Servers and security
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
This topic is focused about all security concerns and solutions we may have related to our servers.
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
Raphaël Jadot Sun 3 Mar 2013 5:19PM
If one of the weakest point is the password, we may think about a password policy. However, it may have some issues, we don't always remember the complex passwords. So we may forget it and not being able to fix a problem, or write it somewhere, and it's a security hole.
![AB](/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMml3Q1E9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--b02a485825ffa041a5b0aa0b365713e88e619298/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaDdDRG9MWm05eWJXRjBTU0lJY0c1bkJqb0dSVlE2RkhKbGMybDZaVjkwYjE5c2FXMXBkRnNIYVFHQWFRR0FPZ3B6WVhabGNuc0hPZ3h4ZFdGc2FYUjVhVlU2Q25OMGNtbHdWQT09IiwiZXhwIjpudWxsLCJwdXIiOiJ2YXJpYXRpb24ifX0=--76fbfb4cf6c235059586b0c7c347dd0d77445cbe/brunocb-sherlock-holmes-tux.png%3F1362414023)
Anurag Bhandari Mon 4 Mar 2013 8:11AM
I like the ssh public key mechanism, and feel it should remain that way. The real question is choosing ease of access or high security. Of course, high security should win. So all infra guys should either copy their public keys to all machines they'd be using to access the servers or create a diff. one for each machine and install all their keys in sshd's config on server. I'd prefer the first method.
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
Raphaël Jadot Mon 4 Mar 2013 12:54PM
@anuragbhandari so I guess the best is to let people be free of adding or not they ssh key, if I understand you correctly. I agree with this vision.
I guess then we may add a security with a ssh password policy, wdyt?
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
Raphaël Jadot Mon 4 Mar 2013 3:34PM
So to be sure we agree or not, let's have a decision.
![J](/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMm13Q1E9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--320d93a220a0c633c5eafc1c01618059fd438fa7/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaDdDRG9MWm05eWJXRjBTU0lJY0c1bkJqb0dSVlE2RkhKbGMybDZaVjkwYjE5c2FXMXBkRnNIYVFHQWFRR0FPZ3B6WVhabGNuc0hPZ3h4ZFdGc2FYUjVhVlU2Q25OMGNtbHdWQT09IiwiZXhwIjpudWxsLCJwdXIiOiJ2YXJpYXRpb24ifX0=--76fbfb4cf6c235059586b0c7c347dd0d77445cbe/jcl6.png%3F1364557855)
jclvanier Mon 4 Mar 2013 4:36PM
We can have both :
-- ssh key for every day use
-- strong passwords for allowing access the servers from rarely used machines.
If someone forget his password, we can send him another one in a cyphered file. This supposes that every one has to create a couple of gpg keys.
![JC](/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMXl3Q1E9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--5d6333fcb49b892d1b53da7f14826b9cd3a82d06/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaDdDRG9MWm05eWJXRjBTU0lKYW5CbFp3WTZCa1ZVT2hSeVpYTnBlbVZmZEc5ZmJHbHRhWFJiQjJrQmdHa0JnRG9LYzJGMlpYSjdCem9NY1hWaGJHbDBlV2xWT2dwemRISnBjRlE9IiwiZXhwIjpudWxsLCJwdXIiOiJ2YXJpYXRpb24ifX0=--e579049eb7f20fc1070cc24f3215f2949d184302/skylar4.jpg%3F1362808252)
John Cave Tue 5 Mar 2013 5:57AM
We should enforce both, but should remember to use a different passphrase for the Key and for the normal login.
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
Raphaël Jadot Tue 5 Mar 2013 11:42AM
@johncave we can't unfortunately check the password of ssh key, or if there is any.
In fact, we must also thing that we have one other way to access the server threw the java console (or IPMI if it's up again)
My idea would be to secure the hosts and for ssh key to them, and don't force ssh key for CT.
WDYT?
![RJ](https://secure.gravatar.com/avatar/a25c23d1f61092a90ca9bfdafcdbf709.png?d=retro&r=pg&s=128)
Raphaël Jadot Tue 5 Mar 2013 11:46AM
@jclvanier technically we can, but we have to think about consequences.
If someone steal a key and have password to it, he has a free access to an account. Anyway, there is a better protection against password sniffing.
Then the failure point is again the password for sudo. So As the hosts are what needs to be protected over the VM, I suggest to force ssh key use for it.
![AB](/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBBMml3Q1E9PSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--b02a485825ffa041a5b0aa0b365713e88e619298/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaDdDRG9MWm05eWJXRjBTU0lJY0c1bkJqb0dSVlE2RkhKbGMybDZaVjkwYjE5c2FXMXBkRnNIYVFHQWFRR0FPZ3B6WVhabGNuc0hPZ3h4ZFdGc2FYUjVhVlU2Q25OMGNtbHdWQT09IiwiZXhwIjpudWxsLCJwdXIiOiJ2YXJpYXRpb24ifX0=--76fbfb4cf6c235059586b0c7c347dd0d77445cbe/brunocb-sherlock-holmes-tux.png%3F1362414023)
Anurag Bhandari Thu 7 Mar 2013 8:31PM
So we all finally agreed on forcing ssh access through keys?
Raphaël Jadot · Sun 3 Mar 2013 5:17PM
We'll have two physical machine that will host one or several VM. I don't see any reason that we use something else than a Linux distribution.
@jclvanier give us a link that summarize well the security concern we may have with SSH access.
The security should be a balance between:
* securing accesses;
* giving the ability to easily access when there is some emergency, and we don't have our usual computer with us;
* being able block/revert situations moving badly.
* keeping the infra simple, understandable and easy to manage.