7 ms·

I like the idea of logging in with a Yubikey, but this presentation seems out of touch with the requirements of the real world: folks needing to SSH into cloud

by cbhl 7y ago

I like the idea of logging in with a Yubikey, but this presentation seems out of touch with the requirements of the real world: folks needing to SSH into cloud machines without logging in to a physical console first; IT departments that need to reset a forgotten password or decrypt a hard drive for compliance reasons; people who have multiple Yubikeys; people who change passwords and don't want to spend hours re-keying the encryption on their USB key.

lorenzhs 7y ago
He starts the talk with something along the lines of: this is what I want for my laptop, not servers. It's explicitly meant for personal machines, not cloud machines. There is no reason why those should have to change, they're served pretty well by account management as it is today. Laptops are not, and he's trying to fix that. And by the way, LUKS has multiple authentication slots (you can have multiple passwords for the same volume, for example a long random password that the IT department keeps in a safe place if they ever need to access the volume) and it takes a second to re-key, not hours. This is all well-known. But Poettering brings out the worst knee-jerk reactions in people.
- johannes1234321 7y ago
  While for a laptop many of those problems he describes are non issues. I.e. configuration via LDAP doesn't happen on a laptop. That said: Integration with encryption and so on is definitely good. So maybe this goes too far in some direction, but too little I. The other?
  - db48x 7y ago
    Millions of laptops are configured via LDAP and Active Directory every day.
    - jacquesm 7y ago
      Windows laptops.
      - diffeomorphism 7y ago
        Which is exactly the point. Enterprise deploys windows machines because there are established tools and mechanisms to manage them. If you want more deployments of linux laptops, you need ...(see the first few slides).
        jacquesm 7y ago
        Google managed to do what RedHat failed at: to distribute Linux en masse for device usage. They also replaced the whole userland with either Android or ChromeOS, and they managed to do all that without breaking Linux for the rest of us. If RedHat wanted to they could simply rename it RhOS or something like that and leave the rest of Linux alone. Now we are getting this false-flag enterprise borne push to replace all of the Linux userland with something that I could have very much done without all in an attempt to let RedHat try once more to go for that elusive enterprise desktop market that they have so far failed to attract.
        db48x 7y ago
        There's a reason they call it "Redhat Enterprise Linux" and not just "Linux", and there's no reason you have to use it. Besides, any complaint about LDAP is a red herring here: he mentioned LDAP not because he wants to force you to use it, but because of the way people sometimes use LDAP to allocate UIDs across many systems. He wants to entirely eliminate the need for that allocation to happen, whether you use LDAP or not.
        jacquesm 7y ago
        If RedHat would keep their code to themselves that would be great news. Unfortunately everybody and their brother can't stop themselves from tripping over their own feet to adopt whatever RH cooks up. Mind you, I'm all for less fragmentation in the Linux space, I'm just not for having that dictated by the likes of RH just because of their tendency to optimize for their own intended use cases and their never ending dreams of being allowed to play on the enterprise desktop.
  - lorenzhs 7y ago
    Enterprise-managed laptops need this just as much as my personal machine, they are woefully underserved by current user management.
    - jacquesm 7y ago
      Enterprise managed laptops typically run Windows or OS/X. I haven't seen a Linux laptop in the wild at the enterprise level for years. Which companies use those?
      - diffeomorphism 7y ago
