Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature: zerotrust with credentials #2119

Closed
chifu1234 opened this issue Jun 1, 2022 · 11 comments
Closed

Feature: zerotrust with credentials #2119

chifu1234 opened this issue Jun 1, 2022 · 11 comments
Labels
enhancement New feature or request

Comments

@chifu1234
Copy link

Is your feature request related to a problem? Please describe.
Today the user has full access(read) to the cred store & thus knows all credentials. This mechanism sometimes leaks some vulnerable information to the end-user & it reduces the user experience as they have to enter the credentials to the session.

Describe the solution you'd like
Boundary acts as ssh or RDP proxy. The admin can set propriety to a credential that the end-user does not have read or write access to these credential. If a user tries to connect to a system with ssh/RDP, the boundary proxy (worker) performs the authentication and then proxies the session back to the end-user.

Describe alternatives you've considered

  • Using OTP for credentials (bad user experience)
  • Use AD Users and let them handle by the HashiCorp vault (with a TTL) (bad user experience)
@chifu1234 chifu1234 changed the title Feature: ZeroTrust with Credentials Feature: zerotrust with credentials Jun 1, 2022
@heatherezell heatherezell added the enhancement New feature or request label Jun 1, 2022
@xingluw
Copy link
Contributor

xingluw commented Jun 1, 2022

Hi @chifu1234, this feature is already being considered for the roadmap, but I will leave this post open so that the community can show interest with their upvotes.

@karras
Copy link

karras commented Aug 11, 2022

@xingluw Is my understanding correct that a first iteration of this feature request was implemented in 0.10.0 with "Credential Injection"? Any plans to include this in the OSS version as this seems to be solely available in HCP Boundary at the moment or am I mistaken? :)

Thanks!

@xingluw
Copy link
Contributor

xingluw commented Aug 11, 2022

Hi @karras, that is correct, it will only be available in HCP Boundary and there are no plans to implement this in OSS at this time.

@xingluw xingluw closed this as completed Aug 11, 2022
@sandstrom
Copy link

sandstrom commented Sep 25, 2022 •
edited
Loading

I get that you want to make money to pay back all investors.

But pushing for HCP (hosted cloud) of an auth-tool doesn't make sense to me.

When you get hacked (will happen) or are down (will also happen) we'll have a big problem. I honestly don't see any benefit to HCP here.

Is there a paid offering where the injection feature is available?

We're a ~10 people company and pay for several "pro" versions of open-source products.

For "boundary pro" a fee per user and month would make sense for us.

It should still be OS and we'd manage/host it, but there would be a license requirement and telemetry could report number of users back to HashiCorp for billing.

Any plans for such a thing?

@covetocove
Copy link
Contributor

covetocove commented Sep 28, 2022 •
edited
Loading

@sandstrom first off thank you for the interest in Boundary and for giving feedback to drive the product's direction. [Update] there is now a self-managed Enterprise offering of Boundary available that includes enterprise support and premium features such as credential injection, multi-hop sessions, and session recording. Learn more about Boundary Enterprise here.

Moving forward we will continue to invest in all editions of Boundary: Boundary OSS, HCP Boundary (Boundary's cloud service), and Boundary Enterprise. This includes:

Investing in HCP Boundary security and availability
One of our top priorities for HCP Boundary is ensuring the managed surface is consumable even in secure environments. Self-managed workers already help limit access to customer environments and we are working on new features that will improve the security posture of accessing a highly secure private network. In addition, we will continue to improve the managed service with functions such as backup workflows, disaster recovery, and platform outage fallbacks. We will have some announcements in this vein at next week's HashiConf Global conference.

Continuing to build a compelling Boundary OSS offering
We remain as committed to building a compelling and secure open source offering of Boundary. The use of single-use credentials instead of static, long-lived credentials, is one of the ways Boundary can help improve an organization’s security posture. Even without credential injection, the use of credential brokering with single-use credentials is a significant improvement in security posture vs other forms of credential management because the attack vector is so limited. We are continuing to improve the user experience for credential brokering to expand to a variety of dynamic credentials and these will be coming to open source Boundary as well as HCP Boundary.

@sandstrom
Copy link

sandstrom commented Sep 28, 2022 •
edited
Loading

Thanks for answering @PPacent!

For us to choose hosted Boundary, it would likely need to be engineered in such a way that even if you are hacked, the hacker wouldn't get access to our systems.

Not an impossible engineering challenge, but not a super-easy one either and would likely require us to spin up nodes that does the actual auth, signs them and passes them along to your hosted stuff. At which point there is little use in spreading out the service across components hosted both by you and by us.

For example, we do use hosted 1Password since it's E2E. But doing a zero-trust auth-service is going to be trickier 😄

We love hosted stuff in general, but I'd say that server access is probably one of very few things that we prefer to maintain our selves.

I looked around a bit more, and found this blog post of yours from about a year ago:
https://www.hashicorp.com/blog/managing-ssh-access-at-scale-with-hashicorp-vault

Something like that, but with Boundary, would also work for us. In that case we could use brokered credentials, since they are short-lived.

I also found this open issue, which I think may be the blocker to unlocking the solution described in that blog post: #1768

@simonfelding
Copy link

You should really reconsider your stance on this issue. I'm sure there's lots of money to be made on support contracts like what oracle does.

I work in a large IT company (7000 employees or so) that currently has a somewhat unpleasant UX for the auth process. Boundary with credential injection would be really great, but there's just no chance of convincing anyone to do a transition to a cloud based service - it's on-prem or nothing.

@JannikZed
Copy link

JannikZed commented Feb 27, 2023 •
edited
Loading

For us, it was also a big shock now, that we invested a few days setting up Boundary OSS (as our customer is not allowing hosted services from US corps..), after evaluating everything with HCP and to realize now, that all needed features don't work. We would need to switch from SSH certs back to SSH passwords in order for boundary to be able to broker it .. an awful experience.

@jory3
Copy link

jory3 commented Aug 2, 2023

Same here: Only after setting up a test environment I found out, that "credential injection", something I considered as the core feature of boundary, doesn't work on premise. Currently, the OSS version of boundary is not much more than a password manager with team capabilities, combined with an SSH client - but much more complicated to setup, use and maintain.

@covetocove
Copy link
Contributor

Hi all - @chifu1234, to your original request on this thread, Boundary now supports credential injection in HCP Boundary as well as Boundary Enterprise (customer-hosted version of Boundary). With credential injection, the user never sees the credential required to authenticate to the target. This provides a passwordless experience for the user, as the worker does both session establishment and authentication to the target on behalf of the user. We currently support credential injection for SSH credentials and plan to expand to other types of protocols in the future. You can learn more about credential injection here.

@jory3, @JannikZed, @simonfelding, @sandstrom - there is now self-managed edition of Boundary that supports credential injection. Boundary Enterprise is now available which includes all premium features of Boundary - including credential injection, multi-hop sessions, and session recording. You can learn more here.

@simonfelding
Copy link

simonfelding commented Aug 2, 2023 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@sandstrom @karras @JannikZed @chifu1234 @jory3 @covetocove @simonfelding @heatherezell @xingluw