Live data from Hacker News

Zero-Trust RDP and SSH Access to VMs on Google Cloud

github.com

51–60 of 90 posts

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#51

Why are we still building tools to hand manage VMs in 2021? Am I missing something or is this for raising pets instead of heading cattle[0]? 0. http://cloudscaling.com/blog/cloud-computing/the-history-of-...

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#52

I make use of IAP and OS Login today, to log in to a Compute Engine Linux VM. The VM has Internet access via NAT, and has no public IP. Logging in is via `gcloud compute ssh`. Authenticating `gcloud` involves a corporate login which uses a client certificate and two-step. For all the components involved, it works pretty well!

> ... which uses a client certificate ...

Can you encrypt the client private key on disk and use sth like ssh-agent?

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#53

Earlier quoted context omitted.

I use Windows VMs on Google Cloud to install and play games in the cloud - my Mac can’t play any

Parsec is outstanding for this use case, it’s basically a roll-your-own Stadia. Dunno what its future will be now that it was acquired by Unity

Yep, usually use Parsec, or Moonlight + ZeroTier for this.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#54

I didn't know big tech companies were still capable of making GUI's that look like this.

In my opinion, this looks far better and more usable than a lot of new UIs nowadays.

I’d say appearance != usability, and while this might look a bit dated, it probably behaves a lot more like a desktop application than most Electron apps out there.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#55

I didn't know big tech companies were still capable of making GUI's that look like this.

In my opinion, this looks far better and more usable than a lot of new UIs nowadays. I’d say appearance != usability, and while this might look a bit dated, it probably behaves a lot more like a desktop application than most Electron apps out there.

Indeed, that GUI is awesome.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#56
post #51

Why are we still building tools to hand manage VMs in 2021? Am I missing something or is this for raising pets instead of heading cattle[0]? 0. http://cloudscaling.com/blog/cloud-computing/the-history-of-...

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

No, part of managing a heard is having the right tools in place. Like monitoring, logging, and observability tools.

There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system.

In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent.

Of you need an interactive session on a prod machine you are missing tools.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#57
post #51

Earlier quoted context omitted.

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

No, part of managing a heard is having the right tools in place. Like monitoring, logging, and observability tools. There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system. In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent. Of you need an interactive session on a…

What about cloud based developer VMs?

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#58
post #51

Earlier quoted context omitted.

Because when your herd of cattle is sick, you need to grab one and have a vet look at it before your whole herd dies from the plague.

No, part of managing a heard is having the right tools in place. Like monitoring, logging, and observability tools. There is nothing I can learn from accessing a VM in production that I can't learn from my monitoring system. In prod where I work, if someone logs into a production VM we mark it tainted and replace it with a fresh instance. This keeps things nice and consistent. Of you need an interactive session on a…

Plugging all our cattle into a heart- and bloodpressure monitor and doing frequent blood draws from every cow "just in case" is wasteful and unnecessary. There is a balance between sensible general always-available monitoring and special-case-debugging a problem.

My rule for that is: more than once a year or more than 6h? Automate and tool it. Less? SSH or other special-case tools are fine.

Re: Zero-Trust RDP and SSH Access to VMs on Google Cloud

#59
post #5

Earlier quoted context omitted.

It looks really useful!

It's gorgeous. Like a breath of fresh air after all that electron nightmare.

I don't see the correlation. I get that people don't like electron bloat, but that is orthogonal to UI/UX, no?
Post reply on HN