3 ms·

Touché, snark notwithstanding ;) It's an unfortunate fact of life that most large enterprises require the ability to quickly grant and revoke permissions acros

Touché, snark notwithstanding ;) It's an unfortunate fact of life that most large enterprises require the ability to quickly grant and revoke permissions across the enterprise. Some enterprises literally have no formal user deprovisioning process (even manual) across Linux/UNIX servers. Given that the only real alternative out there right now is LDAP, we think Userify is a pretty cool fix. However, any powerful authorization framework can be dangerous, and the more power, the more danger. It's definitely a fair point.

xorcist 11y ago
That's not entirely truthful. The "only real alternative to LDAP" is not letting a third party manage your credentials. If you don't want a directory service, pretty much every administration tool fits the bill. Red Hat has a tool, Ubuntu has one, but it's the cloud age so you're probably using Ansible or Puppet anyway where you get the same functionality for free. At least check it in git.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- jamiesonbecker 11y ago
  Well, obviously it's better to not trust anyone, ever. (I have trust issues too:)) You are trusting a third party as soon as you launch stuff in a public cloud or with your OS. For example, entropy.ubuntu.com, your distribution's update mechanism, Android/IOS app store, even Gentoo's github repos. We designed this as safely as we could: Userify doesn't need (or want) secret credentials, only public keys. We encrypt with NaCl before data hits Redis. We only communicate with TLS. The Userify shim does need root permissions because it's managing user accounts. Userify is available for on-premise deployment (currently Enterprise, and, soon, Pro in your AWS VPC), and Cloud is available for people who want free. Soon, we're launching "Pro", which is an in-between product for people who want in-VPC without paying enterprise pricing. (I assume you're talking about RH IPA, which is some nifty wrappers around LDAP. As someone who spent a lot of time implementing LDAP on UNIX at big companies, LDAP and centralized auth in general carries a lot of risks: for example, what happens if just a single one of your boxes is compromised, and rather than just sniff passwords, it starts DoS'ing your LDAP server? oops. now you can't get into any of your servers, even the ones they haven't yet owned.) We focus on a lot more than just authentication. That's just the beginning of the story. Userify Enterprise provides layered role-based access control, a user-friendly front-end for key updates, project functionality, and the ability to remove users across a single project or the entire companies. Ansible or Puppet don't offer any of those things. We have built-in deployment for Chef, for instance. We try hard not to duplicate functionality that you can get elsewhere (for example, systems management, log monitoring.) Those are designed for systems management, and they're good at that. We're designed for complex, multi-tiered user management with a focus on the user, not the system. (Hence our name) We view these as orthogonal directions, and it makes sense to use Userify with a good devops/cf system like Ansible/Chef/Puppet/Salt/etc. Small shops can still manually manage a dozen or so users across a few groups of servers. We've got a bunch of companies with hundreds of servers and less than 10 devops across all of them. For companies like that, Userify gives a bunch of other benefits.. for example, you can rotate your SSH keys without requesting a production code deployment, or update an SSH key without write access to git, or remove a contractor's account on their last day, etc. On-boarding and off-boarding get a lot easier, rotating keys is easier, training users is easier, managing lots of different role sets is easier, and Userify doesn't require any changes to PAM or NSS modules -- installing is a one-liner and it just uses /usr/sbin/adduser and /etc/sudoers.d. The shim is just a few hundred lines.. read through it at https://github.com/userify/shim https://github.com/userify/shim

xorcist 11y ago

That's not entirely truthful. The "only real alternative to LDAP" is not letting a third party manage your credentials. If you don't want a directory service, pretty much every administration tool fits the bill. Red Hat has a tool, Ubuntu has one, but it's the cloud age so you're probably using Ansible or Puppet anyway where you get the same functionality for free. At least check it in git.

deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
jamiesonbecker 11y ago
Well, obviously it's better to not trust anyone, ever. (I have trust issues too:)) You are trusting a third party as soon as you launch stuff in a public cloud or with your OS. For example, entropy.ubuntu.com, your distribution's update mechanism, Android/IOS app store, even Gentoo's github repos. We designed this as safely as we could: Userify doesn't need (or want) secret credentials, only public keys. We encrypt with NaCl before data hits Redis. We only communicate with TLS. The Userify shim does need root permissions because it's managing user accounts. Userify is available for on-premise deployment (currently Enterprise, and, soon, Pro in your AWS VPC), and Cloud is available for people who want free. Soon, we're launching "Pro", which is an in-between product for people who want in-VPC without paying enterprise pricing. (I assume you're talking about RH IPA, which is some nifty wrappers around LDAP. As someone who spent a lot of time implementing LDAP on UNIX at big companies, LDAP and centralized auth in general carries a lot of risks: for example, what happens if just a single one of your boxes is compromised, and rather than just sniff passwords, it starts DoS'ing your LDAP server? oops. now you can't get into any of your servers, even the ones they haven't yet owned.) We focus on a lot more than just authentication. That's just the beginning of the story. Userify Enterprise provides layered role-based access control, a user-friendly front-end for key updates, project functionality, and the ability to remove users across a single project or the entire companies. Ansible or Puppet don't offer any of those things. We have built-in deployment for Chef, for instance. We try hard not to duplicate functionality that you can get elsewhere (for example, systems management, log monitoring.) Those are designed for systems management, and they're good at that. We're designed for complex, multi-tiered user management with a focus on the user, not the system. (Hence our name) We view these as orthogonal directions, and it makes sense to use Userify with a good devops/cf system like Ansible/Chef/Puppet/Salt/etc. Small shops can still manually manage a dozen or so users across a few groups of servers. We've got a bunch of companies with hundreds of servers and less than 10 devops across all of them. For companies like that, Userify gives a bunch of other benefits.. for example, you can rotate your SSH keys without requesting a production code deployment, or update an SSH key without write access to git, or remove a contractor's account on their last day, etc. On-boarding and off-boarding get a lot easier, rotating keys is easier, training users is easier, managing lots of different role sets is easier, and Userify doesn't require any changes to PAM or NSS modules -- installing is a one-liner and it just uses /usr/sbin/adduser and /etc/sudoers.d. The shim is just a few hundred lines.. read through it at https://github.com/userify/shim https://github.com/userify/shim