then this is a recipe for disaster because keeping UIDs in sync is a PITA. It's a waste of time to do manually, but an even bigger waste of time to have to fight with the OS to get it right. If you're using NFS then you're screwed.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#99

Post by true_tuna »

jen20 wrote: post #65
serkanh wrote: post #52

Earlier quoted context omitted.

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use. This model is described in an excellent post by Facebook from a while back [1]. (Disclaimer: I used to work at H…

You have to build a new ssh CA for each class of server. There's no mechanism for granting access by host name. This becomes unmanageable fast.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#100

Post by true_tuna »

bsabrin wrote: post #92
fragmede wrote: post #86

Earlier quoted context omitted.

Using an SSH Certificate Authority is also my recommendation, but be aware that it's relatively new, so associated tooling with it is not super mature yet. In particular, the user still needs some bits in order to login, and whether they generate it themselves and send it off to get signed, or the bits are generated for them on the backend and the user simply needs to receive them, there's a management aspect to it t…

ScaleFT uses a certificate based approach and issues short lived certain for SSH and RDP. Also has a policy engine to set additional access controls.

I tried to deploy them to grant developers limited time access to the hosts running their services. Didn't really work out and I killed the project.
Post reply on HN