The document discusses zero-trust server management as an alternative to traditional server access management using Active Directory and VPN. Zero-trust involves dividing systems into sub-systems with least privilege access for all users, machines, and code. It also recommends using public key authentication and bastion hosts to create security zones for access to servers rather than relying on Active Directory in cloud environments.

1. Zero-Trust Server Management
Boston DevOps August 2014

2. Traditional server access management
has been based on Active Directory and
VPN / perimeter

3. Data center - “Chewy interior”
Perimeter - “Crunchy exterior”

4. What do you do when your
perimeter is taken away?

5. Service A Service B
Service C Service D

6. Zero-Trust:
No “root” privilege
Division of systems into sub-systems
Least privilege among all users, machines and code

7. Zero-Trust is the future of infrastructure
management
http://www.slideshare.net/mdkail/it-ops-2014-technology-roadmap

10. What’s the practical challenge to implement zero-trust
auth for systems management?

11. Don’t try and use Active Directory
in the cloud. It won’t work, for more reasons
than I can list here.

12. Front-End Back-End
◁ Corporate, password
authentication
◁ Second factor
◁ Location-independent
◁ Public key
authentication
◁ No shared keys
◁ Integrated with security
“zones” such as cloud
accounts and security
groups
Identity hand-off

13. ssh
Corporate Password Authority
ssh
Bastion
Service A
Service B
ssh
Public key and
systems authz
authority

14. Apply intelligent use of openssh and PAM
◁ Public keys available as a network service
◁ Granular authorization via PAM
◁ Automatic audit of login/logout events

15. Use Bastions to create security zones
◁ Dedicated admin bastion(s) for access to management
services such as Chef/Puppet server, log server, Conjur
◁ General-purpose bastions for access to everything else
◁ Let the back-end authz system provide most of the
access control

16. Zero-Trust Server Management
Boston DevOps August 2014