5 ms·

>I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that

by iotku 5y ago

>I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that I'd probably spend more time figuring out than get benefit from it given my relatively small footprint. Definitely have a lot more ssh authorized_hosts entries lingering around from old systems than I'm happy about. [1] https://www.vaultproject.io/ https://www.vaultproject.io/

arthurcolle 5y ago
Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?
- thinkmassive 5y ago
  Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
- mewse 5y ago
  A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
  - iotku 5y ago
    >Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. >Lesson learned: when software says that you need a private network, you need a private network. Hah yeah, I imagine a properly secured (famous last words) VPN setup is kinda necessary when dealing with stuff like that. Having your secrets in one place (especially remotely accessible) is a very attractive target and you don't want to find out there's a 0day (or general misconfiguration) on your management system the hard way. I'd like to think that I could make something like that work, but it's certainly more than setup and forget about it.
- 3np 5y ago
  Mostly happy Vault user here. Unless you have hundreds of systems to authenticate (to), maybe with short-lived secrets, I think Vault will bring you more cognitive overhead, not less. I love it for system-to-system auth, or running on the system side at least, but for individual use I think a password manager will do you better. Though yeah, I'd also like a better key management setup for myself. I have not been able to get either gpg-agent or ssh-agent to where I want in terms or privacy or usability.

by iotku 5y ago

arthurcolle 5y ago

Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?

thinkmassive 5y ago
Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
mewse 5y ago
A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
- iotku 5y ago
  >Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. >Lesson learned: when software says that you need a private network, you need a private network. Hah yeah, I imagine a properly secured (famous last words) VPN setup is kinda necessary when dealing with stuff like that. Having your secrets in one place (especially remotely accessible) is a very attractive target and you don't want to find out there's a 0day (or general misconfiguration) on your management system the hard way. I'd like to think that I could make something like that work, but it's certainly more than setup and forget about it.
3np 5y ago
Mostly happy Vault user here. Unless you have hundreds of systems to authenticate (to), maybe with short-lived secrets, I think Vault will bring you more cognitive overhead, not less. I love it for system-to-system auth, or running on the system side at least, but for individual use I think a password manager will do you better. Though yeah, I'd also like a better key management setup for myself. I have not been able to get either gpg-agent or ssh-agent to where I want in terms or privacy or usability.