6 ms·

Even when using a jump server, I've solved the issue of revoking access in the past by using LDAP to control access to servers. Instead of adding user accounts

Even when using a jump server, I've solved the issue of revoking access in the past by using LDAP to control access to servers. Instead of adding user accounts directly to server, the account information is stored in LDAP -- including public SSH keys. If you want to revoke a user's access across the entire infrastructure, then you can do so in one fell swoop. I also have set this up to restrict SSH access to particular hosts based on the LDAP record. The problem they are describing isn't a problem with Jump servers... it's a problem with distributed authorization.

debarshri 4y ago
I haven't seen many organisations actually set SSH PAM via LDAP or another delegated authentication system. You are right about the problem statement. It is distributed authorization problem. And it is a very hard problem to solve or visualize for a fast moving company unless it is a problem.
- POPOSYS 4y ago
  Do you have some data about how many orgs actually set SSH PAM via LDAP? Where can I see this data? I would like to check your statements. We are on the internet, so would you please like to add the source of knowledge to your statements - it is a very basic and good feature called "URL", please use it! Or do you just want to say "I have not seen many orgs with SSH + LDAP in my career because I have never worked in one and from that I conclude that the whole world works like this"?
  - debarshri 4y ago
    I don't think neither me nor anyone reading that statement would come to a conclusion that the works the way I suggested in that argument. I can talk about me interviewing and empirical data of talking to dozens of companies from seed to series B and how they have been managing access to servers. But I won't, I would rather urge you to do basic trend search either on google or your favorite platform for SSH PAM via LDAP or SSH LDAP and see it for yourself where the world is heading [1]. [1] https://trends.google.com/trends/explore?date=today%205-y&q=ssh%20ldap https://trends.google.com/trends/explore?date=today%205-y&q=...
    - mbreese 4y ago
      Oh, I’m sure it’s super rare. It’s actually quite easy to setup, but I’m not sure many people bother with the setup because LDAP (I’m not counting Active Directory) in general isn’t all that common. I know this just from the rarity of articles posted about getting it configured. But once you do it, it’s something that’s easy to keep using because it’s so useful. My favorite was setting up LDAP in combination with a jump host where I had a special program for the SSH command shell (like prgmr.com). I had it setup where the use could authenticate with a password, but then upload an SSH key from the custom shell.
      - debarshri 4y ago
        I am not debating the usefulness of LDAP integrated with SSH. I am agree with you.
        deleted 4y ago
        [deleted]
    - pnutjam 4y ago
      Based on the interviewing I did last year, the clear trending solution, for enterprise, is Cyberark. I saw that all over the place for root password management.
      - mbreese 4y ago
        This isn’t root password management. Or at least, it shouldn’t be. Users shouldn’t have root passwords for end devices. This is about controlling access to remote servers and/or sudo access to those servers. None of which requires the root password on the remote server, unless I’m missing something. Is this for more ephemeral keys?
      - debarshri 4y ago
        Cyberark [1] and delinea [2] are definitely leading enterprise solution right now. Okta too has an offering in this space but I haven't seen it used widely yet. But there are quite some solutions in market at this point that are in growing trend. You would find teleport [3], strongdm [4] in high growth companies where as Adaptive.live [5], Idemium.io [6] and now hoop.dev in the early stage to series B. [1] https://www.cyberark.com/ https://www.cyberark.com/ [2] https://delinea.com/thycotic https://delinea.com/thycotic [3] https://delinea.com/thycotic https://delinea.com/thycotic [4] https://www.strongdm.com/ https://www.strongdm.com/ [5] https://adaptive.live/ https://adaptive.live/ [6] https://idemeum.com/ https://idemeum.com/
  - ilyt 4y ago
    Most orgs are incompetent. We had same discussion with many of our clients, where their requirement was stupid shit like "change password every month" while we had to negotiate that no, we don't even use passwords in the first place, we use hardware tokens for SSH keys. And I'm talking about few big local banks, where accounts on Red Hat boxes are still created by some ops dude manually according to some docs.
trey-jones 4y ago
I set up LDAP with sshPublicKey extension in 2021 together with some scripts to configure new servers to use it and a small command line tool to add and remove GIDs per user (across any infrastructure). It's working great. The biggest effort was learning to manage LDAP, which is a bit anachronistic, but the payoff is worth it I think. Even with <20 users, managing public keys across all of our infrastructure was not sustainable.
ilyt 4y ago
The problem the article is describing is frankly problem with lack of good configuration management. Hell, you can use SSH keys to authorize via sudo and use hardware token to store those keys, sidestepping problem of "user left their id_rsa somewhere"

debarshri 4y ago

I haven't seen many organisations actually set SSH PAM via LDAP or another delegated authentication system. You are right about the problem statement. It is distributed authorization problem. And it is a very hard problem to solve or visualize for a fast moving company unless it is a problem.

