4 ms·
If you look at their current `hardening` document it still has pretty unclear language about what is acceptable and what isn't. > Use a hardened bastion server
by cetra3 6y ago
If you look at their current `hardening` document it still has pretty unclear language about what is acceptable and what isn't.
> Use a hardened bastion server or a VPN to restrict direct access to the Salt master from the internet
Is this SSH access or is this access to the salt master from minions? Or just access in general?
- brians 6y agoApparently it includes minion-master interaction. If that’s to be “hardened” over SSH, what’s the point of all the salt keys?
- deleted 6y ago[deleted]
- user5994461 6y agoSSH bastions and VPN are two standard ways to allow external clients access into an internal network, meaning salt is never exposed publicly. I read this as a guideline that the salt master must not be exposed to the internet. Albeit could be better worded for a developer audience who doesn't understand bastions or VPN well.