4 ms·
Experienced the same dilemma. I’ll say what I do and what I want to do. What I do is SSH as root using SSH certificates. This allows me to use rsync commands i
by klodolph 6y ago
Experienced the same dilemma. I’ll say what I do and what I want to do.
What I do is SSH as root using SSH certificates. This allows me to use rsync commands in Ansible, because elevating to root after login does not.
What I want to do is generate short-lived SSH certificates for root login. Something like, “Run prod-ssh command, enter password, touch YubiKey, and I can SSH as root for the next four hours.” I know how to make this possible, it would just require a couple days of engineering to do it, and I have other things to do.
If I had more hosts to work with I would make one of them run HashiCorp Vault, and serve as an SSH certificate authority for the others.
If I were a team of people managing servers I would probably switch from Ansible to something else. I would want every configuration action to go through source control before being pushed to live servers. As it is, I’m one person, so I don’t need that.
Evaluate for yourself whether this meets your needs, of course. I want to find my own balance between security, safety (removing foot-guns), and convenience.
- corney91 6y agoFor root rsync in Ansible, have you tried using "become: no" and the synchronize module with "rsync_path: sudo rsync"? IIRC that's worked quite well for me. It'd need passwordless sudo so only a minor improvement, but avoiding root login allows you to limit which tasks run as privileged/non-privileged users, tick boxes when it comes to audits, and allows multiple users to run the same playbooks under their own account. As you've just said, it might not fit everyone's needs, but thought it's worth putting out there for anybody who would prefer not to log in as root.
- klodolph 6y agoIf I wanted to tick boxes when it comes to audits, TBH I would migrate from Ansible to something else where changes get pushed to source control first (before push) and nobody has root access during normal operations. I’m using Ansible specifically because I can push directly from my personal machine. I strongly prefer NOT to have passwordless sudo. Disabling root login and then enabling passwordless sudo seems like a pointless exercise in ticking the boxes—any benefit from disabling root login is undone by enabling passwordless sudo.
- drybjed 6y agoRegarding your idea of short lived root SSH certificates. Netflix BLESS[1] is an implementation of this, but it relies on AWS Lambda. Thers's also an open source re-implementation without this dependency, called CURSE[2]. [1]: https://github.com/Netflix/bless https://github.com/Netflix/bless [2]: https://github.com/mikesmitty/curse https://github.com/mikesmitty/curse