        > Enterprise managed laptops typically run Windows or OS/X. I haven't seen a Linux laptop in the wild at the enterprise level for years. Chicken-egg. If you don't have appropriate management features (like the ones introduced here), then you don't get enterprise deployments.
        jacquesm 7y ago
        That's RedHat's wishful thinking at work. Linux on the desktop is called 'Chromebooks', not 'RedHat'. They missed that boat by a couple of years and it is not coming back.
        diffeomorphism 7y ago
        So which is it? - This is going to be so awesome that "everybody and their brother can't stop themselves from tripping over their own feet to adopt". or - Wishful thinking, doesn't matter.
        jacquesm 7y ago
        Package managers and distro maintainers are not typically the end-users I have in mind. But if you can't see these groups as different then that's fine, but lets just leave it at that I, an end user was forced to adopt a set of system changes that I had no influence over because of RedHat's continued aspiration to put 'Linux on the desktop' when that had in fact happened ages ago. That you feel that adoption only happens because something is 'so awesome' is putting the horse behind the cart, stuff gets adopted all the time when better alternatives are available, all it takes is enough clout behind the push and it's a done deal. If technical merits were the deciding factor DR-Dos and OS/2 would still be around today instead of their lesser alternatives.
- jacquesm 7y ago
  > There is no reason why those should have to change, they're served pretty well by account management as it is today. Cue the next release by RedHat when suddenly it is mandatory, and the inevitable adoption by other distros who take their cue from RedHat. Even though I haven't used RH in years I keep having to deal with the 'RH way or the highway' attitude.
  - lorenzhs 7y ago
    Poettering explicitly says in his talk that he doesn't want to change how home directories work on servers. I mean, RHEL runs on a lot of servers, and they certainly aren't going to alienate a ton of customers by requiring them to log in via a physical console after reboot. I normally find your comments on HN measured and insightful, but in this thread you're just coming off as angry.
    - jacquesm 7y ago
      > Poettering explicitly says in his talk that he doesn't want to change how home directories work on servers. I've learned the hard way that trusting mr. Poettering on his word tends to end badly. > I normally find your comments on HN measured and insightful, but in this thread you're just coming off as angry. Yep. I'm seriously pissed off that stuff that worked and that did not require anybody's helping hand keeps being broken without any reason and that I'm forced to eat this crap for the sake of being able to run a reasonably secure distro that I can also use for CUDA and every day stuff such as email and web browsing. The whole 'if it isn't broken don't fix it' mantra is one that I strongly subscribe to, alas, more often than not an 'upgrade' in fact turns out to be a downgrade from what was there before modulo some eye candy that I didn't ask for either.
db48x 7y ago
Yea, it definitely seems geared towards ordinary users rather than admins. On the other hand, he did say it would remain backwards compatible with the existing system of preassigned uids and ordinary home directories, so that's ok. You could use a migratable home directory for your development machine while using ordinary home directories on servers and VMs. Also, you can rekey a LUKS volume very quickly. Each volume is encrypted with a master key which is encrypted in turn by your personal key. Rekeying the volume just means decrypting the master key with your current key, and reencrypting it with a new one. Similarly, you can have multiple keys that can decrypt the master key. On the other hand, it's something you will only do rarely, so you'll have to look it up. I don't think I'd get a lot out of it personally (last time I migrated to a new computer I just moved the physical drive), but it won't get in the way either.
fhennig 7y ago
The new home directory does not need to be encrypted. It can easily be encrypted, but the main feature here is portability.

