5 ms·
What seems to be missing from this is how I assign permissions to individual hosts. When I'm using public keys, I do so by only adding the user's public key to
by michaelmior 5y ago
What seems to be missing from this is how I assign permissions to individual hosts. When I'm using public keys, I do so by only adding the user's public key to the hosts I want them to access. It seems the way that certificates were presented that adding a user implicitly gives them access to all hosts using the same CA. I'm sure there's a solution to this problem, but does anyone have any pointers?
For example, I want hostA and hostB to use the same CA. But some users should only have access to hostA but others should only have access to hostB. Others may have access to both.
- gouggoug 5y agoSimply don’t create a user account for these users on the hosts they shouldn’t access.
- blueflow 5y agoSet the principal name in the Certificates to the name of the users team. On the server side, set the AuthorizedPrincipals* for root to the list of allowed teams.
- tener 5y agoFor scalable, centrally managed solution see: https://goteleport.com/docs/access-controls/reference/#rbac-for-hosts https://goteleport.com/docs/access-controls/reference/#rbac-... Disclaimer: day work.
- tuananh 5y agoit's covered in this post https://engineering.fb.com/2016/09/12/security/scalable-and-secure-access-with-ssh/ https://engineering.fb.com/2016/09/12/security/scalable-and-...
- michaelmior 5y agoThanks! This seems like a pretty simple approach to implement but I'd also imagine it would scale reasonably well after automating various pieces.