Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by closeparen on Tuesday March 30, 2021 @03:20PM
(#26639104)
He could have had 2fa on his console account but saved an access key for CLI access. Many large organizations have an infrastructure where you exchange your corporate authentication (including 2FA) for a short lived AWS access key, but AFAIK this isn’t out of the box.
[ Parent
| on HN ]
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by TheGuyWhoCodes on Tuesday March 30, 2021 @04:56PM
(#26640368)
You can force 2fa even for cli access as far as I remember but It's not on by default.
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by closeparen on Tuesday March 30, 2021 @07:56PM
(#26642012)
This seems incredibly clunky and most people are probably not doing something that involves typing the ARN of their MFA device on a day to day basis. To be tenable on a daily basis you need something like “aws login” with username, password, and code that sets up your credentials file correctly. Expect people to copy and paste values around, and you’ve already lost.
Not to mention legacy code that only knows about access key ID and secret, and doesn’t have a place to even put a token.
https://aws.amazon.com/premiumsupport/knowledge-center/authe...
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by Bellyache5 on Tuesday March 30, 2021 @04:17PM
(#26639850)
AWS SSO does offer this "out of the box", but many large organizations use their own custom SSO setup with custom-built tools to get temporary tokens.