by cbhl 7y ago

lorenzhs 7y ago

He starts the talk with something along the lines of: this is what I want for my laptop, not servers. It's explicitly meant for personal machines, not cloud machines. There is no reason why those should have to change, they're served pretty well by account management as it is today. Laptops are not, and he's trying to fix that. And by the way, LUKS has multiple authentication slots (you can have multiple passwords for the same volume, for example a long random password that the IT department keeps in a safe place if they ever need to access the volume) and it takes a second to re-key, not hours. This is all well-known. But Poettering brings out the worst knee-jerk reactions in people.

johannes1234321 7y ago
While for a laptop many of those problems he describes are non issues. I.e. configuration via LDAP doesn't happen on a laptop. That said: Integration with encryption and so on is definitely good. So maybe this goes too far in some direction, but too little I. The other?
- db48x 7y ago
  Millions of laptops are configured via LDAP and Active Directory every day.
  - jacquesm 7y ago
    Windows laptops.
    - diffeomorphism 7y ago
      Which is exactly the point. Enterprise deploys windows machines because there are established tools and mechanisms to manage them. If you want more deployments of linux laptops, you need ...(see the first few slides).
      - jacquesm 7y ago
        Google managed to do what RedHat failed at: to distribute Linux en masse for device usage. They also replaced the whole userland with either Android or ChromeOS, and they managed to do all that without breaking Linux for the rest of us. If RedHat wanted to they could simply rename it RhOS or something like that and leave the rest of Linux alone. Now we are getting this false-flag enterprise borne push to replace all of the Linux userland with something that I could have very much done without all in an attempt to let RedHat try once more to go for that elusive enterprise desktop market that they have so far failed to attract.
        db48x 7y ago
        There's a reason they call it "Redhat Enterprise Linux" and not just "Linux", and there's no reason you have to use it. Besides, any complaint about LDAP is a red herring here: he mentioned LDAP not because he wants to force you to use it, but because of the way people sometimes use LDAP to allocate UIDs across many systems. He wants to entirely eliminate the need for that allocation to happen, whether you use LDAP or not.
        jacquesm 7y ago
        If RedHat would keep their code to themselves that would be great news. Unfortunately everybody and their brother can't stop themselves from tripping over their own feet to adopt whatever RH cooks up. Mind you, I'm all for less fragmentation in the Linux space, I'm just not for having that dictated by the likes of RH just because of their tendency to optimize for their own intended use cases and their never ending dreams of being allowed to play on the enterprise desktop.
- lorenzhs 7y ago
  Enterprise-managed laptops need this just as much as my personal machine, they are woefully underserved by current user management.
  - jacquesm 7y ago
    Enterprise managed laptops typically run Windows or OS/X. I haven't seen a Linux laptop in the wild at the enterprise level for years. Which companies use those?
    - diffeomorphism 7y ago
      > Enterprise managed laptops typically run Windows or OS/X. I haven't seen a Linux laptop in the wild at the enterprise level for years. Chicken-egg. If you don't have appropriate management features (like the ones introduced here), then you don't get enterprise deployments.
      - jacquesm 7y ago
        That's RedHat's wishful thinking at work. Linux on the desktop is called 'Chromebooks', not 'RedHat'. They missed that boat by a couple of years and it is not coming back.
        diffeomorphism 7y ago
        So which is it? - This is going to be so awesome that "everybody and their brother can't stop themselves from tripping over their own feet to adopt". or - Wishful thinking, doesn't matter.
        jacquesm 7y ago
        Package managers and distro maintainers are not typically the end-users I have in mind. But if you can't see these groups as different then that's fine, but lets just leave it at that I, an end user was forced to adopt a set of system changes that I had no influence over because of RedHat's continued aspiration to put 'Linux on the desktop' when that had in fact happened ages ago. That you feel that adoption only happens because something is 'so awesome' is putting the horse behind the cart, stuff gets adopted all the time when better alternatives are available, all it takes is enough clout behind the push and it's a done deal. If technical merits were the deciding factor DR-Dos and OS/2 would still be around today instead of their lesser alternatives.
jacquesm 7y ago
> There is no reason why those should have to change, they're served pretty well by account management as it is today. Cue the next release by RedHat when suddenly it is mandatory, and the inevitable adoption by other distros who take their cue from RedHat. Even though I haven't used RH in years I keep having to deal with the 'RH way or the highway' attitude.
- lorenzhs 7y ago
  Poettering explicitly says in his talk that he doesn't want to change how home directories work on servers. I mean, RHEL runs on a lot of servers, and they certainly aren't going to alienate a ton of customers by requiring them to log in via a physical console after reboot. I normally find your comments on HN measured and insightful, but in this thread you're just coming off as angry.
  - jacquesm 7y ago
    > Poettering explicitly says in his talk that he doesn't want to change how home directories work on servers. I've learned the hard way that trusting mr. Poettering on his word tends to end badly. > I normally find your comments on HN measured and insightful, but in this thread you're just coming off as angry. Yep. I'm seriously pissed off that stuff that worked and that did not require anybody's helping hand keeps being broken without any reason and that I'm forced to eat this crap for the sake of being able to run a reasonably secure distro that I can also use for CUDA and every day stuff such as email and web browsing. The whole 'if it isn't broken don't fix it' mantra is one that I strongly subscribe to, alas, more often than not an 'upgrade' in fact turns out to be a downgrade from what was there before modulo some eye candy that I didn't ask for either.

db48x 7y ago

Yea, it definitely seems geared towards ordinary users rather than admins. On the other hand, he did say it would remain backwards compatible with the existing system of preassigned uids and ordinary home directories, so that's ok. You could use a migratable home directory for your development machine while using ordinary home directories on servers and VMs. Also, you can rekey a LUKS volume very quickly. Each volume is encrypted with a master key which is encrypted in turn by your personal key. Rekeying the volume just means decrypting the master key with your current key, and reencrypting it with a new one. Similarly, you can have multiple keys that can decrypt the master key. On the other hand, it's something you will only do rarely, so you'll have to look it up. I don't think I'd get a lot out of it personally (last time I migrated to a new computer I just moved the physical drive), but it won't get in the way either.

fhennig 7y ago

The new home directory does not need to be encrypted. It can easily be encrypted, but the main feature here is portability.