Ask HN: How do you manage SSH keys and SSL certificates in your company?

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by janvdberg on Friday May 12, 2017 @02:02AM (#14321749)

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ servers are updated.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by nicklaw5 on Friday May 12, 2017 @05:08AM (#14322441)

We also use Ansible for managing SSH keys, though we only have around 20 servers to maintain. We are a small team and dont have a huge staff turnover so managing keys is not huge issue so far. As we grow, however, this procesure may need to be revisited.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by mbubb on Friday May 12, 2017 @06:09PM (#14328315)

This works pretty well - we manage ~ 300 severs in a similar manner. One wrinkle is that I ask the new user to add their keys to their github account (ie github.com/<username>.keys ) which gives them the ability to add/del keys and jira me to update their user.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by drinchev on Friday May 12, 2017 @03:17AM (#14322026)

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by Spivak on Friday May 12, 2017 @08:37AM (#14323423)

There are two states that we're talking about.

* Ensure that the following key is present.

* Ensure that only the following keys are present.

You can accomplish the second one with the 'exclusive' flag.

http://docs.ansible.com/ansible/authorized_key_module.html

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by falcolas on Friday May 12, 2017 @09:08AM (#14323633)

There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed.

That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by lamby on Friday May 12, 2017 @04:19AM (#14322249)

Not the OP, but say you were populating a directory of keys, you would simply remove it via file's state=absent and then repopulate.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by dkhenry on Friday May 12, 2017 @09:39AM (#14323848)

You can have Ansible generate the authorized_keys file from a list of public key files, then when that list changes ansible will detect that the file has changed and will copy over the new file.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by ruffrey on Friday May 12, 2017 @11:30AM (#14324848)

For a file, specify state=absent

http://docs.ansible.com/ansible/file_module.html

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by janvdberg on Friday May 12, 2017 @05:16AM (#14322468)

Yes, we run it once/only when things (people) change.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by blakesterz on Friday May 12, 2017 @08:05AM (#14323214)

Do you use Ansible for SSL as well? How do you store the keys?

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by atmosx on Sunday May 14, 2017 @06:56AM (#14335088)

Using ansible-vault, check out this gist:

https://gist.github.com/tristanfisher/e5a306144a637dc739e7

Having a partly encrypted YAML file is also available since version 2.3.0

Key management and deployment are two different things. Installing up people's private keys on the hosts, doesn't involve any management. It's a standard sysadmin procedure.

Key managements involves policies such as: key rotation, algorithms to use, access restriction control, etc. It is way more daunting and complex. I don't see how ansible what ansible has to do with this, vaultproject on the other hand has most of the these features (and more) build-in. Never used it, but I know about it through a podcast presentation of vault in "Arrested Devops" IIRC.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by throwaway18917 on Friday May 12, 2017 @08:29AM (#14323369)

Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally).

I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.

[ Parent | on HN ]