<story><title>Ask HN: How do you manage SSH keys and SSL certificates in your company?</title><text>Do you use - Universal SSH Key Manager, ManageEngine Key Manager Plus, Cyberark Solution, or any other tool? Tips please.</text></story><parent_chain><item><author>jen20</author><text>A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use.&lt;p&gt;This model is described in an excellent post by Facebook from a while back [1].&lt;p&gt;(Disclaimer: I used to work at HashiCorp, and put this model into production there, though the Vault support for issuing short-lived certificates was added after I left)&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;code.facebook.com&amp;#x2F;posts&amp;#x2F;365787980419535&amp;#x2F;scalable-and-secure-access-with-ssh&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;code.facebook.com&amp;#x2F;posts&amp;#x2F;365787980419535&amp;#x2F;scalable-and...&lt;/a&gt;</text></item><item><author>serkanh</author><text>So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys  add it to ~&amp;#x2F;.ssh&amp;#x2F;authorized_keys of each machine? i am familiar with vault locking&amp;#x2F;unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.</text></item><item><author>mheiber</author><text>It baffles me that nobody seems to have mentioned Hashicorp&amp;#x27;s Vault yet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.vaultproject.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.vaultproject.org&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&lt;/a&gt;&lt;p&gt;It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backends to delegate granular access for all of these features.&lt;p&gt;It&amp;#x27;s been an absolutely eye-opener for somebody like me who&amp;#x27;s used to managing SSH keys&amp;#x2F;PKIs (what a pain) and I wouldn&amp;#x27;t want to use anything else right now.</text></item></parent_chain><comment><author>fragmede</author><text>Using an SSH Certificate Authority is also my recommendation, but be aware that it&amp;#x27;s relatively new, so associated tooling with it is not super mature yet. In particular, the user still needs some bits in order to login, and whether they generate it themselves and send it off to get signed, or the bits are generated for them on the backend and the user simply needs to receive them, there&amp;#x27;s a management aspect to it that isn&amp;#x27;t a totally solved problem with open source tools.&lt;p&gt;It&amp;#x27;s not a difficult problem, mind you, but there was custom code written that runs on developer laptops (OS X and Ubuntu) to support this workflow.&lt;p&gt;(Despite being a very similar looking string of bytes as more traditional pub&amp;#x2F;private keys, it&amp;#x27;s different in the SSH-Agent protocol, so don&amp;#x27;t assume all ssh-agent-looking daemons support it.)</text></comment>
<story><title>Ask HN: How do you manage SSH keys and SSL certificates in your company?</title><text>Do you use - Universal SSH Key Manager, ManageEngine Key Manager Plus, Cyberark Solution, or any other tool? Tips please.</text></story><parent_chain><item><author>jen20</author><text>A good solution to this problem is to use an SSH Certificate Authority - then you need only configure the CA certificate on each box, and you can either issue semi-long-lived certificates to each user who needs access, or use something like Vault to issue short-lived certificates intended for one-time use.&lt;p&gt;This model is described in an excellent post by Facebook from a while back [1].&lt;p&gt;(Disclaimer: I used to work at HashiCorp, and put this model into production there, though the Vault support for issuing short-lived certificates was added after I left)&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;code.facebook.com&amp;#x2F;posts&amp;#x2F;365787980419535&amp;#x2F;scalable-and-secure-access-with-ssh&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;code.facebook.com&amp;#x2F;posts&amp;#x2F;365787980419535&amp;#x2F;scalable-and...&lt;/a&gt;</text></item><item><author>serkanh</author><text>So let say you have bunch of servers that your team has to access via ssh, how would vault help adding users public keys  add it to ~&amp;#x2F;.ssh&amp;#x2F;authorized_keys of each machine? i am familiar with vault locking&amp;#x2F;unlocking secrets but not sure if Vault can help centralizing and deploying those keys to individual machines.</text></item><item><author>mheiber</author><text>It baffles me that nobody seems to have mentioned Hashicorp&amp;#x27;s Vault yet:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.vaultproject.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.vaultproject.org&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&lt;/a&gt;&lt;p&gt;It comes with both, a full blown PKI (want a new cert? Use an authenticated REST endpoint!) and SSH backend. On top of that you can use it to manage accounts for many other third party applications as well (e.g. PostgreSQL, MySQL) while leveraging a multitude of authentication backends to delegate granular access for all of these features.&lt;p&gt;It&amp;#x27;s been an absolutely eye-opener for somebody like me who&amp;#x27;s used to managing SSH keys&amp;#x2F;PKIs (what a pain) and I wouldn&amp;#x27;t want to use anything else right now.</text></item></parent_chain><comment><author>mi100hael</author><text>One other handy feature that we&amp;#x27;re using is the ability for Vault to set user IDs in the signed key ID field which then get logged by sshd on the remote host.  That way we can still audit who exactly logged in if using a single user on the remote host.</text></comment>