4 ms·

It's not really MITM that's the issue. It's about maintaining access control for SSH access at scale. Once you have a big enough team, and especially if you sto

It's not really MITM that's the issue. It's about maintaining access control for SSH access at scale. Once you have a big enough team, and especially if you store sensitive customer data, you generally want to start thinking about a system that can temporarily provision SSH access on demand so that nobody has standing access, at which point going through a CA and bastion servers is a canonical approach. Exactly how big your team needs to be is a judgement call, but I think a reasonable threshold where you really should start thinking about CAs for SSH access is around where it's no longer possible for the dev ops people to be aware of what everyone who needs production access is working on.

sneak 7y ago
I hadn't realized that this blog post is from the same people who make Teleport, which is a bastion/logging/access ssh proxy for solving exactly that problem. It seems to me that the linked article is probably just content marketing spam (much like Digital Ocean's extensive "how to install $x on a vps" posts) to boost the domain's pagerank/authoritativeness. I still don't think people should be using SSH CAs for anything that isn't a short-lived, single-use bastion/proxy key. They're on the right track with Teleport; not so much with this standalone article.
- dielectricboog 7y ago
  Those how to install X on a VPS articles are requested by active customers, occasionally written by customers, and consumed far more often than you think by customers. DigitalOcean responded to Linode Library (as it was then called) when building that out, and having been somewhat involved in the development of Linode Library, I can assure you that neither SEO nor PageRank was near the top of the rationale list. Maybe tenth on the list as a nice bonus. The people who worked on Linode Library in the beginning were engineers, not social media people nor content marketers. The person who wrote its first CMS is a former nuclear submariner and Perl guy with like nine followers on Twitter. I’m sure you imagine a huge meat grinder spam operation paying by the word, but basically one engineer thanklessly wrote more than half of it in the beginning and went on to a distinguished career at 10gen/Mongo, not sitting on Mechanical Turk. I’d bet DO’s operation is identical and exists for the same reasons, and they’re just as proud of it as I am my extremely limited contributions to an offering that objectively improves the operations discipline. It’s annoying to watch valuable work that expands the profession get dunked on and called spam by a snide comment for absolutely no reason. There’s no reason to be so cynical about things in a hot take, particularly when it was an irrelevant shot in context. Not everyone is blessed with innate knowledge nor a gift for studying man pages, and those docs are useful checklists to make sure I didn’t forget anything with common software like ntpd to this day in my own, principal level, career. People learn Unix operations by buying a Linode. For a $10/month VPS you also get a bunch of tested, free guides that work on them and teach you how to do things. They’re not paywalled to customers and show up in your Google results. I know. The abject horror is almost unbearable.
  - chrisweekly 7y ago
    Well said. (Despite the final sentence's understandable but unnecessary parting shot.)

sneak 7y ago

I hadn't realized that this blog post is from the same people who make Teleport, which is a bastion/logging/access ssh proxy for solving exactly that problem. It seems to me that the linked article is probably just content marketing spam (much like Digital Ocean's extensive "how to install $x on a vps" posts) to boost the domain's pagerank/authoritativeness. I still don't think people should be using SSH CAs for anything that isn't a short-lived, single-use bastion/proxy key. They're on the right track with Teleport; not so much with this standalone article.

dielectricboog 7y ago
Those how to install X on a VPS articles are requested by active customers, occasionally written by customers, and consumed far more often than you think by customers. DigitalOcean responded to Linode Library (as it was then called) when building that out, and having been somewhat involved in the development of Linode Library, I can assure you that neither SEO nor PageRank was near the top of the rationale list. Maybe tenth on the list as a nice bonus. The people who worked on Linode Library in the beginning were engineers, not social media people nor content marketers. The person who wrote its first CMS is a former nuclear submariner and Perl guy with like nine followers on Twitter. I’m sure you imagine a huge meat grinder spam operation paying by the word, but basically one engineer thanklessly wrote more than half of it in the beginning and went on to a distinguished career at 10gen/Mongo, not sitting on Mechanical Turk. I’d bet DO’s operation is identical and exists for the same reasons, and they’re just as proud of it as I am my extremely limited contributions to an offering that objectively improves the operations discipline. It’s annoying to watch valuable work that expands the profession get dunked on and called spam by a snide comment for absolutely no reason. There’s no reason to be so cynical about things in a hot take, particularly when it was an irrelevant shot in context. Not everyone is blessed with innate knowledge nor a gift for studying man pages, and those docs are useful checklists to make sure I didn’t forget anything with common software like ntpd to this day in my own, principal level, career. People learn Unix operations by buying a Linode. For a $10/month VPS you also get a bunch of tested, free guides that work on them and teach you how to do things. They’re not paywalled to customers and show up in your Google results. I know. The abject horror is almost unbearable.
- chrisweekly 7y ago
  Well said. (Despite the final sentence's understandable but unnecessary parting shot.)