POPOSYS 4y ago
Do you have some data about how many orgs actually set SSH PAM via LDAP? Where can I see this data? I would like to check your statements. We are on the internet, so would you please like to add the source of knowledge to your statements - it is a very basic and good feature called "URL", please use it! Or do you just want to say "I have not seen many orgs with SSH + LDAP in my career because I have never worked in one and from that I conclude that the whole world works like this"?
- debarshri 4y ago
  I don't think neither me nor anyone reading that statement would come to a conclusion that the works the way I suggested in that argument. I can talk about me interviewing and empirical data of talking to dozens of companies from seed to series B and how they have been managing access to servers. But I won't, I would rather urge you to do basic trend search either on google or your favorite platform for SSH PAM via LDAP or SSH LDAP and see it for yourself where the world is heading [1]. [1] https://trends.google.com/trends/explore?date=today%205-y&q=ssh%20ldap https://trends.google.com/trends/explore?date=today%205-y&q=...
  - mbreese 4y ago
    Oh, I’m sure it’s super rare. It’s actually quite easy to setup, but I’m not sure many people bother with the setup because LDAP (I’m not counting Active Directory) in general isn’t all that common. I know this just from the rarity of articles posted about getting it configured. But once you do it, it’s something that’s easy to keep using because it’s so useful. My favorite was setting up LDAP in combination with a jump host where I had a special program for the SSH command shell (like prgmr.com). I had it setup where the use could authenticate with a password, but then upload an SSH key from the custom shell.
    - debarshri 4y ago
      I am not debating the usefulness of LDAP integrated with SSH. I am agree with you.
      - deleted 4y ago
        [deleted]
  - pnutjam 4y ago
    Based on the interviewing I did last year, the clear trending solution, for enterprise, is Cyberark. I saw that all over the place for root password management.
    - mbreese 4y ago
      This isn’t root password management. Or at least, it shouldn’t be. Users shouldn’t have root passwords for end devices. This is about controlling access to remote servers and/or sudo access to those servers. None of which requires the root password on the remote server, unless I’m missing something. Is this for more ephemeral keys?
    - debarshri 4y ago
      Cyberark [1] and delinea [2] are definitely leading enterprise solution right now. Okta too has an offering in this space but I haven't seen it used widely yet. But there are quite some solutions in market at this point that are in growing trend. You would find teleport [3], strongdm [4] in high growth companies where as Adaptive.live [5], Idemium.io [6] and now hoop.dev in the early stage to series B. [1] https://www.cyberark.com/ https://www.cyberark.com/ [2] https://delinea.com/thycotic https://delinea.com/thycotic [3] https://delinea.com/thycotic https://delinea.com/thycotic [4] https://www.strongdm.com/ https://www.strongdm.com/ [5] https://adaptive.live/ https://adaptive.live/ [6] https://idemeum.com/ https://idemeum.com/
- ilyt 4y ago
  Most orgs are incompetent. We had same discussion with many of our clients, where their requirement was stupid shit like "change password every month" while we had to negotiate that no, we don't even use passwords in the first place, we use hardware tokens for SSH keys. And I'm talking about few big local banks, where accounts on Red Hat boxes are still created by some ops dude manually according to some docs.

trey-jones 4y ago

I set up LDAP with sshPublicKey extension in 2021 together with some scripts to configure new servers to use it and a small command line tool to add and remove GIDs per user (across any infrastructure). It's working great. The biggest effort was learning to manage LDAP, which is a bit anachronistic, but the payoff is worth it I think. Even with <20 users, managing public keys across all of our infrastructure was not sustainable.

ilyt 4y ago

The problem the article is describing is frankly problem with lack of good configuration management. Hell, you can use SSH keys to authorize via sudo and use hardware token to store those keys, sidestepping problem of "user left their id_rsa somewhere"