On 7/15/06, Jeffrey Tadlock <linux(a)elfshadow.net> wrote:
I think this is a great idea. I think we all know passwords are the
bane of securing any system. Using keys only would certainly be a move
to the right direction.
In our case though I think there is another problem area where a
password is still a weakness. The Account System is a component in how
our ssh keys get distributed currently. So if someone were to
compromise a sysadmin's password for the web based Account System they
would then be able to edit that individual's profile and change the ssh
key for that user which would be distributed across the systems they
have shell access to. Now the intruder can access the systems with the
ssh key pair they own (at least until the original user noticed they
couldn't login anymore).
At least I think that would be an attack vector that could target a
password. Perhaps I am unaware of a component of the Account System or
I am missing something else that would cause the above scenario to not
work, so feel free to point out the obvious!
If the above scenario is an accurate one though, we still are relying on
passwords to secure access to the systems to some extent. It may be an
area we want to look at to force some sort of check or balance to
minimize even that possibility.
While on the topic of security and moving beyond passwords, perhaps the
group as a whole should brainstorm, check settings, etc on the system
and processes from the security perspective. There are lots of
intelligent individuals on the team and some time spent towards a
security audit of sorts could prove useful just to make sure we are
truly following best practices (or going above and beyond) and aren't
assuming certain things about the system configurations that really
aren't in place.
We'll have to find the balance. We could go key kerberos crazy if we
wanted to. On the one hand we should have a very secure system. On
the other hand we cannot burden the developers. After all thats the
whole reason our team exists... to aid the developers.
It should also be said that I've never actually worked at a place that
would end up on Slashdot if we got hacked.... I guess there's a bit
of pride in me that wants to make sure that if the Fedora
infrastructure ever does get hacked that it doesn't happen on my watch