Zero-Trust RDP and SSH Access to VMs on Google Cloud
1–10 of 90 posts
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#2In reading through this on the surface, it appears as though there is a mix of trust relationships that pre-exist, and credential issuances that occur on the fly. Also, it also appears there is no privilege tiering aka, enterprise access model, applied to the example. Did I see this wrong?
I'd be interested in seeing what credentials in toto are there, and which ones are ephemeral, and susceptibility to lateral traversal.
Could you respond on the merits of the critique?
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#3I make use of IAP and OS Login today, to log in to a Compute Engine Linux VM. The VM has Internet access via NAT, and has no public IP.
Logging in is via `gcloud compute ssh`. Authenticating `gcloud` involves a corporate login which uses a client certificate and two-step.
For all the components involved, it works pretty well!
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#4I didn't know big tech companies were still capable of making GUI's that look like this.
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#5I didn't know big tech companies were still capable of making GUI's that look like this.
It looks really useful!
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#6How much work would it be to make this general purpose? To not only work for Google-cloud...
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#7Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#8In reading through this on the surface, it appears as though there is a mix of trust relationships that pre-exist, and credential issuances that occur on the fly. Also, it also appears there is no privilege tiering aka, enterprise access model, applied to the example. Did I see this wrong? I'd be interested in seeing what credentials in toto are there, and which ones are ephemeral, and susceptibility to lateral trave…
For Linux systems at least, IAP doesn’t deal with privilege tiering. Instead, OS Login handles mapping a user’s Google account to a local account. There is also a program that queries a user’s SSH key from OS Login, and passes it to sshd when asked.
OS Login defines two IAM roles, one for “Can I log in?” and one for “Can I sudo?”. Those are implemented on the system via PAM, so you can add whatever additional restrictions you’d like.
Fetching of user information via OS Login is implemented via a NSS module. POSIX attributes can be customized via the Google Directory API. And I believe Google Groups can be mapped to POSIX supplemental groups, but I’m not certain.
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#9How much work would it be to make this general purpose? To not only work for Google-cloud...
Checkout this guide I published today. It walks through the code to do the secure tunneling part in ~20 lines of Rust, using Ockam a library to create end-to-end encrypted secure channels
https://github.com/ockam-network/ockam/tree/develop/document...
Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud
#10Would be nice to have a Mac version of that.