Lead Image © Andriy Popov, 123RF.com

Lead Image © Andriy Popov, 123RF.com

A central access manager for SSH, Kubernetes, and others


Article from ADMIN 70/2022
Teleport centrally manages logins against various protocols, including SSH, Kubernetes, and databases. Functions such as two-factor authentication are included in the scope of delivery, as is management of your own certificates.

A decade and a half ago, when security and compliance were not as dominant in some places as they are today, the number of accounts and passwords was something like manageable and many an admin got rid of local accounts altogether in favor of root on their SSH-only machines. Instead, a password for root worked everywhere in the setup and – with a little luck – was encrypted for storage in a central password store somewhere.

Today, however, this practice is completely unthinkable. Various security standards (e.g., Payment Card Industry Data Security Standard, PCI DSS) now stipulate that it must be possible to trace who changed what on which systems and when, which makes individual accounts mandatory. Today, even the toughest deniers of the need for compliance tend to avoid root logins over secure shell (SSH) with just password protection. Most distributions even prohibit this practice in the default configuration. Sudo and SSH keys for individual access are the means of choice instead.

This practice only makes sense, especially in setups where admins are really only entrusted with the operation and maintenance of machines that can be accessed by SSH. However, this is decreasingly the case today. DevOps, the cloud, and containers have made information technology (IT) far more heterogeneous. Kubernetes APIs and databases need credentials, along with various other services, and all of them use their own protocols for authentication.

Even SSH is not quite as clear-cut as it seems at first: In the interest of security, it is quite common today not to run systems with a direct connection to the Internet if they do not need the access. SUSE Manager, Red Hat Satellite, and the like have long since found a solution to the problem of delivering updates and other essential features to systems without a direct Internet connection.

In return, however, such systems can no longer be accessed directly over SSH. Instead, a jump host or cluster

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy ADMIN Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

comments powered by Disqus