Re:Access for Infrastructure: SSH
by viraptor on Wednesday October 23, 2024 @11:17PM
(#41931569)
Passive metrics/logs won't let you debug all the issues. At some point you either need a system for automatic memory dumps and submitting bpf scripts to live nodes... or you need SSH access to do that.
[ Parent
| on HN ]
Re:Access for Infrastructure: SSH
by otabdeveloper4 on Thursday October 24, 2024 @02:31AM
(#41932550)
This "system for automatic dumps" 100 percent uses ssh under the hood. Probably with some eternal sudo administrator key.
Personal ssh access is always better (from a security standpoint) than bot tokens and keys.
There's a thousand ways to do it without SSH. It can be built into the app itself. It can be a special authenticated route to a suid script. It can be built into the current orchestration system. It can be pull-based using the a queue for system monitoring commands. It can be part of the existing monitoring agent. It can be run through AWS SSM. There's really no reason it has to be SSH.
And even got SSH you can have special keys with access authorised to only specific commands, so a service account would be better than personal in that case.