4 ms·
On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out
by InitialLastName 3y ago
On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.
- toomuchtodo 3y agoInstitutional knowledge and documentation is not free, but it has a cost!
- InitialLastName 3y agoApparently the cost of reading the documentation, asking anybody, or just looking at the account's activity was too high.
- user_7832 3y agoAah, he took down Chesterton's fence and found the reason of its existance! (https://en.wiktionary.org/wiki/Chesterton%27s_fence https://en.wiktionary.org/wiki/Chesterton%27s_fence)
- ChainOfFools 3y agoMore than once I have taken down a Chesterton's fence that I myself had originally put up
- mooreds 3y agoSounds like a few good stories....
- willcipriano 3y agoChesterton's key more like.
- at_a_remove 3y agoDang. Our scream test was just "disable if nobody could tell what it was for."
- themoonisachees 3y agoAt my previous job, we had an entire system aptly named Pandora whose entire role was keeping track of which ssh keys were permitted to be found on servers. It had a bot that would crawl through every server, and if it found a key not in it's database, it nuked it. Every new person or automation key had to first be registered fomarlly, with an end date. A bit of a hassle but definitely necessary for the space the company was in.
- smelendez 3y agoThat’s a good idea although I’d probably be paranoid enough to have a human do the deletions, out of fear of the failure mode where it deletes all the keys everywhere and nobody can log into anything.
- vertis 3y agoThere is a future where they're locked out of the servers.
- konha 3y agoWhy not use ssh certificates at that point?
- falserum 3y agoI assume op’s system was to allow A to ssh to B, but not to C. (With lot of different As and Cs) Where “but not to C” is the reason for existence. How certificates simplify that part? (Never used them, but my understanding they are usefull when you want x1,x2,… ssh’ing into y1,y2,…; two uniform sets; if set sizes approach 1, then cert usefullness aproach zero)
- themoonisachees 3y agoI would have been a good use case, but unfortunately no, if your key was registered it would be left alone on all servers (though you had to place it, and access control was done by way of bastions). Ssh certs weren't used because the system was put in place before they became commonplace.