I started writing a long response to this, decrying security theatre in
the face of real issues, but thought better of it. Much shorter version
with free advice.
Leif Nixon wrote:
Stuart Barkley <stua...@4gh.net> writes:
- Kerberos with ssh works fine for interactive users, but doesn't seem
to translate well to a queuing environment. Or am I missing
something?
It's quite possible to use, but you do get a ticket expiry problem.
- Each user creates a password-less ssh private key, puts the public
key in the authorized_hosts file and has relatively unfettered ssh
access between nodes (nfs shared home directory helps a lot). This
seems to be the most common approach.
Yes, this is common. And a really, really BAD IDEA. Do not do this. Bad,
bad, BAD.
I consider it dangerous to encourage use of password-less ssh keys.
Yes, very much so. And your users will discover that they can copy that
passphrase-less private key to their personal workstation and get
password-less access to the cluster. (Yes, they will.) And then the key
will get stolen. (Yes, it will.) And then you get
http://www.us-cert.gov/current/archive/2008/09/08/archive.html#ssh_key_based_attacks
I won't fisk this, other than to note most of the exploits we have
cleaned up for our customers, have been windows based attack vectors.
Contrary to the implication here, the ssh-key attack vector, while a
risk, isn't nearly as dangerous as others, in active use, out there.
http://www.darknet.org.uk/2008/08/puttyhijack-v10-hijack-sshputty-connections-on-windows/
Real security is security in depth. Its understanding real risks, and
mitigating the same, or making the downside of the compromise as small
as possible. Leif had a suggestion further down about careful
management of keys, that is eminently reasonable. You don't leave your
house keys under the door mat, if you care about security that is. Same
principle applies here.
Fake security, aka security theatre (c.f.
http://en.wikipedia.org/wiki/Security_theater ) are things you get when
people want to seem like they are doing something, even if the thing
doesn't help, or worse, gives you a false sense of security. See every
anti-virus/anti-phishing package out there for windows. If you think
you are safe because you are running them, you are sadly mistaken.
I'd argue that security theatre is more dangerous than the real threats.
Threats can be mitigated. The danger is in using theatrics and
pronouncements rather than practical measures.
As John Hearns pointed out, hard on the outside soft on the inside.
Doesn't help with clouds, though you can do IPsec to IPsec bridging of
virtual private clusters (we do this for our customers).
Assume multiple attack vectors, and that the bad guys and gals are going
for your weak links. You need a realistic assessment of what your weak
links are, they will be exploited. Most IT managers are fearful of this
conversation, many are patently in denial about it. Regardless, the
successful attacks we have seen and cleaned up after all came from
*inside* organizations. Where they have been thwarted, has been due to
other good practices. Where they have been successful, they have had
success due to very very bad practices.
--
Joseph Landman, Ph.D
Founder and CEO
Scalable Informatics, Inc.
email: land...@scalableinformatics.com
web : http://scalableinformatics.com
http://scalableinformatics.com/jackrabbit
phone: +1 734 786 8423 x121
fax : +1 866 888 3112
cell : +1 734 612 4615
_______________________________________________
Beowulf mailing list, Beowulf@beowulf.org sponsored by Penguin Computing
To change your subscription (digest mode or unsubscribe) visit
http://www.beowulf.org/mailman/listinfo/beowulf
