Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening SSH with 2FA

gist.github.com

Post reply on HN
Print view View original

91–100 of 103 posts

Re: Hardening SSH with 2FA

#91

Post by akerl_ »

StavrosK wrote: post #83
pimlottc wrote: post #64

Earlier quoted context omitted.

Huh, I guess you are technically correct. They are listed on the Yubikey product page, though, and Yubikey is so strongly associated with Yubico that the distinction is easily lost.

Yeah, that's unfortunate, because someone can easily mistake them for Yubikeys. They're basically WebAuthn keys.

This page has a “Using your Yubikey” section: https://www.yubico.com/product/security-key-by-yubico/#secur...

I think it’s pretty impossible to expect people to look at these keys and think “ah yes, this is a Yubico Security Key, not a Yubikey”, given they look like a painted yubikey, are sold by the same company, have some feature overlap, and the docs are commingled with yubikey docs.

Re: Hardening SSH with 2FA

#92

Post by sbrown12 »

toast0 wrote: post #45
idlewords wrote: post #2

I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…

It's key to setup two or three bastion hosts with similar diversity to your prod fleet (are you in multiple locations? put a bastion in at least two of those; if not, do you have multiple racks? put a bastion in at least two of those, etc) -- you will have network incidents where some hosts are unreachable, you don't want that to hit all your bastions or you'll be very sad. Bastions are nice, because you can harden t…

For anyone interested in trying a bastion host approach, here's a step-by-step guide to spin up a bastion host and enable ssh logging: https://www.strongdm.com/bastion-hosts-with-audit-logging-pa...

Re: Hardening SSH with 2FA

#93

Post by askmike »

Spivak wrote: post #89
askmike wrote: post #81

Earlier quoted context omitted.

Given that he: > I wrote a blog post on this recently, using only open-source tools that don't come from big corps. I doubt he wants to use CloudFlare ;)

Philosophically is using CloudFlare or whatever CDN any worse that using the normal internet infrastructure in terms of software freedom?

Definitely, all traffic is readable by CloudFlare. Whereas if you have your own SSL certs everything going through the "normal internet infrastructure" is encrypted (in theory your webhost is able to get to it, but definitely not as easily - and this is only an issue if you rent a server).

On top of that there are many arguments against CloudFlare when it comes to an open and decentralized internet.

EDIT: didn't read the Philosophically in your comment. CloudFlare does many things against an open internet, for a long time they blocked (or required excessive captchas) for all TOR users.

Re: Hardening SSH with 2FA

#94

Post by mises »

alias_neo wrote: post #72
mises wrote: post #42

Earlier quoted context omitted.

Unless you're hitting a database for every connection, even a puny box ought to be fine.

Static site, no DBs. Link's posted so let's see!

Looks great. If it's static, try using netlify and cloudflare; I've used cloudflare with great success for years, and I just tried netlify (works great & free).

Re: Hardening SSH with 2FA

#95

Post by tanderson92 »

idlewords wrote: post #7
zegl wrote: post #4

Earlier quoted context omitted.

If the yubikey dies, either another person can provision your replacement, or a configuration management system can do so. We’re doing this successfully where I’m working.

I'm not sure I understand what you mean. I run a one-person business and my servers are 110 miles away in Sacramento; what do I do if my yubikey breaks?

You should already have a full backup of your (private) RSA key anyway on an encrypted USB drive in a desk drawer somewhere, so you use that until you can provision a new Yubikey.

Re: Hardening SSH with 2FA

#96

Post by jplayer01 »

LeonM wrote: post #30
jplayer01 wrote: post #15

Earlier quoted context omitted.

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

Just about every Dell and Lenovo laptop from the enterprise lineup still comes with a SC reader option. In the enterprise world, smartcards are the de facto standard. I've heard complaints from $BIGCORP managers that they couldn't have iPads because they don't offer smartcard functionality.

Somehow I managed to snag one of the Thinkpad models that doesn't have an SC reader option (T420p), which is disappointing, because this seemed like a cool thing to look into and experiment with.

Re: Hardening SSH with 2FA

#99

Post by mholt »

alias_neo wrote: post #87
e12e wrote: post #86

Earlier quoted context omitted.

Nice walk-through. Re:bandwidth worries, for this crowd, you probably just link to: https://github.com/2bytes/website/blob/master/content/post/t... I doubt hn will take down github...

I had considered that, but as someone else else pointed out, what have I got to lose if it's taken down? At least with links to my blog I can use the access logs for an idea of which articles people find interesting (I don't do other metrics/analytics due to my philosophy). At the moment I'm trying to build a new box to host this on but it seems Caddy has broken source builds (again) and I need plugins for my Git hoo…

Caddy's source builds are still working; just took a couple hours for me to figure out and update the instructions.

Re: Hardening SSH with 2FA

#100

Post by oarsinsync »

rincebrain wrote: post #68
microtonal wrote: post #65

Earlier quoted context omitted.

Or one of the Nitrokeys, which are generally more affordable and have open source firmware: https://www.nitrokey.com

Do they offer a good solution to the dual problem of: - if you can flash/read everything, so can an attacker - if you have a blackbox nothing can peer into, how can you trust the device?

It looks like the very first FAQ answers that:

1) You generate your own root keys, to deploy onto the device,

2) You can't read the root keys back off the device once it's deployed.

Post reply on HN