Hardening SSH with 2FA
gist.github.com
Hardening SSH with 2FA
1–10 of 103 posts
Re: Hardening SSH with 2FA
#2I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff?
I'm also curious what people's preferred fallback method is for preserving access to machines if you lose access to your yubikey(s), assuming you keep your private SSH key stored on one.
Re: Hardening SSH with 2FA
#3I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
backup key on offline usb. Safely stored in a safe, never to be used except in emergency.
Re: Hardening SSH with 2FA
#4I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
If the yubikey dies, either another person can provision your replacement, or a configuration management system can do so.
We’re doing this successfully where I’m working.
Re: Hardening SSH with 2FA
#5I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
> I'm also not sure of the rationale for having a bastion host
It's a central place where you can do your logging, which many enterprises must do for compliance reasons.
Re: Hardening SSH with 2FA
#6Once just for fun I setup HAProxy in TCP mode and depending on the host name would direct the SSH to the correct host. But I had some nice ACLs so that if they weren’t in the ACL they would be sent to a honeypot.
Re: Hardening SSH with 2FA
#7I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
If the yubikey dies, either another person can provision your replacement, or a configuration management system can do so. We’re doing this successfully where I’m working.
I'm not sure I understand what you mean. I run a one-person business and my servers are 110 miles away in Sacramento; what do I do if my yubikey breaks?
Re: Hardening SSH with 2FA
#8Earlier quoted context omitted.
If the yubikey dies, either another person can provision your replacement, or a configuration management system can do so. We’re doing this successfully where I’m working.
I'm not sure I understand what you mean. I run a one-person business and my servers are 110 miles away in Sacramento; what do I do if my yubikey breaks?
I think the SOP is to have a second Yubikey registered and stored in a safe place and/or a set of one-time codes that you can use instead.
Re: Hardening SSH with 2FA
#9Once just for fun I setup HAProxy in TCP mode and depending on the host name would direct the SSH to the correct host. But I had some nice ACLs so that if they weren’t in the ACL they would be sent to a honeypot.
How did HAProxy know the host name?
Re: Hardening SSH with 2FA
#10I have two dozen co-located servers to log into. So far I've resisted the idea of setting up a bastion host, because that seems like a way to lock myself out of SSH access if that machine dies. I'm also not sure of the rationale for having a bastion host, other than "big companies do it". How do other non-cloud people handle this access vs. security tradeoff? I'm also curious what people's preferred fallback method i…
Run 2 bastion hosts?