5 ms·

I believe privileged access management is the proper way to manage access to a password protected systems. It is basically a terminal server, proxy, bastion or

by adontz 3y ago

I believe privileged access management is the proper way to manage access to a password protected systems. It is basically a terminal server, proxy, bastion or anything similar. You log in there with federated identity (for example AD) and it logs you in into target system with some shared or temporary user. Usually it also records session and does other security/compliance related things. Examples are Delinea (former Thycotic), CyberArk, To some extent Apache Guacamole can be used as PAM.

steve1977 3y ago
Why not use something like Kerberos (for example) and have the proper identity also on the system where you log in to via SSH?
- adontz 3y ago
  Kerberos is a) relatively complex to set up properly if its not a Windows in AD b) an SSO, not federated ID. Which means reasking MFA is not possible.
  - josephcsible 3y ago
    > reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and then never ask again from it?
    - adontz 3y ago
      I'd rather reask credentials before elevating effective access level. Just like sudo reasks password. I don't mean reasking MFA to access corporate intranet website with a blog no one reads, I mean reasking for administrative access.
      - gnufx 3y ago
        If you want a session with extra permissions you use an appropriate Kerberos principal, e.g. admin/...
        adontz 3y ago
        I know. This practice of having two user accounts sucks.
        gnufx 3y ago
        Suid and ambient authority suck. I'd rather a more principalled approach.
  - mmh0000 3y ago
    Check out FreeIPA (or Red Hat IdM if you like paying for things.). It’s Kerberos and a few other utilities in a very easy to setup package. It also support OTP MFA https://www.freeipa.org/ https://www.freeipa.org/ https://www.freeipa.org/page/V4/OTP https://www.freeipa.org/page/V4/OTP
    - gnufx 3y ago
      MIT Kerberos supports preauth with OTP, or PKINIT (X.509 certifies); I don't know what Heimdal currently has. FreeIPA has been doing good work past that, on integrating FIDO, for instance, and can issue tickets on the basis of external identity providers. It certainly does more -- like a souped-up AD.
  - gnufx 3y ago
    I don't see how setting up MIT or Heimdal Kerberos is complex compared with AD (which is more than Kerberos); they seem easy enough to me. SSO seems to me what you want, and Kerberos is the reasonable implementation.
bityard 3y ago
These are a good idea for large enterprise organizations. We are using a product called Securden which offers PAM features. (But I much prefer keys/certs over passwords where possible.)
616c 3y ago
They become a very high value target though and I have learned "security software" devs are as fallible as all devs, sometimes more. Thycotic had some vulnerability with a symmetric recovery key a few years ago. But comprehensive product like this or roll your own this is frequent so I'd rather do keys and certs like others suppose
cmrx64 3y ago
I fully agree. Essentially, the PAM wraps a pure knowledge-based “keys as capabilities” model into a much richer “real capabilities” model.
johann8384 3y ago
There are multiple proper ways depending on your needs and the context. I've used systems like this and I completely agree with you for many cases.
pphysch 3y ago
If using OpenSSH, you can roll your own solution by setting AuthorizedKeysCommand to curl a secure internal auth server.
yetanotherloss 3y ago
I've been moving away from this model towards user-asssociated VPNs or (inverse) captive portals. Used Powerbroker and cyberark for a long time and while they're good at stated purpose the integration with more flexible and modern auth systems has had a lot of friction. The particular regulatory area I work in is also just a non-starter for federated AAA from outside the regulated systems which colors my opinion though. Combined with command restrictions in openssh and sudo etc you end up with several wholly disjoint attack surfaces, decent logging, and granular user restrictions.
- unixhero 3y ago
  >I've been moving away from this model towards user-asssociated VPNs or (inverse) captive portals. Would you care to share how you achieve this/what does the implementation of these two look like?
  - yetanotherloss 3y ago
    The terminology varies by vendors but essentially there are authentication portals that users will log into and receive auth tickets. These are forwarded to network gateways, usually encrypted in a vpn tunnel, that allow traffic based on user RBAC, sometimes region or time, etc. Captive portals are web auth pages for use cases the more structured method doesn't work for. They were envisioned as making you sign in hotel wifi and such but work in the other direction as well by forcing a web user login before allowing traffic from a host for some period of time.
oneplane 3y ago
PAM does not preclude having everything secure instead of some sort of 'hardened' bastion and 'soft' destination. Everything should be 'hardened'. This also means everything has to do proper authentication and authorisation, and skipping that step by letting some proxy do that just creates a bottleneck in security, reliability, availability, and performance. It also doesn't really matter how it's done, a Kerberos Ticket, x509 client certificate, JWT or multiple credentials (i.e. username with a password and MFA token) are all plenty valid. Granted, a ticket, certificate or token allows shipping claims or attributes allows for directory-less access control, but that doesn't mean that having to do directory lookups is not feasible anymore. Most of the other things like f5, pa, Citrix, powerbroker and bomgar are just really shoddy software that you setup to attempt to not have to bear responsibility or know what you're doing (or it's clipboard/checklist-based security...), but that just bypasses fulfilling the actual need of a good IAM and PAM implementation. None of those products do it better than what is natively supported, and they are consistently more problematic (be it performance, cost or actual security).
Too 3y ago
Is there any tool out there that can provide this using short lived ssh certificates?
- oarmstrong 3y ago
  Hashicorp's Vault works quite nicely. Teleport is another tool I believe handles this but haven't used it personally.
signal11 3y ago
> privileged access management is the proper way to manage access to a password protected systems Managing access to privileged systems at scale is hard despite these tools. This isn’t a knock on the tools. It’s a people/risk problem. Eg staying on top of those recorded sessions becomes increasingly difficult over time. The sustainable way is to work with business and compliance and remove the need for privileged access. It’s doable in many scenarios and leaves a very small “rump” of things that do need privileged access, with all the attendant overhead. In general, challenging teams to do without privileged access and making it a “last resort” thing is a great idea, depending upon your industry / risk profile.
- deleted 3y ago
  [deleted]

by adontz 3y ago

steve1977 3y ago

Why not use something like Kerberos (for example) and have the proper identity also on the system where you log in to via SSH?

