Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Rotation is a really interesting subject which has true security benefits. Unfortunately manual rotation is a PITA. What works better is to have an automated system rotating the credentials, and then you fetch the credentials as-needed by authenticating with an identity and access management system.

For example, in Conjur there is a suite of rotators (https://developer.conjur.net/reference/services/rotation) for rotating things like SSH keys, database passwords, and cloud credentials. In each case, the rotator changes the credential in the backend (e.g. changes the public key in the authorized_keys file), and then stores the new credential behind an access-controlled and audited API where only you (and other authorized roles) can fetch it.

Disclosure: I am CTO of Conjur.



A bit off topic, but the conjur.net domain seems to be a bit broken. https://conjur.net doesn't work properly and it threw an SSL/TLS certificate error the first time I visited. Also, it appears as if your main site doesn't redirect to HTTPS. As a security company my first thought is that if you can't handle these simple things I'm not sure I'm ready to talk to you about more complex matters.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: