3 ms·
Where do you get the fingerprints to check against? Three intuitive but wrong answers: a) By spawning the instance with a script that will post them to some AP
by closeparen 6y ago
Where do you get the fingerprints to check against? Three intuitive but wrong answers:
a) By spawning the instance with a script that will post them to some API. Now you are just blindly trusting whatever gets posted to that API. If your provider offers instance identity documents, you could sign the request with that, but an attacker who can MITM within your VPC can presumably impersonate anyone to the instance metadata service. And if MITM within the VPC is not in your threat model, then blind trust (from another host in the VPC) is fine.
b) By having an SSH CA service connect to the instance to grab its public key. The CA is extending the same blind trust as the admin would have in doing it manually.
c) By having generated the host keypair somewhere other than the host. Now you have key material in the wrong places.
I don't think there's such a clear-cut line here. "Verify" just pushes the blind trust somewhere else.
I can think of some potentially better answers, for example write the public key to a block device, detach it from the new host, attach it to a verification service host and read it there. But this is kind of just reinventing networking... why do we trust the cloud provider's SAN more than its SDN?
- MaxBarraclough 6y ago> Where do you get the fingerprints to check against? Any serious cloud/VPS provider will offer a way, leveraging HTTPS. On EC2, the Linux distro writes the SSH fingerprint to the instance's 'system log' which can be securely viewed over the AWS web dashboard. On Linode, you can use a web-based terminal session (over HTTPS of course) to run a command to show the fingerprint. I've discussed this in other replies in this thread. > "Verify" just pushes the blind trust somewhere else. Not really. If my cloud provider is compromised, it's game-over anyway. Provided there's a secure channel to communicate the fingerprint, and provided we really do check the fingerprint (most people just don't bother), we should be ok. > write the public key to a block device, detach it from the new host, attach it to a verification service host and read it there Yep, that's pretty much the Amazon approach!
- closeparen 6y agoCaring about MITM inside the VPC already assumes cloud provider compromise.
- MaxBarraclough 6y agoIt's not inside the VPC, I'm connecting from the outside. I agree there's little need to check fingerprints for VPC-internal sessions.
- detaro 6y agoNote that you've introduced the additional measure of "inside a providers VPC". Which indeed is a solution, but not something every environment provides and not everyone uses.
- closeparen 6y agoHow many organizations are paranoid enough to care about MITM but not enough to have private networking?