adontz 3y ago
Kerberos is a) relatively complex to set up properly if its not a Windows in AD b) an SSO, not federated ID. Which means reasking MFA is not possible.
- josephcsible 3y ago
  > reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and then never ask again from it?
  - adontz 3y ago
    I'd rather reask credentials before elevating effective access level. Just like sudo reasks password. I don't mean reasking MFA to access corporate intranet website with a blog no one reads, I mean reasking for administrative access.
    - gnufx 3y ago
      If you want a session with extra permissions you use an appropriate Kerberos principal, e.g. admin/...
      - adontz 3y ago
        I know. This practice of having two user accounts sucks.
        gnufx 3y ago
        Suid and ambient authority suck. I'd rather a more principalled approach.
- mmh0000 3y ago
  Check out FreeIPA (or Red Hat IdM if you like paying for things.). It’s Kerberos and a few other utilities in a very easy to setup package. It also support OTP MFA https://www.freeipa.org/ https://www.freeipa.org/ https://www.freeipa.org/page/V4/OTP https://www.freeipa.org/page/V4/OTP
  - gnufx 3y ago
    MIT Kerberos supports preauth with OTP, or PKINIT (X.509 certifies); I don't know what Heimdal currently has. FreeIPA has been doing good work past that, on integrating FIDO, for instance, and can issue tickets on the basis of external identity providers. It certainly does more -- like a souped-up AD.
- gnufx 3y ago
  I don't see how setting up MIT or Heimdal Kerberos is complex compared with AD (which is more than Kerberos); they seem easy enough to me. SSO seems to me what you want, and Kerberos is the reasonable implementation.

bityard 3y ago

These are a good idea for large enterprise organizations. We are using a product called Securden which offers PAM features. (But I much prefer keys/certs over passwords where possible.)

616c 3y ago

They become a very high value target though and I have learned "security software" devs are as fallible as all devs, sometimes more. Thycotic had some vulnerability with a symmetric recovery key a few years ago. But comprehensive product like this or roll your own this is frequent so I'd rather do keys and certs like others suppose

cmrx64 3y ago

I fully agree. Essentially, the PAM wraps a pure knowledge-based “keys as capabilities” model into a much richer “real capabilities” model.

johann8384 3y ago

There are multiple proper ways depending on your needs and the context. I've used systems like this and I completely agree with you for many cases.

pphysch 3y ago

If using OpenSSH, you can roll your own solution by setting AuthorizedKeysCommand to curl a secure internal auth server.

yetanotherloss 3y ago

I've been moving away from this model towards user-asssociated VPNs or (inverse) captive portals. Used Powerbroker and cyberark for a long time and while they're good at stated purpose the integration with more flexible and modern auth systems has had a lot of friction. The particular regulatory area I work in is also just a non-starter for federated AAA from outside the regulated systems which colors my opinion though. Combined with command restrictions in openssh and sudo etc you end up with several wholly disjoint attack surfaces, decent logging, and granular user restrictions.

unixhero 3y ago
>I've been moving away from this model towards user-asssociated VPNs or (inverse) captive portals. Would you care to share how you achieve this/what does the implementation of these two look like?
- yetanotherloss 3y ago
  The terminology varies by vendors but essentially there are authentication portals that users will log into and receive auth tickets. These are forwarded to network gateways, usually encrypted in a vpn tunnel, that allow traffic based on user RBAC, sometimes region or time, etc. Captive portals are web auth pages for use cases the more structured method doesn't work for. They were envisioned as making you sign in hotel wifi and such but work in the other direction as well by forcing a web user login before allowing traffic from a host for some period of time.

oneplane 3y ago

PAM does not preclude having everything secure instead of some sort of 'hardened' bastion and 'soft' destination. Everything should be 'hardened'. This also means everything has to do proper authentication and authorisation, and skipping that step by letting some proxy do that just creates a bottleneck in security, reliability, availability, and performance. It also doesn't really matter how it's done, a Kerberos Ticket, x509 client certificate, JWT or multiple credentials (i.e. username with a password and MFA token) are all plenty valid. Granted, a ticket, certificate or token allows shipping claims or attributes allows for directory-less access control, but that doesn't mean that having to do directory lookups is not feasible anymore. Most of the other things like f5, pa, Citrix, powerbroker and bomgar are just really shoddy software that you setup to attempt to not have to bear responsibility or know what you're doing (or it's clipboard/checklist-based security...), but that just bypasses fulfilling the actual need of a good IAM and PAM implementation. None of those products do it better than what is natively supported, and they are consistently more problematic (be it performance, cost or actual security).

Too 3y ago

Is there any tool out there that can provide this using short lived ssh certificates?

oarmstrong 3y ago
Hashicorp's Vault works quite nicely. Teleport is another tool I believe handles this but haven't used it personally.

signal11 3y ago

> privileged access management is the proper way to manage access to a password protected systems Managing access to privileged systems at scale is hard despite these tools. This isn’t a knock on the tools. It’s a people/risk problem. Eg staying on top of those recorded sessions becomes increasingly difficult over time. The sustainable way is to work with business and compliance and remove the need for privileged access. It’s doable in many scenarios and leaves a very small “rump” of things that do need privileged access, with all the attendant overhead. In general, challenging teams to do without privileged access and making it a “last resort” thing is a great idea, depending upon your industry / risk profile.

deleted 3y ago
[deleted]