Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I built a simple, open-source tool to manage servers and SSH keys

github.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#61

Post by dangsux »

jldadriano wrote: post #48
usrbinbash wrote: post #38

Question: What is the specific advantage I get from using $ viking machine add --name deathstar --key starkey 168.112.216.50 $ viking exec --tty deathstar /bin/bash Over putting the following in my ~/.ssh/config Host deathstar HostName 168.112.216.50 User my_user IdentityFile ~/.ssh/starkey And then just typing $ ssh deathstar ?

as someone who dislikes config files to an extreme degree (hidden information, commands stop being portable) a modern cli that allows me to manage my configurations seems very useful

[dead]

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#62

Post by nbap »

JadoJodo wrote: post #35

I see that you're getting hammered in this thread, so I want to say a few things: 1. Great job on shipping! Whether or not the people in this thread find this tool useful, I want to congratulate you on putting together something you're ready to share with the world. 2. I'd love to hear the story of what prompted you to create this tool. Was it an issue you had? Did you set out to make something easier? 3. Not everyth…

That was very well put. I noticed an increasing negativity in Show HN posts lately. The usual inquisitive and supportive comments are being replaced with straight up negative and dismissive ones (or maybe it was always like this and people being nice is just a fabricated memory of mine)

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#63

Post by gunapologist99 »

cyberpunk wrote: post #5
nkotov wrote: post #4

Earlier quoted context omitted.

If you're managing a ton of servers manually, this makes a lot of sense.

If you’re managing a ton of servers you are already using ansible or packer or salt or something.

(Or Userify installed with Ansible..)

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#64

Post by gunapologist99 »

jamiesonbecker wrote: post #54
berkes wrote: post #37

Earlier quoted context omitted.

> What's the point of having different ssh key per server? I do have some use-cases where I use different ssh-keys per server/cluster: - Setting up client's machines allow me to nuke the keypair when work is done and I no longer have access. Customers trust me to do this - they trusted me to set up their machines already. - Belonging to different projects: so that when the project is finished, handed over or closed d…

I agree! People should generate at least a single ssh key per client device. (On Userify, rotating your key is just a matter of pasting the new public key into your keybox in your dashboard.) One per client device will let you revoke/rotate only that key when it's compromised. This also helps keep you from copying the private key somewhere else (which you should never do). It does look like this wants to be a replace…

One key per laptop.

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#65

Post by gunapologist99 »

synergy20 wrote: post #7

how does this compare to cassh https://github.com/nbeguier/cassh

cassh is a manager for CA's in SSH. CA's were added to SSH to satisfy people who thought PKI was a good idea; it's not, and SSH pubkeys are far better IMO. Better to use a tool like Userify (or similar like SSH.com) for pubkey management.

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#66

Post by gunapologist99 »

xcke wrote: post #9

assh is another project to consider, altough I falled back to just regular SSH config files and imports.

Yeah, you can go a long way with a single line added to the top of your .ssh/config like:

    Include ~/.ssh/config.d/2024/*

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#67

Post by 1oooqooq »

jldadriano wrote: post #48
usrbinbash wrote: post #38

Question: What is the specific advantage I get from using $ viking machine add --name deathstar --key starkey 168.112.216.50 $ viking exec --tty deathstar /bin/bash Over putting the following in my ~/.ssh/config Host deathstar HostName 168.112.216.50 User my_user IdentityFile ~/.ssh/starkey And then just typing $ ssh deathstar ?

as someone who dislikes config files to an extreme degree (hidden information, commands stop being portable) a modern cli that allows me to manage my configurations seems very useful

this site has only two audiences. nerds and mba's.

you're in a nerd thread, and will be downvoted without comments by starting an unwillingness to deep knowledge for the sake of knowledge.

if this were a mba thread the opposite would happen.

that said, shame on you for wanting ignorance!

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#68

Post by e12e »

jamiesonbecker wrote: post #56
enlighten420 wrote: post #15

why not just utilize a Certificate Authority?

CA's have a lot of management and logistical issues and potential for misuse. The simplicity and TOFU design of the SSH key system (which obv can bring along some issues of its own) can bring a lot of benefits, especially for people who don't want to introduce a CA or PKI. (obligatory disclaimer, I work at Userify and we have a server-side product that automates SSH key management and distribution. For example, the C…

> the CA design doesn't kick someone out once their access is removed, but Userify's shim actually terminates all of sessions instantly

I was a bit confused at first, I thought you were saying ssh certificates couldn't be revoked - but I see you're talking about signing the user out from existing sessions.

That is a fair point. I guess removing/locking a local user (in /etc/passwd, /etc/shadow) would typically leave any console logins alone too - unless other action is taken.

Certificates can of course be revoked:

http://www.ixany.org/articles/key-revocation-lists-on-openss...

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#69

Post by e12e »

gunapologist99 wrote: post #65
synergy20 wrote: post #7

how does this compare to cassh https://github.com/nbeguier/cassh

cassh is a manager for CA's in SSH. CA's were added to SSH to satisfy people who thought PKI was a good idea; it's not, and SSH pubkeys are far better IMO. Better to use a tool like Userify (or similar like SSH.com) for pubkey management.

At least certificates expire, and can list capabilities right in the certificate?

Re: Show HN: I built a simple, open-source tool to manage servers and SSH keys

#70

Post by traumivator »

You are very close to solving a real business problem. The problem is not "how can I have SSH aliases on my computer" but "how can we manage, company-wide, who can access which SSH servers."

My company currently uses YubiKeys to support hardware-based individual SSH keys. These SSH keys are distributed with Ansible. It works but is cumbersome and lacks a single pane of glass.

What we would like to have: a list of servers, a list of users, user roles (via sudoers), and a WebUI to manage all of it. And I don't know of any tool to do this. Of course, there are tools like Teleport or SSH CA instead of SSH keys, but they are for larger organizations and are overkill for my company.

Post reply on HN