3 ms·

I use hashi corp's stack: Boundary + Vault for ssh credential injection https://developer.hashicorp.com/boundary/tutorials/credential-management/hcp-private-va

by slt2021 3y ago

I use hashi corp's stack: Boundary + Vault for ssh credential injection https://developer.hashicorp.com/boundary/tutorials/credential-management/hcp-private-vault-cred-injection https://developer.hashicorp.com/boundary/tutorials/credentia... it completely replaces the need for bastion hosts and ssh-agent at scale (I'm a hashicorp's paying customer) compared to Teleport, boundary is lightweight (you dont need to install agent on each target server) and is integrated with the Vault for certificate based auth or simple cred brokering

wahern 3y ago
I wrote a macOS app that supports using Vault Transit Engine keys with OpenSSH, as well as GnuPG and PKCS#11. (OpenSSH is supported via both the agent protocol and PKCS#11.) You can even use an Apple T2 (Secure Enclave) key for peer mTLS authentication to the Vault server. https://www.keymux.com/ https://www.keymux.com/ Using this teams can share an SSH key without exposing the key; nor do you need to configure certificate PKI, use jump hosts, or otherwise change your existing software or workflows.