ScaleFT, a company selling BeyondCorp-style access to servers, writes about SSH certificates, zero-trust access and authentication.
HN commenters recommend ScaleFT as a turnkey option for BeyondCorp-style infrastructure access, with one praising its PCI DSS compliance page; a co-founder also comments.
SSH is like a candy store for advanced attackers.
Password auth discloses your password to the server. Clearly this is unfortunate if you connect to the wrong server, but it also means that a compromised server can intercept the passwords of anyone logging in.
The same extends to anyone using password auth with LDAP. In practice this means that if an organization uses LDAP with passwords for SSH authentication, the ability to execute arbitrary code on one server (combined with a routine privilege escalation) implies complete access to any infrastructure accessible with the same password. Most MFA schemes simply force the attacker to act quickly to utilize an intercepted token on a higher value target. Probably this means trying to find a copy of the private key that the devops team is using to run Ansible without having to MFA to every single server.
For small scale use private keys are a simple way to combat this, but at scale they're difficult to manage, and tend to result in high value static credentials lying around on laptops.
A lot of companies are combatting this using SSH certificates. Certificates can be short-lived (as low as minutes given the right tooling), and the CA that issues them can be heavily audited and linked to an existing identity system.
Netflix has open-sourced BLESS: https://github.com/Netflix/bless
Lyft has adapted BLESS for use without a bastion, start at slide 28:…
I'm from ScaleFT, thanks for the mention. True that our original focus was in SSH/RDP access, however we've recently introduced Web access as well.
https://www.scaleft.com/blog/how-to-deploy-a-beyondcorp-style-web-app-behind-the-scaleft-access-fabric/
I agree with many commenters that it appears transformative, but that's only through the lens of Google. Centralized access controls at Layer 7 through a proxy service that can authenticate and authorize requests, while brokering encrypted sessions isn't that out of reach. Our goal at ScaleFT is to offer as much as a service as we can.
Where things do get tricky, though, is with the access policies and device attestation in a BYOD environment. Admittedly, we have work to do in this regard, but it may not require a full MDM layer. Really, you only need to query device state at a given time to make an authZ decision.
Love to see BeyondCorp get more coverage, and I hope to see further adoption outside of Google.
(disclaimer, I'm a co-founder of ScaleFT)
If you are interested in a commercial solution in this space, check out ScaleFT. Besides the dynamic SSH certificates, we also track both SSH keys used and access events, which you can then pull via an API across all your machines. We also have a Slack notifier, though It needs a little love & cleanup.
We're currently in what I could best call a beta: https://www.scaleft.com/
Apologies for the confusion! I picked BeyondCorp as there seems to be a number of references to it as a more general-cloud term than anything Google Cloud specific.
As some examples, https://www.beyondcorp.com/ is run by the IdP Okta, and ScaleFT (a zero trust SaaS company) references the philosophy of BeyondCorp as being used outside of Google: https://www.scaleft.com/blog/beyondcorp-outside-of-google/
Hi, that looks good! I'll probably try it out soon.
One suggestion regarding PCI DSS: you should probably make a page/whitepaper that outlines the compliance story of Kryptonite. ScaleFT has a great one: https://www.scaleft.com/use-cases/pci-dss/. By the way, have you checked that you do not need to be compliant yourself?
This seems so completely obvious that it's surprising how common intranets and internal services locked only by network rules are.
Also highly recommend https://www.scaleft.com/ for anyone who wants beyondcorp-style access to infrastructure.