#security - August 2018 | Slack Archive

security

46 messages

Archive: https://archive.sweetops.com/security/

Jul 2018

August 2018

Sep 2018

pmullerover 8 years ago

@pmuller has joined the channel

Jamie Nelson (BitFlight)over 8 years ago

@Jamie Nelson (BitFlight) has joined the channel

tamskyover 8 years ago

@tamsky has joined the channel

Jeremy Gover 8 years ago

@Jeremy G has joined the channel

Erik Osterman (Cloud Posse)over 8 years ago

https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/

erikover 8 years ago

Jamie Nelson (BitFlight)over 8 years ago

This is something that is huge, and is hard to understand

Jamie Nelson (BitFlight)over 8 years ago

It is as specific and specialist as anything we do

Jamie Nelson (BitFlight)over 8 years ago

So I hope this channel helps us pull together the resources that help keep us all on tract for secure environments

Erik Osterman (Cloud Posse)over 8 years ago

Yea, it’s a never ending endeavor

Jamie Nelson (BitFlight)over 8 years ago

100

Erik Osterman (Cloud Posse)over 8 years ago

https://gsuiteupdates.googleblog.com/2018/08/control-government-backed-attack-alerts.html?m=1

Erik Osterman (Cloud Posse)over 8 years ago

Not a feature I was exactly asking for, but hey, why not!

Erik Osterman (Cloud Posse)over 8 years ago

That’s an alert that would freak me out.

tamskyover 8 years ago

if they already have a good signal detector, it's pretty nice that they share

pmullerover 8 years ago

ahahah, so you get an alert saying a government is attacking you (does it includes the us gov? ;)) - then what ? you go to the police ? 😛

Erik Osterman (Cloud Posse)over 8 years ago

Then you pack your bags and prepare for rendition

Erik Osterman (Cloud Posse)over 8 years ago

https://latacora.singles/2018/08/03/the-default-openssh.html

tamskyover 8 years ago

https://apple.stackexchange.com/questions/48502/how-can-i-permanently-add-my-ssh-private-key-to-keychain-so-it-is-automatically
- this OSX feature lets users pick a high entropy passphrase and have ssh-add -K store the phrases in Keychain.
- this also means we can't easily type the passphrase (when requested) when geodesic shell starts

tamskyover 8 years ago

all this makes me think that my ssh-agent should live on a secure device that prompts me on each use

Erik Osterman (Cloud Posse)over 8 years ago

yea, would be neat if the yubikeys could act as an SSH agent

Erik Osterman (Cloud Posse)over 8 years ago(edited)

Also, if adding UseKeychain yes, recommend also adding IgnoreUnknown UseKeychain because the UseKeychain extension is not supported by alpine linux.

Erik Osterman (Cloud Posse)over 8 years ago

just found this: https://github.com/cyberark/summon-aws-secrets

Erik Osterman (Cloud Posse)over 8 years ago

it's like chamber but for aws secrets manager.

Erik Osterman (Cloud Posse)over 8 years ago

So, I had kind of written off secrets manager because of the ease of use of chamber.

Erik Osterman (Cloud Posse)over 8 years ago

but the automatic key rotation feature using lambdas seems pretty sweet from a compliance POV

tamskyover 8 years ago

yea, would be neat if the yubikeys could act as an SSH agent

they can act as an SSH agent by acting as a GPG agent:

https://github.com/drduh/YubiKey-Guide

this too reads as very far from "turnkey"
&& has the same "how can I plumb my agent into docker" problems as the current ssh-agent

jyleeover 8 years ago

@jylee has joined the channel

Danover 8 years ago

@Dan has joined the channel

Dylanabout 8 years ago

@Dylan has joined the channel

tarrallabout 8 years ago

@tarrall has joined the channel

M Hunterabout 8 years ago

@M Hunter has joined the channel

Erik Osterman (Cloud Posse)about 8 years ago

@adamstrawson says:

That did the trick, thanks. Next question i'm afraid, I'm struggling to see how you get the github-authorized-keys container and the bastion container to work together. They're both running and working independently, but the bastion container doesn't seem to want to do anything with the keys (eg. if I ssh to -p 1234, I get permission denied.) github-authorized-keys has synced the users and keys to the host machine (I can ssh fine to the host machine with a synced user), but via the bastion container it doesn't detect any keys. Can't see in the docs how the two work together

adamstrawsonabout 8 years ago

@adamstrawson has joined the channel

Erik Osterman (Cloud Posse)about 8 years ago(edited)

so in the bastion container, are you bind-mounting /etc/passwd from the host machine?

Erik Osterman (Cloud Posse)about 8 years ago

the other thing to check is that the github-authorized-keys command in the bastion container can talk to the host API

Erik Osterman (Cloud Posse)about 8 years ago

https://github.com/cloudposse/bastion/blob/master/rootfs/usr/bin/github-authorized-keys#L20

Erik Osterman (Cloud Posse)about 8 years ago

you might need to change API_URL

Erik Osterman (Cloud Posse)about 8 years ago

since localhost in the container is not equal to localhost of the node

Erik Osterman (Cloud Posse)about 8 years ago(edited)

(when we deployed this, we deployed the github-authorized-keys container and bastion container in the same Pod in kubernetes - which allows them to talk over localhost)