SSH Emergency Access

Re:SSH Emergency Access by markpeek on Saturday July 04, 2020 @02:47PM (#23734124)

Using certificates with SSH is the way to go for shared access servers. Here's an open source way (yes, I'm involved in the project) to manage authorization and access with asynchronous approvals:

https://github.com/cloudtools/ssh-cert-authority

[ Parent | on HN ]

Re:SSH Emergency Access by dcow on Saturday July 04, 2020 @03:37PM (#23734401)

Smallstep also offers an open source ssh-aware kms-backed certificate authority.

https://github.com/smallstep/certificates

One nice advantage is its support for different provisioning flows. The oauth flavor allows you to hook into an existing identity provider to authenticate certificate requests.

Simply:

    $ step ssh login

and boom you've got a short-lived ssh certificate in your ssh-agent using a private key that never touched the disk.

[ Parent | on HN ]