3 ms·
I strongly disagree with the article, but: Have a yubikey to connect to your jumphost(we called that access vm), then have a cronjob that will, every month, de
by orwin 6y ago
I strongly disagree with the article, but:
Have a yubikey to connect to your jumphost(we called that access vm), then have a cronjob that will, every month, deploy ansible, generate a key pair on the accessvm and deploy those new key on accessible vms (ideally not your log collecting vm, that should be even more secured.).
- jlgaddis 6y agoWere you using some awesome new cryptographically secure method to manage the passphrases of the newly generated keys (and communicate them to the user)? Or, more likely, were all of these new private keys granting access to all of your hosts just sitting there on disk unencrypted -- and, as a result, freely available to and easily stolen and used to gain access to all of your production machines by the first attacker to come along and compromise the bastion host?