3 ms·

What if my infrastructure is over 50 hosts? How am I going to distribute key files for 50 people with 50 keys every 14 days?

tokenizerrr 11y ago
You could use something like ansible for the management of keys. Or you could centralize your authentication, which would probably be a lot more sane.
- jethro_tell 11y ago
  Even with central management, I don't know that I want to have 2500 keys floating around even if I have a management stack in place. That seems like an attack vector all in its own. Changing a key every other day on a 90 day rotation with 50 boxes. And fifty boxes isn't even that much. That's like 2 racks. Even with config management this won't scale past about 2 or 3 people and 10-20 boxes. Central auth is an option I guess but I think the better way to go would be a 2 factor with the key and hotp.
  - xorcist 11y ago
    It's not that bad, it's part of the user data and should be provisioned the same way. OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.
    - jethro_tell 11y ago
      The suggestion was not PKI though. I'd be happy with that. I already have a PKI in place. The suggestion was for a 1 key per box.
barkingcat 11y ago
You automate it. At 50 hosts some automation like puppet or ansible, etc is worth the trouble, especially if it helps you make sure that all hosts have the correct keys on them - that's just basic security - make sure there are no keys that shouldn't be there. What do you do now if someone leaves? Remove that person's key from all 50 hosts one at a time? Or, at the very least, you use tmux with sync panes or csshx - and log into all 50 hosts at once, and then you can issue one rm / scp command if you are still doing things manually.
- jethro_tell 11y ago
  Well I have an automated credentials and authentication infrastructure in place. The point is that if I have 50 hosts (and my infrastructure has considerably more) and 3 employees with 50 keys each, there will be 2 key changes a day on a 90 day rotation. Are my guys going to spend 5 minutes every morning making and pushing keys? What if my hosts auto provision themselves and there are 5 new hosts every morning? Am I going to make keys as part of infrastructure deployments and push them back to the workstations and update other peoples ssh configs? I'm just saying if you've worked at scale, you'll realize that a key per box won't scale. I mean, anything can scale if you put enough effort into it. But the chances of disaster in lack of access or security breach, from over complication is way to high here. Automating bad processes just makes it easier for them to fuck you.

tokenizerrr 11y ago

You could use something like ansible for the management of keys. Or you could centralize your authentication, which would probably be a lot more sane.

jethro_tell 11y ago
Even with central management, I don't know that I want to have 2500 keys floating around even if I have a management stack in place. That seems like an attack vector all in its own. Changing a key every other day on a 90 day rotation with 50 boxes. And fifty boxes isn't even that much. That's like 2 racks. Even with config management this won't scale past about 2 or 3 people and 10-20 boxes. Central auth is an option I guess but I think the better way to go would be a 2 factor with the key and hotp.
- xorcist 11y ago
  It's not that bad, it's part of the user data and should be provisioned the same way. OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.
  - jethro_tell 11y ago
    The suggestion was not PKI though. I'd be happy with that. I already have a PKI in place. The suggestion was for a 1 key per box.

barkingcat 11y ago

You automate it. At 50 hosts some automation like puppet or ansible, etc is worth the trouble, especially if it helps you make sure that all hosts have the correct keys on them - that's just basic security - make sure there are no keys that shouldn't be there. What do you do now if someone leaves? Remove that person's key from all 50 hosts one at a time? Or, at the very least, you use tmux with sync panes or csshx - and log into all 50 hosts at once, and then you can issue one rm / scp command if you are still doing things manually.

jethro_tell 11y ago
Well I have an automated credentials and authentication infrastructure in place. The point is that if I have 50 hosts (and my infrastructure has considerably more) and 3 employees with 50 keys each, there will be 2 key changes a day on a 90 day rotation. Are my guys going to spend 5 minutes every morning making and pushing keys? What if my hosts auto provision themselves and there are 5 new hosts every morning? Am I going to make keys as part of infrastructure deployments and push them back to the workstations and update other peoples ssh configs? I'm just saying if you've worked at scale, you'll realize that a key per box won't scale. I mean, anything can scale if you put enough effort into it. But the chances of disaster in lack of access or security breach, from over complication is way to high here. Automating bad processes just makes it easier for them to fuck you.