21–30 of 114 posts
The sysadmin just adds each employee's key to the servers. From reading this thread it sounds like bad practice?
edit: typo
We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.
>https://github.com/sneak.keys
How do you do that? I mistook you for a Github employee at first.
It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AWS server edition in the AWS marketplace. When you remove someone in the dashboard, their account is removed across all of the servers they have access to, and their sessions are terminated, but their home directory is retained for archival or forensics.
Our primary foci are paranoid levels of security (hardened, all data encrypted at rest with X25519, in motion with TLS), flexibility, and speed: fast to deploy or integrate (w/ ansible, chef, puppet, terraform, cloudformation), and fast to install (milliseconds), with both SaaS/Cloud and self-hosted versions and open source python agent (we call it the 'shim').
We were founded in 2011 and serve thousands of servers and users in real time; I'm first.last at userify for any questions, and/or info at userify.
We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.
A comment above, https://news.ycombinator.com/item?id=14321901 , does a similar thing as you, except they use the Github API to fetch the list of usernames. I don't know your use case, but maybe this is useful to you too. > https://github.com/sneak.keys How do you do that? I mistook you for a Github employee at first.
We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ server…
How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.
I'm the co-founder of a startup that has developed a tool for this called Userify[1]. It creates and removes local accounts and manages the ssh keys and sudo permissions centrally, so you don't have to worry about not being able to get in if your LDAP/AD is down. (Our Enterprise edition, self-hosted in your VPC or in your DC, can optionally integrate with LDAP or AD for dashboard logins, MFA, etc.) We also have an AW…
LDAP as a public key service and servers configured via PAM to use that as source for pub keys. Nothing to distribute. Delete key from LDAP and second later user can't log on any machine. We are analysing teleport ssh suite for possible migration direction. SSL is different story :)
We use Yubikeys as GPG smartcards, and use them for gpg-agent as ssh keys. Everyone puts their hsm keys on their github account (and removes all others). We fetch the keys for each user from github on system init. e.g. https://github.com/sneak.keys When we need to add/remove people, we just update the list of usernames in the script that fetches keys, and then kill off instances one at a time to force a redeploy.
A comment above, https://news.ycombinator.com/item?id=14321901 , does a similar thing as you, except they use the Github API to fetch the list of usernames. I don't know your use case, but maybe this is useful to you too. > https://github.com/sneak.keys How do you do that? I mistook you for a Github employee at first.
LDAP as a public key service and servers configured via PAM to use that as source for pub keys. Nothing to distribute. Delete key from LDAP and second later user can't log on any machine. We are analysing teleport ssh suite for possible migration direction. SSL is different story :)
Can anyone log into hosts if LDAP is down? Is that a concern? Is there an easy way to mitigate the concern if you wanted to? Interested in exploring this solution, but worried about the availability risk.
Users can log onto machines if the credentials are cached, I think. Unsure how PAM handles this on Linux.
My company Foxpass (YC S15) has a product to manage SSH keys. It serves as access control too -- the keys are only available on the hosts where a user should have access. https://www.foxpass.com/
We've been using Foxpass for more than a year now and can definitely recommend. We have Amazon Machine Images with the required packages installed and configured; we use the web interface to grant/revoke access to users and add SSH keys. So each user logs in as themselves. Aren has been awesome with responding to emails and helping us set it up too.