alexk

19 ms·

1. 121.▲
   by alexk 9y ago

   Have you considered more conservative rate-limiting external IPs on login endpoints? E.g. with nginx it will make sense to set a custom rate limiting zone to prevent many requests from the same IP specifically to the login page: https:&#x2
2. 122.▲
   by alexk 9y ago

   Thanks for sending us your resume, we really appreciate it and I'm really sorry we missed your email. Feel free to ping me at sasha@gravitational.com, so I can respond directly.
3. 123.▲
   by alexk 9y ago

   Gravitational (YS S15) | Devops | Toronto | ONSITE https://gravitational.com Gravitational, an early stage systems & cloud startup in San Francisco and Toronto, is looking for ambitious and talented people. We are well-funde
4. 124.▲
   by alexk 9y ago

   when connecting to the agent teleport uses `SSH_AUTH_SOCK` environment variable, so as long as you set the right variable, tsh login should work, unless I'm missing something.
5. 125.▲
   by alexk 9y ago

   No infrastructure secret management or very bad infrastructure secret management: * Private SSH/AWS API Keys in Github * Shared Prod Passwords Not applying updates to infrastructure regularly
6. 126.▲
   by alexk 9y ago

   OpenShift is a great PaaS that brought a lot of innovation and improvements to Kubernetes, congrats team on the awesome and useful product! Here are just some of the influences of OpenShift on Kubernetes that I'm aware of: * RBAC model
7. 127.▲
   by alexk 9y ago

   Gravitational (YS S15) | Devops | San Francisco & Toronto | ONSITE REMOTE https://gravitational.com Gravitational, an early stage systems & cloud startup in San Francisco, is looking for ambitious and talented people. W
8. 128.▲
   by alexk 9y ago

   Thanks, this seemed to be quite unusual decision to be made by the Kubernetes dev community, that's why I've asked.
9. 129.▲
   by alexk 9y ago

   > More recently, I was part of a discussion where Kubernetes has decided to roll its own logging infrastructure, while leaving important parts like log rotation still undecided.... driving me even closer to the Docker ecosystem. Can you
10. 130.▲
    by alexk 10y ago

    To be honest, it takes one email to get our pricing, and we mostly use it to stay in touch and understand your use-case better. Thanks for feedback though, we will work on making it easier to get the pricing and explain the split between en
11. 131.▲
    by alexk 10y ago

    For the folks who are interested in such things: "SSH, The Secure Shell: The Definitive Guide" is an amazing book with lots of great info and nice tricks/SSH solutions http://shop.oreilly.com/product/9780
12. 132.▲
    by alexk 10y ago

    there are a couple of nice SSH setups you can achieve with RADIUS and our friends at https://www.foxpass.com/ Vault also has SSH backends that you could find useful
13. 133.▲
    by alexk 10y ago

    the real reason for "contact us" first approach is to keep in touch with folks who are interested, understand their use cases better as we are in the relatively early stages of the enterprise offering
14. 134.▲
    by alexk 10y ago

    This is not how SSH jumphosts and Teleport Proxy work. With jumphost ssh client goes through the authentication and authorization twice: * first when connecting to the jumphost public ip and requesting to execute a subsystem to allow proxyi
15. 135.▲
    by alexk 10y ago

    Here's the overview of the feature we call "Trusted clusters" http://gravitational.com/teleport/docs/2.0/admin-guide/#trus...
16. 136.▲
    by alexk 10y ago

    > yeah this is a bad idea in general. If you have critical stuff you need to SSH into from the public internet, keep it all in private IP space and have an openvpn gateway This is not a bad idea in general. In fact, teleport proxy implem
17. 137.▲
    by alexk 10y ago

    Gravitational (YS S15) | Systems Engineers & Devops | San Francisco & Berlin | ONSITE REMOTE https://gravitational.com Gravitational, an early stage systems & cloud startup in San Francisco, is looking for ambitious
18. 138.▲
    Gravitational (YC S15) is hiring DevOps and Go/Linux systems engineers(github.com)

    1 points by alexk 10y ago
19. 139.▲
    by alexk 10y ago

    makes sense, this was written before TPR though, so there is a room for improvement.
20. 140.▲
    by alexk 10y ago

    This one: https://github.com/sorintlab/stolon It is not called the operator, but in many ways it is similar to what Etcd Operator does
21. 141.▲
    by alexk 10y ago

    > Here's a quick question - isn't StatefulSets and PersistentVolumeClaim the exact opposite of how fault tolerant database systems are generally built ? In some cases it is perfectly valid to rely on underlying storage to get H
22. 142.▲
    by alexk 10y ago

    If you are interested in deployments of databases on top of cluster orchestrators, here are some interesting projects: * Postgres automation for Kubernetes deployments https://github.com/sorintlab/stolon * Automation f
23. 143.▲
    by alexk 10y ago

    Thanks for your feedback, I've created an issue to track: https://github.com/gravitational/teleport/issues/677 Docs will be out with 1.5 release
24. 144.▲
    by alexk 10y ago

    We don't have detailed docs on our audit logs yet. Here's short description: Teleport's SSH servers capture PTY output and send logs to the audit server alongside with session metadata. Every SSH session has a unique identifi
25. 145.▲
    by alexk 10y ago

    We've recently added RBAC in master to provide a bit more fine-grained access to various user roles: https://github.com/gravitational/teleport/issues/620 This will be out in 1.5 release. Using this RBAC
26. 146.▲
    by alexk 10y ago

    BTW you can use Teleport with standard SSH clients as well: http://gravitational.com/teleport/docs/admin-guide/#using-te... tsh can work in agent mode, or you can generate certificates yourself.
27. 147.▲
    by alexk 10y ago

    Good catch, fixed!
28. 148.▲
    by alexk 10y ago

    sure thing, but then you'd need to authenticate/authorize first to get a proper set of principals and TTL, that's why Teleport authz works in a more traditional "web app" way.
29. 149.▲
    by alexk 10y ago

    Sasha, one of Teleport authors here. Not sharing password is definitely an advantage in this use case. On the other hand, thanks to pass + 2nd factor flow, Teleport creates unified Web and CLI SSH access using the same set of credentials. I
30. 150.▲
    by alexk 10y ago

    Mostly because we wanted to support Google auth out of the box and OIDC is a good way to get this + give options for pluggable auth to everyone else.