8
votes
Accepted
Can I create AWS Keys for each user that expire every 2 weeks?
Root User
The root user should have MFA enabled, then have it locked away and never used. Never create access keys for the root user.
IAM Administrator
Create an IAM administrator user with MFA ...
- 33.2k
5
votes
Can I create AWS Keys for each user that expire every 2 weeks?
DO NOT use an access key for your AWS account root user. Use IAM users for everyday interaction with AWS. Now that is out of the way...
Use Temporary Security Credentials
You can create IAM roles ...
- 508
5
votes
How to generate new, 2048-bit Diffie-Hellman parameters with Java keytool?
Actually you can specify custom DHE Parameters with recent Java 8 versions. That is independend of the application (as Long as it using JSSE TLS implementation).
You first need to specify the size of ...
- 845
4
votes
Accepted
Where is cli.ini letsencrypt config file?
Where is the cli.ini file for default letsencrypt package?
According to the documentation: “By default, the following locations are searched: /etc/letsencrypt/cli.ini, $XDG_CONFIG_HOME/letsencrypt/...
- 1,753
4
votes
SSH key problems: Not a RSA1 key file unknown key type '-----BEGIN'
Additional information in case anyone finds it useful.
This error can be caused by using a private key generated by a recent version of ssh-keygen with a much older version of the ssh client.
I ...
- 864
4
votes
How can I know which AWS S3 bucket(s) an AWS key and secret key that can access?
This is a good question and I don't think there is a single, particularly simple answer.
If all you've got is an access key and secret key, you may want to use aws cli commands like list-buckets. ...
- 445
3
votes
Accepted
"Target KMS key" error when trying to enable backup replication on an AWS RDS instance
So the problem is that I had created my symmetric multi-region KMS key in the same region in which I was creating the RDS database.
The KMS key needs to be created in the region where the backups will ...
- 303
3
votes
public key authentication fails ONLY when sshd is daemon
I had the same issue. In my case, restorecon and chcon did not work.
I did not want to disable selinux. After lots of research, I finally figured it was because my home directory was mounted from ...
- 31
2
votes
Centralized management system for SSH keys?
There's a lot of great commercial and open source solutions, such as Userify[1] (where I work), Universal Key Manager[2], SSH Key Box[3], etc. It depends on what your needs are and if you are looking ...
- 1,184
2
votes
How do you set the session key size in OpenSSH?
A lot of security improvements were made in the SSH 2 protocol compared to protocol version 1 and I imagine removing that option was one of those.
As far as I can divine the session key size is ...
- 81.7k
2
votes
Accepted
Edit x509v3 extended key usage in existing certificate-file
No, you can't edit contents of the certificate, because it is digitally signed by CA server. If you modify anything there, you will break the signature and make your certificate unusable. Digital ...
- 7,257
2
votes
Accepted
Cut Off My Own Google Cloud Engine SSH Nose
To edit or examine configuration files in the root disk of a VM that you do not have access, follow the steps in the section ¨Inspect an instance without shutting it down¨ of this document.
A summary ...
- 1,395
2
votes
OpenVPN Copy Server Certificate/Keys Onto Different Server
Easy-RSA is a (easy) way of generating the certificates, keys, etc. necessary for operating services such as OpenVPN, but also Apache/nginx. It does not matter where you run the actual program, as ...
- 253
2
votes
public key authentication fails ONLY when sshd is daemon
To add to Mark Wagner's answer, if your're using a custom home directory path (i.e. not /home), you need make sure you've set the SELinux security context. To do so, if you have user home directories ...
- 121
1
vote
How can I know which AWS S3 bucket(s) an AWS key and secret key that can access?
If you need to do this programmatically, say if you have a lot of credentials or buckets this bit of Python I wrote a while ago might help:
import botocore
import boto3
import os
from pathlib import ...
1
vote
FreeIPA SSH keys not working with Ubuntu
This is now resolved. The problem was AWS related. In newer versions of Ubuntu images (20.04 upwards) in AWS, ssh via key files reaches out to something called ec2 instance connect. This bypasses ...
- 81
1
vote
In OpenShift Origin, I need to generate keys and certificates in order to make my connection secure. Where do these keys come from?
SSL keys infrastructure is meant to prevent man-in-the-middle (MITM) attacks. Suppose you're a bank. A MITM can intercept traffic between you and your customer, impersonate you for your customer and ...
- 123
1
vote
Extract a .pem file from an existing .ppk or from the server?
Copy the putty key to your mac
Install Homebrew (if not installed)
Install putty command-line on your mac
brew install putty
Extract your private key
puttygen id_dsa.ppk -O private-openssh -o ...
- 145
1
vote
Accepted
Can an AWS CloudFormation create a KeyPair to subsequently use when starting instances?
According to the documentation, it is (now) possible to create a key pair with cloudformation:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-keypair.html
To create a ...
- 126
1
vote
Enforce SSH key passwords?
One mitigation would be to use the google authenticator PAM module plugin. Usually available within the official packages.
This will make 2FA available through a 6-digit code on your smartphone.
...
- 2,220
Only top scored, non community-wiki answers of a minimum length are eligible