0

We have big legacy code working for big corporation connecting to multiple remote/local databases.

The configuration files with IP, name and password for connecting to different databases are now handled manually. We have these files in git, but our passwords rotate on different schedule than our deployment, so we need to directly edit the configs on our servers(production, UAT, testing, development).

This is really tedious task and errors appear regularly. Different servers are connected to different databases and connecting multiple times with bad password will lock the id.

We are thinking about creating a service to distribute the config files into the servers. The idea is, that every midnight, some bash script on the server will access this service, and rewrite config files with data provided by this service.

Than, we only need to store name of server(to tell the service, which config we need) and SSH key to connect to service.

The question is, is this good solution? I see the problem that when one ssh key gets compromised, than all our passwords are available. Is there some other more standard way to solve our problem?

1

You can use some Deployment management tool like Ansible ( my personal favourite, needs only python2, and public SSH keys added on server nodes ), Chef, Salt, and Puppet.

The question is, is this good solution? I see the problem that when one ssh key gets compromised, than all our passwords are available. Is there some other more standard way to solve our problem?

You can use different SSH keys for different servers/services and have this distribution service on small device ( like Raspberry Pi ), that doesn't have any open ports ( no SSH, only local management! ).

And in "strong security scenario" protect those SSH keys with password which will be provided by an admin ( each day ) and stored in encrypted memory ( and protected by IOMMU ).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.