mfdutra

4 ms·

1. 1.▲
   by mfdutra 10y ago

   Absolutely nothing special about them. They trust the same LDAP/Kerberos infra the laptops are part of. We have two-factor authentication, which is pretty simple with PAM. And they're only accessible if you are in our corporate ne
2. 2.▲
   by mfdutra 10y ago

   We only do that in bastion servers. It would be a bit trickier with laptops, but doable I guess.
3. 3.▲
   by mfdutra 10y ago

   Also, we bind certificates to the hosts that requested them. If a certificate and its private key move somewhere else, they will be useless. ssh-keygen -O source-address=1.2.3.4...
4. 4.▲
   by mfdutra 10y ago

   In fact, we use a lot the terms authn, authz, authnz and AAA at Facebook. :-)
5. 5.▲
   by mfdutra 10y ago

   We have hundreds of thousands of servers and we also run sshd inside containers everywhere, so we probably have over a million endpoints we can SSH into. Cache is only good for things you login frequently, like your workstation or a handful
6. 6.▲
   by mfdutra 10y ago

   We can use RevokedKeys for that, but in fact we normally issue short-lived certificates. If we ever have a mass certificate leak, we'll just rotate the entire CA.
7. 7.▲
   by mfdutra 12y ago

   Yeah, I didn't have one, I guess. I was hoping to get notifications from this thread, but no. :-(
8. 8.▲
   by mfdutra 12y ago

   I'm a drop out from a 3rd world country and I'm an engineer at Facebook. I'm also an interviewer, an trust me guys. We really don't care where and if you graduated. If you are good, you are in.