SSH Emergency Access

#1

Post by based2 » Sat, Jul 04, 2020, 10:16 AM UTC

Re: SSH Emergency Access

#2

Post by noodlesUK » Sat, Jul 04, 2020, 11:34 AM UTC

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

Re: SSH Emergency Access

#3

Post by nix23 » Sat, Jul 04, 2020, 12:12 PM UTC

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

Maybe monitor the Emergency Machine itself? If it boot's up, emergency credentials are probably used?

But really good point, and i love the analogy to 'break glass'

Re: SSH Emergency Access

#4

Post by withinboredom » Sat, Jul 04, 2020, 12:12 PM UTC

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

You can physically put the (yubikey) device in a vault that will physically sound an alarm when opened. It could also have a battery-powered arduino inside the box (with SIM breakout) that texted the devops team when opened.

Re: SSH Emergency Access

#5

Post by chrisweekly » Sat, Jul 04, 2020, 12:25 PM UTC

withinboredom wrote: post #4

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

You can physically put the (yubikey) device in a vault that will physically sound an alarm when opened. It could also have a battery-powered arduino inside the box (with SIM breakout) that texted the devops team when opened.

No idea why you were downvoted; it seems like a reasonable idea to me. (Also, IMHO downvoting a good-faith comment like yours is a lazy alternative to posting a substantive response.)

Re: SSH Emergency Access

#6

Post by lormayna » Sat, Jul 04, 2020, 12:35 PM UTC

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

You can use pam-hooks module to execute scripts at login/logout.

Re: SSH Emergency Access

#7

Post by masonhensley » Sat, Jul 04, 2020, 12:47 PM UTC

Neat - something I feel that often gets overlooked in most SAAS systems (think internal side) be it customer service, ops, etc tooling is break the glass escalation functionality. Most systems I’ve seen in the wild completely lack this and will result in over provisioning of admin “god mode” accounts.

NoodlesUK points out alerting which is a pretty important concept to incorporate.

Largely a solved concept in Electronic Medical Records & as outlined in the post.

Re: SSH Emergency Access

#8

Post by andylynch » Sat, Jul 04, 2020, 1:05 PM UTC

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

There are tools like Powerbroker which do this, and also privileged access management more generally - popular at banks and the like. Also SSH (the company)

Re: SSH Emergency Access

#9

Post by modinfo » Sat, Jul 04, 2020, 1:06 PM UTC

What a coincidence, 3 days ago I ordered two pieces of yubikey 5, today arrived a package and today I read a post on how to use them in an interesting way for emergency access to my server via SSH.

I'd like to add that the way it's described really works.

But... Now I don't know to leave one yubikey in case I need to use it for emergency access to ssh? I have a server since 2011 and I have never problems with access through ssh, I use the same keys to this day and everything works.

I think this way with yubikey to emergency access is overkill.

It's just an interesting way to use yubikey.

Re: SSH Emergency Access

#10

Post by aidos » Sat, Jul 04, 2020, 1:07 PM UTC

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

You can add a script at ~/.ssh/rc that’s run on each login. You’d need to be careful to make sure it couldn’t be changed if you were relying on it for notifications.