ssh-over-ssm
Infrastructure
remote access
SHOW HN2020
131points
36comments
#472of 3,028 in 2020
Top 16%of 2020 by points
How HN took it
MixedNo clear lean
10 positive, 14 neutral or asking, 2 mixed, 3 critical, out of 29 comments about the project. Thread score +0.33.
Execution: 4 for, 0 againstIdea: 2 for, 1 againstDesign: 2 for, 0 againstPrivacy: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Removes need for bastion hosts and inbound SSH
From 3 comments
We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an…
jbergknoff on HNVery funny, we received a ticket from a security audit a week ago asking us to get rid of our bastion and use SSM instead. Having never heard of SSM, being in a rush to a…
williamdclt on HNSession manager doesn't require inbound access iirc. An agent on the machine handles the request via a connection to the SSM service. Your request for a session goes to the SSM…
nostrebored on HN
Ties access to IAM permissions without managing access keys
From 2 comments
It's hard to overstate how much of a difference this makes for managing people's access to servers without having to manage access keys. Especially if someone leaves the…
sakisv on HNSSM doesn't require you to manage keys or have a bastion/vpn/public access. It'll also log access attempts, in some cases log commands, and ties into IAM permissions (ie: these…
marcinzm on HN
Easy to set up and use
From 2 comments
Very funny, we received a ticket from a security audit a week ago asking us to get rid of our bastion and use SSM instead. Having never heard of SSM, being in a rush to a…
williamdclt on HNI've been rolling SSM out at work; 10/10 would do again.
BrandonBradley on HN
Objections
Session logging is weak; SSH over SSM does not log commands
From 2 comments
Solving the SSH over SSM is sadly useless right now. The whole point of why we began using SSM was logging. 1) We soon discovered that using bash (and not sh that SSM signs you…
klohto on HN>There is a way to tie IAM user to SSM. You have to request SSM permissions and AWS logs that. AWS logs pretty much every single API call so it's just matter of storing and…
marcinzm on HN
Generic ssm-user makes per-person auditing hard
From 2 comments
You can specify the behavior. There is no unique user for each login, by default you are dropped to generic ssm-user. It's possible to set up a log-in into specific user based on…
klohto on HN> If you're using a generic ssm-user (and going to ssh so there's no ssm logs of the commands) then wouldn't you not be able to distinguish the commands (say in auditd) of two…
klohto on HN
Cannot do port forwarding to RDS through a bastion replacement
From 1 comment
We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an…
jbergknoff on HN
Requests
Support for aliasing instance IDs to hostnames
From 1 comment
We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an…
jbergknoff on HN
Built-in user and key management
From 1 comment
We've been using SSH over SSM at work, and it's been great for tying access to IAM credentials. Using the SSM tool as a ProxyCommand for OpenSSH is brilliant. I can SSH to an…
jbergknoff on HN
Questions
How does this compare to AWS Secrets Manager
From 1 comment
Can anyone give any experience using this method vs. AWS Secrets Manager?
billman on HN
How is this different from EC2 Instance Connect
From 2 comments
You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native…
vegardx on HNSeem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: ``` gcloud compute ssh <instance_name> ``` GCP takes care of generating a key pair. The…
leg100 on HN
Alternatives named
GCP OS Login
From 1 comment
Seem likes an awfully laboured equivalent of GCP's OSLogin [1]. To SSH into an instance: ``` gcloud compute ssh <instance_name> ``` GCP takes care of generating a key pair. The…
leg100 on HN
EC2 Instance Connect
From 2 comments
You can also use ec2-instance-connect[0] to enable users to generate ephemeral keys that are valid for a few minutes, authenticated with IAM. The benefit is that it's all native…
vegardx on HNEC2 Connect is OSLogin-esque: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html
ignoramous on HN
SSH certificates with step-ca or Vault
From 2 comments
Hasn't this been solved by using SSH certificates instead of keys?
tilolebo on HNIt has to use an existing system account, yes. You do lose a lot of auditing abilities this way, since you cannot capture the content. For me this is more about establishing a…
vegardx on HN
Okta Advanced Server Access
From 1 comment
(disclaimer, I was a founder of ScaleFT - acquired by Okta) This is exactly why many customers use Okta's Advanced Server Access:…
pquerna on HN
Teleport
From 1 comment
It has to use an existing system account, yes. You do lose a lot of auditing abilities this way, since you cannot capture the content. For me this is more about establishing a…
vegardx on HN