3 ms·
1) Programmatically issue certificates with short lifetimes after authenticating against your IdP. This way if a user is deactivated in LDAP their access will e
by closeparen 7y ago
1) Programmatically issue certificates with short lifetimes after authenticating against your IdP. This way if a user is deactivated in LDAP their access will expire on its own after a few hours.
2) Firewall off all but a few bastion hosts and ProxyCommand through those. Immediate revocation can be assured by updating the CRLs on those specific hosts.
- Spivak 7y agoBuy why go through the extra effort compared to just having your servers ask the IdP for the user's keys?
- cbhl 7y agoIf your IdP goes down, how will you SSH in to fix it?
- exabrial 7y agoCurrently we use the root "physical" console. Generally we avoid IDP outages by keeping our LDAP servers clustered and geographically diversified. Because LDAP is 99.999% of the time reads, not writes, this makes clustering pretty simple.
- webvictim 7y agoHaving been on the rough end of this during a huge LDAP outage, I can confirm that LDAP is great until such time as it isn't.
- sytringy05 7y ago+1 this is no fun.
- webvictim 7y agoThis is definitely the premise of what I was going for with the post. I'm a firm believer in the idea that short-lived certificates which expire by default are one of the best ways to provide access to infrastructure, and enforcing that access comes from a limited list of bastions gives you an easy choke point to withdraw access as desired when you need to.
- sytringy05 7y agoIsn't there a netflix ssh CA that does this?
- V-eHGsd_ 7y agoyes, it's called bless. https://github.com/Netflix/bless https://github.com/Netflix/bless there's also cashier https://github.com/nsheridan/cashier https://github.com/nsheridan/cashier