Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage SSH keys and SSL certificates in your company?

news.ycombinator.com

Post reply on HN
Print view View original

111–114 of 114 posts

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#111

Post by atmosx »

blakesterz wrote: post #55
janvdberg wrote: post #3

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…

Do you use Ansible for SSL as well? How do you store the keys?

Using ansible-vault, check out this gist:

https://gist.github.com/tristanfisher/e5a306144a637dc739e7

Having a partly encrypted YAML file is also available since version 2.3.0

Key management and deployment are two different things. Installing up people's private keys on the hosts, doesn't involve any management. It's a standard sysadmin procedure.

Key managements involves policies such as: key rotation, algorithms to use, access restriction control, etc. It is way more daunting and complex. I don't see how ansible what ansible has to do with this, vaultproject on the other hand has most of the these features (and more) build-in. Never used it, but I know about it through a podcast presentation of vault in "Arrested Devops" IIRC.

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#112

Post by seroland86 »

I am the author of a PAM module called Keeto that lets you reuse all key management processes of a PKI for X.509 certificates for OpenSSH. Furthermore a layer has been added to centrally manage access permissions for OpenSSH servers. For further information see: https://keeto.io

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#113

Post by wgoulet »

The company I work for (Venafi), provides enterprise grade SSL certificate and SSH key management solutions. The on-premise enterprise solution provides certificate lifecycle management (monitoring for expiration, automatic renewal, and automatic installation). It provides a REST API so you can automate the process using your toolkit of choice. We've also recently released a new cloud service that offers free certificates for use in dev/test environments (and will have more functionality added soon!)

Re: Ask HN: How do you manage SSH keys and SSL certificates in your company?

#114

Post by Tharkun »

Foxboron wrote: post #69
Tharkun wrote: post #48

Earlier quoted context omitted.

"It depends". I dislike that Github doesn't explicitly mention that it publishes your public keys, because they can be used to figure out your identity across multiple services. I believe someone a while back posted a demo on HN, where you could SSH in and it would greet you with "hello $yourname", which it derived from your github keys. My advice: if you use different (user)names for different services, you should p…

Wrong solution. The main problem that Fhilippo pointed out with the service is that ssh by default gives all keys present inn your keyring, or all keys named id_{rsa,dsa,ecdsa}. What should be done is to never present ALL your keys, but turn on "IdentitiesOnly yes" in your SSH config. Project: https://github.com/FiloSottile/whosthere

Yes, that's part of the solution indeed.
Post reply on HN