Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Emergency Access

smallstep.com

Post reply on HN
Print view View original

51–60 of 74 posts

Re: SSH Emergency Access

#51

Post by rnotaro »

rsync wrote: post #41
noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

"I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH?" Yes - quite simple and old-fashioned, actually ... I have this line in the SSH users' .login file: /usr/local/sbin/sms 4153331111 4158882222 "USER LOGIN TO XXX - $DATE" >& /dev/null ... where the 'sms' command, above, is a shell script I wrote to call twilio messagi…

Direct link of the audio that the XML will play: https://demo.twilio.com/docs/classic.mp3

Re: SSH Emergency Access

#52

Post by ed25519FUUU »

Here's what I like to do on my server(s) in cron, which pulls my keys from github:

    @hourly  ssh-import-id gh:
If I lose my keys to this host, I can simply update github.com with my new ones and go to lunch. I'll be able to login again shortly.

And on all of my hosts:

    @reboot  ssh-import-id gh:
This is REALLY helpful on devices like raspberry pi, where they may stay shutdown / offline for years. The minute they're powered up again they'll get my fresh keys and I can login to them without needing a console.

http://manpages.ubuntu.com/manpages/bionic/man1/ssh-import-i...

Re: SSH Emergency Access

#53

Post by jlgaddis »

noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

Generating alerts from syslog messages is something that we've been doing for decades.

Re: SSH Emergency Access

#54

Post by jlgaddis »

tashian wrote: post #30
noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

Hey there, I wrote this post. It's a great question. One benefit of using certificates for emergency access is that SSHD logging can be configured to show a lot more detail about the certificate that was used. With public keys, there isn't anything to show. But with certificates you have a key ID, serial number, principals, CA fingerprint, etc. So, that log is a good hook for sounding the alarm. A more advanced versi…

> With public keys, there isn't anything to show.

There's, at minimum, client IP address, username, and the key fingerprint -- which has always been good enough for me.

There might be even more details available but I'm not sitting in front of a computer to check.

Re: SSH Emergency Access

#55

Post by jlgaddis »

rsync wrote: post #41
noodlesUK wrote: post #2

I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH? Running a command to page the ops/security team when a server receives a login attempt with an emergency credential?

"I think another thing we might want to learn about is how to sound the alarm when the break glass is used. Is there an easy way of doing that with SSH?" Yes - quite simple and old-fashioned, actually ... I have this line in the SSH users' .login file: /usr/local/sbin/sms 4153331111 4158882222 "USER LOGIN TO XXX - $DATE" >& /dev/null ... where the 'sms' command, above, is a shell script I wrote to call twilio messagi…

What prevents a user from disabling or bypassing the command execution (if one desired to do so)?

Re: SSH Emergency Access

#56

Post by dcow »

BillinghamJ wrote: post #22
chrisweekly wrote: post #5

Earlier quoted context omitted.

No idea why you were downvoted; it seems like a reasonable idea to me. (Also, IMHO downvoting a good-faith comment like yours is a lazy alternative to posting a substantive response.)

Overcomplex technical solution to a simple problem. Besides which, if you really want to go full-on with technically clever solutions, keep in mind you could ensure no cellular service prior to opening. But then we're just getting into the realms of silly situations.

Would you attempt to use the key if you knew the CTO, SRE and OPS teams were paged as soon as the safe was accessed?

Re: SSH Emergency Access

#58

Post by dcow »

aaronmdjones wrote: post #57

To add to the blog post; you don't need brew or step or any of that nonsense to inspect certificates. $ ssh-keygen -Lf the-cert.pub

You can, but `ssh-keygen` is about as nice to use as `openssl` which practically means you spend a lot of time with your head in the manual. The `step` tools have a nicer UI:

    $ step ssh inspect the-cert.pub
Also the post already mentions that using `step` instead of `ssh-keygen` is optional, so I'm not sure why you feel the need to repeat it...

Re: SSH Emergency Access

#59

Post by aaronmdjones »

dcow wrote: post #58
aaronmdjones wrote: post #57

To add to the blog post; you don't need brew or step or any of that nonsense to inspect certificates. $ ssh-keygen -Lf the-cert.pub

You can, but `ssh-keygen` is about as nice to use as `openssl` which practically means you spend a lot of time with your head in the manual. The `step` tools have a nicer UI: $ step ssh inspect the-cert.pub Also the post already mentions that using `step` instead of `ssh-keygen` is optional , so I'm not sure why you feel the need to repeat it...

Right, you'd have to look up the switches in the manpage if you don't remember them, but that's already the case with the generation portion, which is why the post includes the switches for that. I'm just saying it could have included the inspect switches too.
Post reply on HN