ssh – Page 2 – Türker Yıldırım

A self-hosted runner, and what it is allowed to reach

Deep diveMay 26, 202010 min read

The hosted runner cannot reach the private network, which is the whole problem — and a runner inside it is a machine running other people’s code.

SSH certificates expire on their own, which is the point

NoteOctober 16, 20191 min read

Managing authorized_keys across thirty servers means a configuration run to add a colleague and another to remove one, and the removal is the one that gets forgotten. Access…

Deploy on push, on a platform you do not control

Deep diveAugust 16, 201910 min read

The same deployment problem, a second time, on a different platform. A push notification is not authentication, and HTTP has a timeout.

SSH certificate authentication instead of a keys file per host

NoteMay 30, 20181 min read

Managing authorized_keys across thirty servers means a configuration management run to add a colleague and another to remove one, and the removal is the one that gets forgotten.…

Wildcard certificates, and the DNS challenge

Deep diveMarch 28, 20189 min read

ACME v2 landed in March and wildcards need a different proof. The certificate is the easy part; the API token that can rewrite your zone is not.

Disabling password auth is the single highest-value line in sshd_config

NoteFebruary 15, 20182 min read

A server on a public IP receives thousands of password attempts a day, and fail2ban reduces the rate rather than the risk. Turning the mechanism off removes it.…

rsync over one persistent SSH connection

NoteJune 2, 20162 min read

A deploy that runs rsync three times and then a handful of remote commands opens a new SSH connection each time, and each one pays the full handshake…

The CI box gets its own deploy key, and it is read-only

NoteMay 31, 20161 min read

Giving CI a copy of a developer’s key, or an account with write access, means a compromised build server can push to the repository — and a build…

Hardening a public-facing server before it gets found

Deep diveApril 29, 20159 min read

A week-old server already sees thousands of login attempts a day. Key-only SSH, a firewall, fail2ban and monit — and the recovery plan for locking yourself out.

Sync a directory to a remote server over SSH

SnippetApril 14, 20151 min read