4 ms·
> A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this... Problem 1. Now you have to maintain password Problem 2. Now
by yeukhon 11y ago
> A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this...
Problem 1. Now you have to maintain password
Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can't automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API.
IMO, actually, better approach:
* each instance only allow coming from known network
* user must be authenticated and authorized with LDAP / added to authorized_keys file and enable SSH logging
* automation should retrieve the private key from some safe location and is constantly rotating key across instances. This is quite easy on AWS with IAM if you run infrastructure on AWS. For non-AWS, you just harden the location twice as hard.
- CaptSpify 11y ago> Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can't automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API. You can use ssh-agents for this. Some people consider that cheating though |;)
- yeukhon 11y agoSorry maybe I am not aligned, ssh-agent for handling password prompt? ssh-agent afaik is useful for going from A->B and then B carrying that over to C,D,E,F,G etc
- CaptSpify 11y agoMaybe we're talking about different things then? If you use the agent, you only have to handle the prompt once, then it's cached. That's the automation I was replying about.