3 ms·

Interesting thanks! How do you get your engineer's public keys uploaded to the ldap server? Do they generate keys themselves and upload to some portal? Also wh

Interesting thanks! How do you get your engineer's public keys uploaded to the ldap server? Do they generate keys themselves and upload to some portal? Also what makes you distrust teleport -- is it just third party code? I think you can (or have to) self host it but maybe that's not true for enterprise.

gargravarr 8y ago
There's a neat Python application, ssh_ldap_pubkey, that not only retrieves the user's pubkeys (e.g. can be called by SSH) but also allows users to manipulate them (add/delete). So end users generate the keys and push them to the LDAP cluster themselves. The backend servers then validate SSH keys against the LDAP servers instead of locally, so it's a perfectly logical extension of existing LDAP functionality. It's not specifically Teleport I distrust, it's most cloud-based software due to its often-woeful attention to security. Also, if we suffer a major internet outage and my systems lose connection, it shouldn't stop me SSH'ing into them. So long as my LDAP machines, on the same LAN, are up, I can get in. I also dislike paying for something we could build ourselves for little-to-moderate effort :)