News for hackers. Stuff that matters.

A comment on AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely. Parent comment

Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by tptacek on Wednesday April 04, 2018 @03:45PM (#16758275)
It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by JoachimSchipper on Wednesday April 04, 2018 @04:12PM (#16758551)
What are you assuming about exposure? If a SSH key lives on a well-secured workstation or bastion host (and you ideally don't agent-forward it to insecure hosts), rotating that key once per hour doesn't seem a top priority to me? E.g. a sudo password is (lower-impact, but) more likely to get exposed to compromised hosts?

("Well-secured workstation" is arguably an oxymoron, of course...)

[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by cassianoleal on Wednesday April 04, 2018 @07:41PM (#16760397)
Wait, you keep private SSH keys on bastion hosts?

It's much better practice to use the bastion as a proxy to the other hosts. This is easily achieved using the ProxyCommand option of OpenSSH.

No agent forwarding, no secrets kept in random hosts.

[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by JoachimSchipper on Thursday April 05, 2018 @01:15AM (#16761985)
No, keeping SSH keys on bastion hosts was the silliest reasonable thing I could think of.
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by scrollaway on Wednesday April 04, 2018 @09:23PM (#16760963)
Do you know a good guide with standard practices for setting up and securing bastion hosts (preferably on aws)?
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by toomuchtodo on Wednesday April 04, 2018 @11:54PM (#16761626)
If you don’t require interactive sessions, consider using AWS SSM run command [1] instead. You install the agent on the instances, with commands sent from the client through the AWS control plane (with IAM and SSM documents for access control and CloudTrail logs of all commands issued).

I’m currently deploying it in an enterprise for ~5k users, and it works surprisingly well for providing the ability to run arbitrary commands on instances without ssh access.

[1] https://docs.aws.amazon.com/systems-manager/latest/userguide...

[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by jessaustin on Thursday April 05, 2018 @08:47AM (#16764347)
...a one-hour SSH login cred is a significant exposure.

Does this refer to an SSH password or e.g. a 4096-bit RSA key, or possibly something completely different? If this refers to an RSA key then I'm quite confused.

[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by apawloski on Wednesday April 04, 2018 @03:50PM (#16758342)
How are you managing your SSH keys to make <1HR rotation feasible?
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by tptacek on Wednesday April 04, 2018 @03:52PM (#16758361)
With an SSH CA.
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by kasey_junk on Wednesday April 04, 2018 @06:20PM (#16759813)
Is there one of those you’d recommend?
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by skywhopper on Wednesday April 04, 2018 @09:16PM (#16760921)
Check out Hashicorp Vault (https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...) for a general product (has lots of the features of AWS Secrets Manager as well), or Netflix BLESS (https://github.com/Netflix/bless) for a very specific tool for just this.
[ Parent | on HN ]
Re:AWS Secrets Manager – Store, Distribute, and Rotate Crede... by euroclydon on Thursday April 05, 2018 @06:56AM (#16763621)
I found these:

https://www.digitalocean.com/community/tutorials/how-to-crea...

https://medium.com/uber-security-privacy/introducing-the-ube...

[ Parent | on HN ]