Hacker News Reader

Comment by mheiber | Hacker News Reader

It baffles me that nobody seems to have mentioned Hashicorp's Vault yet:

https://www.vaultproject.org https://github.com/hashicorp/vault

It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backends to delegate granular access for all of these features.

It's been an absolutely eye-opener for somebody like me who's used to managing SSH keys/PKIs (what a pain) and I wouldn't want to use anything else right now.

View on HN

So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys add it to ~/.ssh/authorized_keys of each machine? i am familiar with vault locking/unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.

A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use.

This model is described in an excellent post by Facebook from a while back [1].

(Disclaimer: I used to work at HashiCorp, and put this model into production there, though the Vault support for issuing short-lived certificates was added after I left)

[1]: https://code.facebook.com/posts/365787980419535/scalable-and...

As a follow up - I would now also take a _very_ serious look at Teleport [1] for managing SSH.

[1]: https://gravitational.com/teleport/

Agreed on an SSH Certificate Authority being a good solution. Another open source project (disclaimer: I'm affiliated with it) which provides approval controls is available here: https://github.com/cloudtools/ssh-cert-authority

One other handy feature that we're using is the ability for Vault to set user IDs in the signed key ID field which then get logged by sshd on the remote host. That way we can still audit who exactly logged in if using a single user on the remote host.

Using an SSH Certificate Authority is also my recommendation, but be aware that it's relatively new, so associated tooling with it is not super mature yet. In particular, the user still needs some bits in order to login, and whether they generate it themselves and send it off to get signed, or the bits are generated for them on the backend and the user simply needs to receive them, there's a management aspect to it that isn't a totally solved problem with open source tools.

It's not a difficult problem, mind you, but there was custom code written that runs on developer laptops (OS X and Ubuntu) to support this workflow.

(Despite being a very similar looking string of bytes as more traditional pub/private keys, it's different in the SSH-Agent protocol, so don't assume all ssh-agent-looking daemons support it.)

ScaleFT uses a certificate based approach and issues short lived certain for SSH and RDP. Also has a policy engine to set additional access controls.

I tried to deploy them to grant developers limited time access to the hosts running their services. Didn't really work out and I killed the project.

You have to build a new ssh CA for each class of server. There's no mechanism for granting access by host name. This becomes unmanageable fast.

You can represent that pretty easily with principals. Just make sure that each host has itself listed as a principal and generate keys that contain that same string. It's pretty common to have a set of increasingly general principals (I.e. Hostname, cluster, tier, root@everywhere).

> https://www.vaultproject.org

That link doesn't work. The correct one is https://www.vaultproject.io

Absolutely, thank you. I'm on mobile right now and was too lazy to check the reference m(

Reply on news.ycombinator.com