Access for Infrastructure: SSH

• bastion

  5 35 10.0 Go

  Trove's SSH Bastion (by notion)

  

  I wrote a system that did this >5 years ago (luckily was able to open source it before the startup went under[0]). The bastion would record ssh sessions in asciicast v2 format and store those for later playback directly from a control panel. The main issue that still isn't solved by a solution like this is user management on the remote (ssh server) side. In a more recent implementation, integration with LDAP made the most sense and allows for separation of user and login credentials. A single integrated solution is likely the holy grail in this space.

  [0] https://github.com/notion/bastion

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• openpubkey

  7 657 8.3 Go

  Reference implementation of OpenPubkey

  

  Underlying tech is “Openpubkey”.

  https://github.com/openpubkey/openpubkey

  BastionZero just builds on top of that to provide a “seamless” UX for ssh sessions and some auditing/fedramp certification.

  Personally, not a fan of relying on CF. Need less centralization/consolidation into a few companies. It’s bad enough with MS dominating the OS (consumer) space. AWS dominating cloud computing. And CF filling the gaps between the stack.

• bottlerocket

  42 8,812 9.8 Rust

  An operating system designed for hosting containers

  

  There's not one answer to your question, but here's mine: kubelet and AWS SSM (which, to the best of my knowledge will work on non-AWS infra it just needs to be provided creds). Bottlerocket <https://github.com/bottlerocket-os/bottlerocket#setup> comes batteries included with both of those things, and is cheaply provisioned with (ahem) TOML user-data <https://github.com/bottlerocket-os/bottlerocket#description-...>

  In that specific case, one can also have "systemd for normal people" via its support for static Pod definitions, so one can run containerized toys on boot even without being a formal member of a kubernetes cluster

• gimlet

  1 0 - Go

  Use SSM to pass traffic through VPCs (by Cyberax)

  Be careful with SSM, it can provide pretty much unlimited access: https://github.com/Cyberax/gimlet

  You can use it to tunnel arbitrary traffic inside your VPC.

• Gravitational Teleport

  65 17,687 10.0 Go

  The easiest, and most secure way to access and protect all of your infrastructure.

  

  To save others the search: https://github.com/gravitational/teleport/pull/35259 Apache to AGPLv3

• ssh-principal-and-ca-playground

  2 16 0.0 Shell

  Dockerized setup of SSH with a Certificate Authority and Principals configured

  Using CAs and signed certificates in SSH is definitely the way.

  If anyone wants to play around with that, without the risk of locking themselves out of a server, I built a little "playground" awhile back whihc is a series of Docker containers that can SSH to each other. Give it a try at https://github.com/dmuth/ssh-principal-and-ca-playground

  (I haven't touched the project in awhile, so if there are any issues, please open an Issue and I'll gladly look at it!)

Suggest a related project