21–30 of 103 posts
I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…
so this way, my always-on router can ONLY be accessed by a yubikey. That uses "slot 1", which requires me to insert the yubi and long-touch it(it only has one button). and my desktop can be accessed without a password if the yubi is inserted (without pressing it or anything, this is slot0) or I can type my password if I want.
what I thought was going to be a wild rodeo with bucking broncos and PAM module errors, turned out to be riding the coin-operated horse in front of the grocery store.
This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki
Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?
This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki
Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?
Mandated by the US government so yes, lots of people use them.
https://www.vaultproject.io/docs/secrets/ssh/one-time-ssh-pa...
You also have to configure the servers to support Vault, using their PAM integration:
I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…
I'm afraid to link it here because the traffic might kill my puny box.
Earlier quoted context omitted.
> I'm also not sure of the rationale for having a bastion host It's a central place where you can do your logging, which many enterprises must do for compliance reasons.
Really? Do any compliance standards specifically require this? Or is the specific control defined in the organization itself that requires this? I've found many compliance standards to be pretty open-ended and function-driven, rather than prescribing specific standards. Client contracts.... they may be a different beast, and often require specific promises by vendors.
Earlier quoted context omitted.
I think the SOP is to have a second Yubikey registered and stored in a safe place and/or a set of one-time codes that you can use instead.
I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and... This looks like exactly the answer I needed; thank you!
This doesn't require any support on the serverside; as far as the server's concerned, the Y4 is just another RSA key.
It does require the more expensive Yubikey, but there are some security advantages to using it.
I've thought about doing something like this several times, but the proposition of using any tools/libraries/pam modules/etc not installed by default, custom pam/sshd configs, and generally anything "outside of the box" sort of scares me. I've used 2FA for SSH at $lastjobatmegacorp, however all that infrastructure was supported by a team of people dedicated to such things. How finicky would setting this up for myself…
This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki
Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?