glassechidna / lastkeypair Goto Github PK
View Code? Open in Web Editor NEWA serverless SSH certificate authority to control access to machines using IAM and Lambda
License: Apache License 2.0
A serverless SSH certificate authority to control access to machines using IAM and Lambda
License: Apache License 2.0
j and k work, but the user is unlikely to know this.
Maybe switch to https://github.com/AlecAivazis/survey
kms:Encrypt
kms:DescribeKey
lambda:InvokeFunction
e.g. why we validate kms key ID is what we expect
Avoiding cross-region dependencies is generally preferable - LKP should support a use-case with the Lambda deployed to multiple regions.
Considerations:
Admins will probably want to disable SSH shell login on SSH jumphosts, so a cert without user-pty would be nice. But right now one cert is shared for both the target instance and the intermediate jumphosts. Fix that
lkp
token
create # creates a token that can be authenticated by kms
validate # validates aforementioned token
ssh
sign # uses CA key to sign user or host key
exec # ask lambda func to sign ssh pubkey
proxy # to be used as ssh_config ProxyCommand. maybe allows user@i-<instance>?
setup # creates kms key+policy, ssh CA key, uploads lambda zip, everything
--dry-run # just emits cfn files, zip, ssh key, etc
--do-it # actually performs all the actions
ec2
sign # sends host key to lambda, replaces instance key with signed version
trustca # adds 'cert-authority' flag to ~/.ssh/authorized_keys entry
vouch # create token to send out-of-bound to person who needs 2-operator login
--recipient
--duration
--host
lambda # fulfils the lambda func, is passed fn args in stdin by thin wrapper
While the custom authoriser is able to accept/reject a connection to (e.g.) a prod box based on its EC2 tags, it would be nice for this to be logged in CloudTrail. So we should support passing in arbitrary key=val pairs which
We can deduce the account ID from GetCallerIdentity and the region from the user's config. If region not set, let the user know how to fix it.
Include CLI, Lambda version numbers in req/resp
Probably not the domain of this project, but could build upon this. A Lambda that does something like:
https://github.com/sourcelair/xterm.js
https://github.com/stuicey/SSHy
Don't make the user type in the IP address when we can figure it out based on the instance ARN. Considerations:
ProxyCommand
(or jump host or whatevs) to use or the user can provide their own in their ~/.lkp/config.yml
file. Advantage of the Lambda doing it is that the administrator could specify different jump hosts for different instance regions, accounts, etc.LkpUserCertAuthorizationRequest.Principals
property should be removed.LkpUserCertAuthorizationResponse.Principals
is absent, LKP should populate with RemoteInstanceArn
Specifically this one: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Puwaders.C!ml&ThreatID=242877
Might have to stop using UPX for the Windows binary
When using jumpboxes the authoriser should have a way to return different CertificateOptions for each connection in the chain. E.g. the JumpBox will require permit-port-forwarding to work, but maybe it isn't needed for the final connection
The duplication here could/will lead to bugs. Maybe we could serialise to JSON and use that to avoid missing fields that get added in the future.
Lambda got this, but user not told of any error:
Decryption error: AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
This should add the ssh CA to the user's known_hosts
Subcommand would allow user to interactively do MFA authentication before doing an ssh [email protected]
command.
Look into whether ProxyCommand
, ssh-agent
or something can let us transparently do ssh user@ip
or even ssh user@instance-id
instead of the current lkp ssh exec --
dance
Right now it's just "user"
(and soon to add "host"
) but we also want to add some kind of "namespace" (e.g. AWS account id) to the encryption context
Windows powershell remoting allows authentication using SSL client certificates. We could add support for this
Should include the authoriser lambda function, but more importantly example IAM policies needed to ensure that users can't escalate their own access. See:
Needed for SSH bastions, maybe for other things too?
Rather than silently swallowing {"stackTrace": [["runtime/proxy.py", 44, "_handle", null]], "errorType": "fundamental", "errorMessage": "authorisation denied by auth lambda"}
Maybe something like JS in (a file on S3|parameter store|an environment variable).
JS would have access to (at least) info about the user and maybe info about the target instance. Could fetch target instance's tags (preferably on-demand)
E.g. We know that KMS keys should begin with aws:arn:kms:<region>:<accountid>
where regions alway follow a certain format and account IDs are always numeric. Return a nice error message rather than:
2018/09/11 10:35:48 Encryption error: RequestError: send request failed
caused by: Post https://kms.us-east-1a.amazonaws.com/: dial tcp: lookup kms.us-east-1a.amazonaws.com on 10.224.50.10:53: no such host
Which is caused by an accidental us-east-1a
as the region.
When instances do an lkp host
setup, it could install both the "active" CA pubkey and an "inactive" one (or more) ready for rotation when the time comes.
Maybe we want to use a different keypair per account, or per region, or per whatever. Maybe authoriser lambda could instruct the LKP lambda which keypair CA to use. Related-ish to #29
Right now the code assumes that the jumpboxes have host certs with principals that match the addresses returned by the authoriser lambda
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.