FAQ: Audit SSH usage

[drnickiw]

what

• How to audit SSH usage FAQ

why

• Imported from Google Doc

Links to #353

[osterman]

Suggested change

).

[osterman]

Suggested change

	The best way is with Teleport. We’ve implemented this with other clients. However, those Helm Charts are not yet open-sourced. We are working with them to make that happen; see [here](https://github.com/gravitational/teleport
	The best way is with Teleport. We’ve implemented this with other clients. However, those Helm Charts are not yet open-sourced. We are working with them to make that happen; see [here](https://github.com/gravitational/teleport).

[osterman]

Suggested change

	Gravitational makes a Helm Chart available for Teleport. However, last we checked, it didn't work the way we'd want it to, whereby Teleport is deployed on all nodes as a `DaemonSet`.
	Gravitational makes a [Helm Chart available for Teleport](https://github.com/gravitational/teleport/tree/master/examples/chart/teleport). However, last we checked, it didn't work the way we'd want it to, whereby Teleport is deployed on all nodes as a `DaemonSet`.

[osterman]

Suggested change

Technically, we have our own solution called `sudosh`, but that's subpar by comparison. It's an extremely simple wrapper for `sudo` that enables it to be used as a system login shell. `sudo` natively supports session logs and replay. The downside with this solution is we still must store the `sudo` binary logs somewhere, so it's not as tamper-resistant as Teleport. In addition, the logs are binary, so shipping them to a log store like Sumologic or Splunk is not recommended.

Technically, we have our own solution called [`sudosh`](https://github.com/cloudposse/sudosh), but that's subpar by comparison. It's an extremely simple wrapper for `sudo` that enables it to be used as a system login shell. `sudo` natively supports session logs and replay. The downside with this solution is we still must store the `sudo` binary logs somewhere, so it's not as tamper-resistant as Teleport. In addition, the logs are binary, so shipping them to a log store like Sumologic or Splunk is not recommended.

[osterman]

This PR includes changes from #385

This usually means one of two things:

1. Your master branch is not pristine (as in contains changes), so if you fork from it, you're including changes. See https://stackoverflow.com/a/1628334/1237191
2. You are not changing back to master before starting a new fork

[drnickiw]

I created new forks from master each time. This first one stated there was a difference in the commits that was awaiting review from a reviewer at the origin though, so I assumed it was something that was pending on your end and continued on. I'll check this issue though.

…

________________________________ From: Erik Osterman <[email protected]> Sent: Monday, February 18, 2019 9:48 PM To: cloudposse/docs Cc: drnickiw; Assign Subject: Re: [cloudposse/docs] FAQ: Audit SSH usage (#386) This PR includes changes from #385<#385> This usually means one of two things: 1. Your master branch is not pristine (as in contains changes), so if you fork from it, you're including changes. See https://stackoverflow.com/a/1628334/1237191 2. You are not changing back to master before starting a new fork — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub<#386 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/Artg4ad9tDlO1kUiKc3wWv_Rzv26VvG_ks5vO2XsgaJpZM4a_2Tx>.

[drnickiw]

I created new forks from master each time. This first one stated there was a difference in the commits that was awaiting review from a reviewer at the origin though, so I assumed it was something that was pending on your end and continued on. I'll check this issue though.
…
________________________________ From: Erik Osterman [email protected] Sent: Monday, February 18, 2019 9:48 PM To: cloudposse/docs Cc: drnickiw; Assign Subject: Re: [cloudposse/docs] FAQ: Audit SSH usage (#386) This PR includes changes from #385<#385> This usually means one of two things: 1. Your master branch is not pristine (as in contains changes), so if you fork from it, you're including changes. See https://stackoverflow.com/a/1628334/1237191 2. You are not changing back to master before starting a new fork — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub<#386 (comment)>, or mute the threadhttps://github.com/notifications/unsubscribe-auth/Artg4ad9tDlO1kUiKc3wWv_Rzv26VvG_ks5vO2XsgaJpZM4a_2Tx.

[drnickiw]

This PR includes changes from #385

This usually means one of two things:

1. Your master branch is not pristine (as in contains changes), so if you fork from it, you're including changes. See https://stackoverflow.com/a/1628334/1237191
2. You are not changing back to master before starting a new fork

[drnickiw]

The second unnecessary file should be properly removed.