3 ms·

Excellent release. OpenSSH + Userify = authtopia Summary + New default: PermitRootLogin prohibit-password, which also prohibits all interactive login forms

Excellent release. OpenSSH + Userify = authtopia Summary + New default: PermitRootLogin prohibit-password, which also prohibits all interactive login forms. + DSS keys are finally disabled by default + Use at least 2048 bits for your RSA keys + Deprecating or disabling MD5, SHA1, Blowfish CBC, ARC4, and a few other older ciphers/hmac's. + Bug and vuln fixes

bonzini 11y ago
> Use at least 2048 bits for your RSA keys It says they only plan on "refusing all RSA keys smaller than 1024 bits" (e.g. 768 bits. > Deprecating or disabling SHA1 SSH1, not SHA1!
- jamiesonbecker 11y ago
  at least 2048 bits yeah, I added that .. 2048 is really minimum best practice these days ;) SSH1, not SHA1! Good point, edited - btw next paragraph also says disabling 1024 bit diffie-hellman-group1-sha1 key exchange.
xorcist 11y ago
> Userify Which turns out to be a Cloud solution that promises "root privileges with just one mouse click" across all my servers. What could possibly go wrong?
- nadams 11y ago
  What I would like is an open source/self hosted solution where if I login as root to a system I would get a pop-up or message asking to verify this. Obviously for the individual sys admins it may not be useful - but for a company it makes sense. Personally I just want it as a sanity security check. I could probably easily write it - just haven't had a chance to do it.
  - jamiesonbecker 11y ago
    FWIW, don't login as root or su to root. Force yourself to always have to type in sudo. That half second is a good sanity check on whatever you're about to do. Plus, figuring out how to do crazy pipe things or here-docs as root is part of the fun :)
    - nadams 11y ago
      Kind of hard when VPS hosters configure their systems with root access. I'm not really sure I want to start mucking with the way they have it configured too much. When I self-hosted VMs I did configure them with root disabled. I'm experienced enough to the point where if I was going to do something stupid - typing in sudo won't stop me from doing it (I'm not saying I'm an expert - I'm saying that sudo has become muscle memory so it doesn't register in my mind). The added benefit to the message is a notification in the event that the system is compromised.
- jamiesonbecker 11y ago
  Touché, snark notwithstanding ;) It's an unfortunate fact of life that most large enterprises require the ability to quickly grant and revoke permissions across the enterprise. Some enterprises literally have no formal user deprovisioning process (even manual) across Linux/UNIX servers. Given that the only real alternative out there right now is LDAP, we think Userify is a pretty cool fix. However, any powerful authorization framework can be dangerous, and the more power, the more danger. It's definitely a fair point.
  - xorcist 11y ago
    That's not entirely truthful. The "only real alternative to LDAP" is not letting a third party manage your credentials. If you don't want a directory service, pretty much every administration tool fits the bill. Red Hat has a tool, Ubuntu has one, but it's the cloud age so you're probably using Ansible or Puppet anyway where you get the same functionality for free. At least check it in git.
    - deleted 11y ago
      [deleted]
    - deleted 11y ago
      [deleted]
    - jamiesonbecker 11y ago
      Well, obviously it's better to not trust anyone, ever. (I have trust issues too:)) You are trusting a third party as soon as you launch stuff in a public cloud or with your OS. For example, entropy.ubuntu.com, your distribution's update mechanism, Android/IOS app store, even Gentoo's github repos. We designed this as safely as we could: Userify doesn't need (or want) secret credentials, only public keys. We encrypt with NaCl before data hits Redis. We only communicate with TLS. The Userify shim does need root permissions because it's managing user accounts. Userify is available for on-premise deployment (currently Enterprise, and, soon, Pro in your AWS VPC), and Cloud is available for people who want free. Soon, we're launching "Pro", which is an in-between product for people who want in-VPC without paying enterprise pricing. (I assume you're talking about RH IPA, which is some nifty wrappers around LDAP. As someone who spent a lot of time implementing LDAP on UNIX at big companies, LDAP and centralized auth in general carries a lot of risks: for example, what happens if just a single one of your boxes is compromised, and rather than just sniff passwords, it starts DoS'ing your LDAP server? oops. now you can't get into any of your servers, even the ones they haven't yet owned.) We focus on a lot more than just authentication. That's just the beginning of the story. Userify Enterprise provides layered role-based access control, a user-friendly front-end for key updates, project functionality, and the ability to remove users across a single project or the entire companies. Ansible or Puppet don't offer any of those things. We have built-in deployment for Chef, for instance. We try hard not to duplicate functionality that you can get elsewhere (for example, systems management, log monitoring.) Those are designed for systems management, and they're good at that. We're designed for complex, multi-tiered user management with a focus on the user, not the system. (Hence our name) We view these as orthogonal directions, and it makes sense to use Userify with a good devops/cf system like Ansible/Chef/Puppet/Salt/etc. Small shops can still manually manage a dozen or so users across a few groups of servers. We've got a bunch of companies with hundreds of servers and less than 10 devops across all of them. For companies like that, Userify gives a bunch of other benefits.. for example, you can rotate your SSH keys without requesting a production code deployment, or update an SSH key without write access to git, or remove a contractor's account on their last day, etc. On-boarding and off-boarding get a lot easier, rotating keys is easier, training users is easier, managing lots of different role sets is easier, and Userify doesn't require any changes to PAM or NSS modules -- installing is a one-liner and it just uses /usr/sbin/adduser and /etc/sudoers.d. The shim is just a few hundred lines.. read through it at https://github.com/userify/shim https://github.com/userify/shim
currysausage 11y ago
OpenSSH + Userify = authtopia. Disclaimer: I am founder of Userify. FTFY.
- jamiesonbecker 11y ago
  thx :)

bonzini 11y ago

> Use at least 2048 bits for your RSA keys It says they only plan on "refusing all RSA keys smaller than 1024 bits" (e.g. 768 bits. > Deprecating or disabling SHA1 SSH1, not SHA1!

