KeyBox: A better way to SSH
sshkeybox.com
KeyBox: A better way to SSH
1–10 of 57 posts
Re: KeyBox: A better way to SSH
#2So, fanterm[1] for the web.
Re: KeyBox: A better way to SSH
#3So, fanterm[1] for the web. [1]: http://www.stearns.org/fanout/README.html
Thanks ! This is nice to know. I'm sure this will be useful.
Re: KeyBox: A better way to SSH
#4Big fan of keybox, used it massively at my old place. So handy to remove contractors from servers at a push of button.
Re: KeyBox: A better way to SSH
#5So, fanterm[1] for the web. [1]: http://www.stearns.org/fanout/README.html
Re: KeyBox: A better way to SSH
#6Single point of compromise. :(
I wish people would just stop with these things. The appropriate way to be able to manage many users is called LDAP, it's been LDAP for decades and it's unlikely to change.
These days it's super easy to use SSH keys with LDAP, still using the standard openssh-lpk schema but now not requiring any patches to OpenSSH itself, just need to use the AuthorizedKeysCommand and an appropriate helper (which normally ships with distro).
By forgoing the above gateway style thing you now have central key management without a single point of compromise. Revoking a key is as simple as deleting it from LDAP or disabling that users account.
Re: KeyBox: A better way to SSH
#7This is the kind of thing I currently use Ansible for. Is there a big advantage to using KeyBox for this instead?
Re: KeyBox: A better way to SSH
#8Single point of compromise. :( I wish people would just stop with these things. The appropriate way to be able to manage many users is called LDAP, it's been LDAP for decades and it's unlikely to change. These days it's super easy to use SSH keys with LDAP, still using the standard openssh-lpk schema but now not requiring any patches to OpenSSH itself, just need to use the AuthorizedKeysCommand and an appropriate hel…
"These days it's super easy to use SSH keys with LDAP"
Are there any articles that go in to detail on exactly how to do this?
Re: KeyBox: A better way to SSH
#9Adding the browser to the mix won't make it much more secure, I fear.
Re: KeyBox: A better way to SSH
#10Single point of compromise. :( I wish people would just stop with these things. The appropriate way to be able to manage many users is called LDAP, it's been LDAP for decades and it's unlikely to change. These days it's super easy to use SSH keys with LDAP, still using the standard openssh-lpk schema but now not requiring any patches to OpenSSH itself, just need to use the AuthorizedKeysCommand and an appropriate hel…
The thing about keybox is that it's nice and fast to get better. For someone that doesn't have an ops team, or even an ops person, it is a neat solution.
Yes you need to be careful with it, I ran it on an internal VM, with only 2 users who had access to the admin console.
I'd love to see something as simple to use as keybox based around LDAP, I've had a google and can't see anything.