News for hackers. Stuff that matters.

A comment on Hologram: taking EC2 Instance Roles everywhere.

Re:Hologram: taking EC2 Instance Roles everywhere by alimoeeny on Wednesday December 24, 2014 @08:44AM (#8792804)
Great news, and very good work, thanks for sharing. One thing that I am concerned about (or have questions about), is how would you make sure you are not exposing the service to outside, so that when the laptop is on a coffee shop network others can query the credentials? I mean, it often happens that a developer needs to expose a webserver they are running to outside to showcase something or demo or .... It is not very hard to make a mistake and expose everything right?
[ Parent | on HN ]
Re:Hologram: taking EC2 Instance Roles everywhere by frugalfirbolg on Wednesday December 24, 2014 @09:37AM (#8792958)
Hmm, judging from the source code the default listenAddress is on '0.0.0.0:3100' so it's listening on every interface, but it's instantiated to use TLS and in server.go HandleServerRequest does SSH authentication.

This service is separate from whatever the developer is working on that needs to call to it. If the work in progress exposes temporary credentials it's not the end of the world.

[ Parent | on HN ]
Re:Hologram: taking EC2 Instance Roles everywhere by epall on Wednesday December 24, 2014 @11:41AM (#8793417)
The hologram server is privileged and should run behind a firewall. It will only hand out keys to successfully authenticated (using an SSH challenge-response) clients, so it could be publicly accessible, but why go to that risk?

The hologram agent that runs on your laptop, and could potentially be exposed in a cafe, attaches to lo0, so there's no way somebody on your coffee shop wifi could get the creds.

[ Parent | on HN ]
Re:Hologram: taking EC2 Instance Roles everywhere by earless1 on Wednesday December 24, 2014 @09:58AM (#8793025)
On the Ec2 side security groups can be used to only allow access for the company IP. Then VPN can be used to secure connections from coffee houses back the the office.
[ Parent | on HN ]
Re:Hologram: taking EC2 Instance Roles everywhere by silversupreme on Wednesday December 24, 2014 @03:18PM (#8794393)
That's what we do at AdRoll, and it seems to work pretty well for us. :)
[ Parent | on HN ]