jamiesonbecker 11y ago
at least 2048 bits yeah, I added that .. 2048 is really minimum best practice these days ;) SSH1, not SHA1! Good point, edited - btw next paragraph also says disabling 1024 bit diffie-hellman-group1-sha1 key exchange.

xorcist 11y ago

> Userify Which turns out to be a Cloud solution that promises "root privileges with just one mouse click" across all my servers. What could possibly go wrong?

nadams 11y ago
What I would like is an open source/self hosted solution where if I login as root to a system I would get a pop-up or message asking to verify this. Obviously for the individual sys admins it may not be useful - but for a company it makes sense. Personally I just want it as a sanity security check. I could probably easily write it - just haven't had a chance to do it.
- jamiesonbecker 11y ago
  FWIW, don't login as root or su to root. Force yourself to always have to type in sudo. That half second is a good sanity check on whatever you're about to do. Plus, figuring out how to do crazy pipe things or here-docs as root is part of the fun :)
  - nadams 11y ago
    Kind of hard when VPS hosters configure their systems with root access. I'm not really sure I want to start mucking with the way they have it configured too much. When I self-hosted VMs I did configure them with root disabled. I'm experienced enough to the point where if I was going to do something stupid - typing in sudo won't stop me from doing it (I'm not saying I'm an expert - I'm saying that sudo has become muscle memory so it doesn't register in my mind). The added benefit to the message is a notification in the event that the system is compromised.
jamiesonbecker 11y ago
Touché, snark notwithstanding ;) It's an unfortunate fact of life that most large enterprises require the ability to quickly grant and revoke permissions across the enterprise. Some enterprises literally have no formal user deprovisioning process (even manual) across Linux/UNIX servers. Given that the only real alternative out there right now is LDAP, we think Userify is a pretty cool fix. However, any powerful authorization framework can be dangerous, and the more power, the more danger. It's definitely a fair point.
- xorcist 11y ago
  That's not entirely truthful. The "only real alternative to LDAP" is not letting a third party manage your credentials. If you don't want a directory service, pretty much every administration tool fits the bill. Red Hat has a tool, Ubuntu has one, but it's the cloud age so you're probably using Ansible or Puppet anyway where you get the same functionality for free. At least check it in git.
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - jamiesonbecker 11y ago
    Well, obviously it's better to not trust anyone, ever. (I have trust issues too:)) You are trusting a third party as soon as you launch stuff in a public cloud or with your OS. For example, entropy.ubuntu.com, your distribution's update mechanism, Android/IOS app store, even Gentoo's github repos. We designed this as safely as we could: Userify doesn't need (or want) secret credentials, only public keys. We encrypt with NaCl before data hits Redis. We only communicate with TLS. The Userify shim does need root permissions because it's managing user accounts. Userify is available for on-premise deployment (currently Enterprise, and, soon, Pro in your AWS VPC), and Cloud is available for people who want free. Soon, we're launching "Pro", which is an in-between product for people who want in-VPC without paying enterprise pricing. (I assume you're talking about RH IPA, which is some nifty wrappers around LDAP. As someone who spent a lot of time implementing LDAP on UNIX at big companies, LDAP and centralized auth in general carries a lot of risks: for example, what happens if just a single one of your boxes is compromised, and rather than just sniff passwords, it starts DoS'ing your LDAP server? oops. now you can't get into any of your servers, even the ones they haven't yet owned.) We focus on a lot more than just authentication. That's just the beginning of the story. Userify Enterprise provides layered role-based access control, a user-friendly front-end for key updates, project functionality, and the ability to remove users across a single project or the entire companies. Ansible or Puppet don't offer any of those things. We have built-in deployment for Chef, for instance. We try hard not to duplicate functionality that you can get elsewhere (for example, systems management, log monitoring.) Those are designed for systems management, and they're good at that. We're designed for complex, multi-tiered user management with a focus on the user, not the system. (Hence our name) We view these as orthogonal directions, and it makes sense to use Userify with a good devops/cf system like Ansible/Chef/Puppet/Salt/etc. Small shops can still manually manage a dozen or so users across a few groups of servers. We've got a bunch of companies with hundreds of servers and less than 10 devops across all of them. For companies like that, Userify gives a bunch of other benefits.. for example, you can rotate your SSH keys without requesting a production code deployment, or update an SSH key without write access to git, or remove a contractor's account on their last day, etc. On-boarding and off-boarding get a lot easier, rotating keys is easier, training users is easier, managing lots of different role sets is easier, and Userify doesn't require any changes to PAM or NSS modules -- installing is a one-liner and it just uses /usr/sbin/adduser and /etc/sudoers.d. The shim is just a few hundred lines.. read through it at https://github.com/userify/shim https://github.com/userify/shim

currysausage 11y ago

OpenSSH + Userify = authtopia. Disclaimer: I am founder of Userify. FTFY.

jamiesonbecker 11y ago
thx :)