4 ms·

Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud

• mmalone 9y ago
  Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.
  • lmz 9y ago
    They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-packages https://github.com/GoogleCloudPlatform/compute-image-package...
    • mmalone 9y ago
      Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow? Edit: sorry didn’t read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn’t go that route. Maybe not an option when they built this?
• exidy 9y ago
  I have successfully integrated Okta SSO to SSH via Hashicorp Vault, using it as a SSH CA to issue short-lived SSH certificates.