4 ms·

Can't some Hacker News reader start a company that can do this right so I don't have to think about it? It would be really nice to have a solution to this prob

Can't some Hacker News reader start a company that can do this right so I don't have to think about it? It would be really nice to have a solution to this problem that doesn't require the user to go to first principles involving Alice, Bob, and Charlie.

tptacek 6y ago
You mean, like: https://gravitational.com/teleport/ https://gravitational.com/teleport/
ViViDboarder 6y ago
Smallstep has done a few blog posts of doing this simply using their tools.
different_sort 6y ago
Hashicorp vault? You probably have more secrets than SSH to protect. If you’re on AWS also consider high value add built ins like EC2 instance connect or ssm session manager so you can manage host access via IAM.
avanai 6y ago
Something like https://www.okta.com/products/advanced-server-access/ https://www.okta.com/products/advanced-server-access/ ?
paolomrg 6y ago
Solved all my headaches and saved a lot of time managing my (and teammates) SSH keys with this service: https://authkeys.io/ https://authkeys.io/
- mpaepper 6y ago
  Nice, looks like they pretty much automated what I described in my article as a service.
  - gizero76 6y ago
    Hi! Thanks for looking at Authkeys, company co-founder here. The technical approach is slightly different. Theoapp, the opensource core behind Authkeys leverages AuthorizedKeysCommand [1] sshd feature, instead of using a CA for signing public keys. macno's post at [2] covers it with more context and references. [1] https://linux.die.net/man/5/sshd_config https://linux.die.net/man/5/sshd_config [2] https://news.ycombinator.com/item?id=24620842 https://news.ycombinator.com/item?id=24620842
macno 6y ago
Actually we did! Disclaimer: main developer and co-founder here. We started theoapp [1] in mid 2018 and we introduced it at FOSDEM 2019 [2]. We then launched AuthKeys [3], a company that offers it as SaaS. From a technical standpoint, we chose a different approach than that described by this thread's O.P. More specifically we implemented our service as a client/server suite to integrate with the standard sshd authorizedKeysCommand feature. Rationale and more technical details can be found at the links below. We've been in "stealth mode" until now (this is our very first public post!), while running the service with selected customers since December 2019. Recent developments will soon allow us to widen the product’s offer with a self-hosted solution of AuthKeys. Feedback from the HN community is more than welcome: we'd like to hear whether the website is effective and clear enough on explaining how AuthKeys works [4]. We realized the topic comes with a certain degree of complexity for some potential users while others really want to quickly spot how the internals work and how we managed to make it secure to trust and easy to use. We’ll be happy to answer any questions on the matter, and to offer promo codes to HN readers in case you wish to give it a go. [1] https://github.com/theoapp/ https://github.com/theoapp/ [2] https://archive.fosdem.org/2019/schedule/event/theo_keys_manager/ https://archive.fosdem.org/2019/schedule/event/theo_keys_man... [3] https://authkeys.io/ https://authkeys.io/ [4] https://authkeys.io/how-it-works https://authkeys.io/how-it-works

tptacek 6y ago

You mean, like: https://gravitational.com/teleport/ https://gravitational.com/teleport/

ViViDboarder 6y ago

Smallstep has done a few blog posts of doing this simply using their tools.

different_sort 6y ago

Hashicorp vault? You probably have more secrets than SSH to protect. If you’re on AWS also consider high value add built ins like EC2 instance connect or ssm session manager so you can manage host access via IAM.

avanai 6y ago

Something like https://www.okta.com/products/advanced-server-access/ https://www.okta.com/products/advanced-server-access/ ?

paolomrg 6y ago

Solved all my headaches and saved a lot of time managing my (and teammates) SSH keys with this service: https://authkeys.io/ https://authkeys.io/

mpaepper 6y ago
Nice, looks like they pretty much automated what I described in my article as a service.
- gizero76 6y ago
  Hi! Thanks for looking at Authkeys, company co-founder here. The technical approach is slightly different. Theoapp, the opensource core behind Authkeys leverages AuthorizedKeysCommand [1] sshd feature, instead of using a CA for signing public keys. macno's post at [2] covers it with more context and references. [1] https://linux.die.net/man/5/sshd_config https://linux.die.net/man/5/sshd_config [2] https://news.ycombinator.com/item?id=24620842 https://news.ycombinator.com/item?id=24620842

macno 6y ago

Actually we did! Disclaimer: main developer and co-founder here. We started theoapp [1] in mid 2018 and we introduced it at FOSDEM 2019 [2]. We then launched AuthKeys [3], a company that offers it as SaaS. From a technical standpoint, we chose a different approach than that described by this thread's O.P. More specifically we implemented our service as a client/server suite to integrate with the standard sshd authorizedKeysCommand feature. Rationale and more technical details can be found at the links below. We've been in "stealth mode" until now (this is our very first public post!), while running the service with selected customers since December 2019. Recent developments will soon allow us to widen the product’s offer with a self-hosted solution of AuthKeys. Feedback from the HN community is more than welcome: we'd like to hear whether the website is effective and clear enough on explaining how AuthKeys works [4]. We realized the topic comes with a certain degree of complexity for some potential users while others really want to quickly spot how the internals work and how we managed to make it secure to trust and easy to use. We’ll be happy to answer any questions on the matter, and to offer promo codes to HN readers in case you wish to give it a go. [1] https://github.com/theoapp/ https://github.com/theoapp/ [2] https://archive.fosdem.org/2019/schedule/event/theo_keys_manager/ https://archive.fosdem.org/2019/schedule/event/theo_keys_man... [3] https://authkeys.io/ https://authkeys.io/ [4] https://authkeys.io/how-it-works https://authkeys.io/how-it-works