Today - people that know the UN/PWD of the controllers are capable of using that later to log in and cause significant outages maliciously. This is a severe security breach on our installations.
Suggested solution
Meneja generates a keypair everytime a new image is made for a new installation
Private key for this keypair is written into the env_xxxx repo that can only be accessed by the operations team (need to make sure that this is the case)
Once installation is finished a few things happen
the public key in the environment is removed on the controller (create HC that checks this and executes this so when install is not properly done we get alarm)
the private key is removed from the env_xxxx repo
a public key for a "recovery" is added so that we can still log into a node, even if 0-access would not work
the private key for the "recovery" key is only know by the CEO, COO and head of engineering and can only be access through a vault. We need to define that vault
Detailed description
Today - people that know the UN/PWD of the controllers are capable of using that later to log in and cause significant outages maliciously. This is a severe security breach on our installations.
Suggested solution
Meneja generates a keypair everytime a new image is made for a new installation
Private key for this keypair is written into the env_xxxx repo that can only be accessed by the operations team (need to make sure that this is the case)
Once installation is finished a few things happen
the private key for the "recovery" key is only know by the CEO, COO and head of engineering and can only be access through a vault. We need to define that vault