Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Emergency Access

smallstep.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: SSH Emergency Access

#61

Post by dcow »

aaronmdjones wrote: post #59
dcow wrote: post #58

Earlier quoted context omitted.

You can, but `ssh-keygen` is about as nice to use as `openssl` which practically means you spend a lot of time with your head in the manual. The `step` tools have a nicer UI: $ step ssh inspect the-cert.pub Also the post already mentions that using `step` instead of `ssh-keygen` is optional , so I'm not sure why you feel the need to repeat it...

Right, you'd have to look up the switches in the manpage if you don't remember them, but that's already the case with the generation portion, which is why the post includes the switches for that. I'm just saying it could have included the inspect switches too.

We actually plan to update the post to demonstrate doing it entirely with the `step` tool. We just want to do a pass on the UX to make sure it is as easy an foolproof as possible before bringing more attention to it.

Re: SSH Emergency Access

#62

Post by dcow »

danmur wrote: post #13
modinfo wrote: post #9

What a coincidence, 3 days ago I ordered two pieces of yubikey 5, today arrived a package and today I read a post on how to use them in an interesting way for emergency access to my server via SSH. I'd like to add that the way it's described really works. But... Now I don't know to leave one yubikey in case I need to use it for emergency access to ssh? I have a server since 2011 and I have never problems with access…

If you need to the option to give someone temporary access it seems like a good option. I don't think it would add anything to my personal stuff since there's no reason I can think of to give someone else access. At work definitely.

Right, this is more about a cryptographic grant of temporary emergency access to someone who doesn't have a user account or admin keys already on a machine (and ideally nobody should have persistent admin access in a well-oiled production setting) in the event that existing access control mechanisms have failed. And backing the signing operations by a YubiKey lets you physically secure the key in ways that you wouldn't an entire laptop and provides all the benefits of tamper resistant, proximity aware, hardware. Probably not something most people will want or need to bother with for personal stuff, but very reasonable expectation as soon as you're working on a team or managing many hosts, etc.

Re: SSH Emergency Access

#63

Post by dcow »

markpeek wrote: post #60

Using certificates with SSH is the way to go for shared access servers. Here's an open source way (yes, I'm involved in the project) to manage authorization and access with asynchronous approvals: https://github.com/cloudtools/ssh-cert-authority

Smallstep also offers an open source ssh-aware kms-backed certificate authority.

https://github.com/smallstep/certificates

One nice advantage is its support for different provisioning flows. The oauth flavor allows you to hook into an existing identity provider to authenticate certificate requests.

Simply:

    $ step ssh login
and boom you've got a short-lived ssh certificate in your ssh-agent using a private key that never touched the disk.

Re: SSH Emergency Access

#64

Post by Spooky23 »

marcosdumay wrote: post #21
kevincox wrote: post #16

Earlier quoted context omitted.

I think it depends. I've worked in places that had something like the following setup. - Hardware in datacenters with operators who were not experts on the applications running. - All remote access was done using a short term (~1 day) ssh keys. There was an authentication service to generate these. It was pretty easy to imagine that the authentication service would go down. In this case a selection of people who work…

> All remote access was done using a short term (~1 day) ssh keys. There was an authentication service to generate these. This is weird. Really weird. Did that service use a more secure authentication storage than a password protected key?

It seems weird but has several advantages. Most places screw up defunct account cleanup and privilege management.

A process like this allows you to ensure that people have the access they need and makes it easy to get them the privilege separation needed.

Re: SSH Emergency Access

#65

Post by closeparen »

munchbunny wrote: post #37

This is a pedantic detail, but if you're trying to implement this system, it does matter: "resident key" is not a required feature here. You're not using the hardware token for its WebAuthn capability, you're using it for its smart card capability. You just need PKCS11 token support for SSH, which the YubiKey's smart card capability can do. YubiKey 4 and YubiKey FIPS can both do it, and so can regular old smart cards…

The procedure here is actually using WebAuthn, which is now explicitly implemented by OpenSSH.

Re: SSH Emergency Access

#67

Post by nokya »

CodeWriter23 wrote: post #49
tashian wrote: post #29

Earlier quoted context omitted.

Hey there — I'm the author of this post. There's a few scenarios where I imagined this approach being useful: * If you have any kind of remote dependency in your SSH auth flow (LDAP, or an online CA, or automated Ansible playbooks to push keys), any of those might fail and render the host otherwise inaccessible. * It's becoming more common to not ever SSH into machines. So, what if emergency SSH access is the only wa…

There’s also the access control feature of this approach. You can give someone temp access to a host.

That's exactly the reason why we use certificate based ssh access at my employer's: for our suppliers. It looks like the author went far away to find alternate reasons to deploy this :/

Re: SSH Emergency Access

#68

Post by ThePowerOfFuet »

tashian wrote: post #29
timeattack wrote: post #14

It's cool and interesting application of the technology, but doesn't really seem to be practical. When you're unable to access machine using your standard SSH keys usually it means that it's highly unlikely that it will be possible to login remotely via other means. As an emergency login there are two common options: * in case of cloud: use remote VM console provided by the hosting provider. * in case of bare-metal:…

Hey there — I'm the author of this post. There's a few scenarios where I imagined this approach being useful: * If you have any kind of remote dependency in your SSH auth flow (LDAP, or an online CA, or automated Ansible playbooks to push keys), any of those might fail and render the host otherwise inaccessible. * It's becoming more common to not ever SSH into machines. So, what if emergency SSH access is the only wa…

> Valid: from 2020-06-24T16:53:03 to 2020-06-24T16:03:03

Almost! I think you meant:

Valid: from 2020-06-24T16:53:03 to 2020-06-24T17:03:03

Re: SSH Emergency Access

#69

Post by kubanczyk »

ascotan wrote: post #11

I don't get it. When would u need a backup ssh key other than if a user lost access? Most VMs have console access for this purpose.

I wonder if there are some khem-khem notable clouds that just don't provide an old-school tty login. /s
Post reply on HN