search

hypothesis / product-backlog

Where new feature ideas and current bugs for the Hypothesis product live
118 stars 7 forks source link

Switch to individual SSH Keys #897

Closed dmfine closed 5 years ago

dmfine commented 5 years ago

This would probably be an Ansible play to create users on each server, add public keys, and sudoers config. Another approach would be LDAP + SSSD but I don't think the complexity is justified at this time. The problem we're trying to solve is key rotation and revocation. Switching to separate users lays the foundation for security auditing and more granular access controls.

robertknight commented 5 years ago

Hi David,

I think I can follow how this would work for our static infrastructure (support, mon, bastion servers etc.). How would this work with our dynamic infrastructure managed by Elastic Beanstalk though?

dmfine commented 5 years ago

Replacing this with 4 other issues and an epic on improving ssh auth