151–160 of 246 posts
Not ideal, but it works... At least until one of us resign (but turnover is quite low here, so crossed fingers).
Earlier quoted context omitted.
> We don't have SSH keys because it's not the 90's and we don't have servers. This seems unnecessarily snarky. There are lots of businesses in 2020 that still maintain their own servers, use ssh keys, and are staffed by admins and developers who very much know what they are doing (and are not at all "behind the times", as this comment seems to imply such businesses are). If that's not what you meant, well, OK, but I…
He'll learn... probably the hard way.
We use vault, but sometimes I just `openssl` gpg encrypt the secrets with the keys of all the members of my team and commit the .gpg to git. We all use yubikeys and use them to SSH. Not ideal, but it works... At least until one of us resign (but turnover is quite low here, so crossed fingers).
We use vault, but sometimes I just `openssl` gpg encrypt the secrets with the keys of all the members of my team and commit the .gpg to git. We all use yubikeys and use them to SSH. Not ideal, but it works... At least until one of us resign (but turnover is quite low here, so crossed fingers).
We use Bitwarden[0] for our secrets. It's open-source with a hosted option. Makes sharing passwords and keys across the team pretty straightforward. In addition to it, we use envwarden[1], which is a simple open-source wrapper around the Bitwarden CLI to manage our server secrets. It's super simple, but does the job for us well. We can then manage both passwords and keys in one place. Disclaimer: I created envwarden.…
I try to push as much to certificate auth as possible. Internal CA keys are stored on an offline USB HSM, which is locked in a cabinet. Access to the key requires 2/10 individuals to be physically present. There are different CAs for different purposes. There's an intermediate for device management, and another for user or service auth purposes.
Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.
We use Azure KeyVault
+1 Worth noting accessible using api via REST https://docs.microsoft.com/en-us/rest/api/keyvault/ and powershell https://docs.microsoft.com/en-us/azure/key-vault/secrets/qui...
The main observation I'd make that if you put your keys somewhere only accessible in production, you've made it impossible to test anywhere except production. If you do that, you need to create a process where people can ship some small bit of code to test if the production key setup genuinely works (hint: it won't).