Skip to content

Comment on Jump Servers

Comments

Jump Servers must be able to reach to a certain private network and this requires specific configuration for each environment;

Yup. Use VPNs and firewall ACLs. Jump servers are leftovers of bad practices where good practices were too hard to implement.

Burden of managing SSH keys of users throughout all nodes. Rotation is required when someone leaves or enter the organization;

That is extremely trivial if you have (you should) any sensible configuration management in place. We just store them in LDAP with user data and distribute where neede (gitlab, servers)

Role management requires managing sudoers files, making sure file system permissions are properly configured and users are within their proper groups;

Ah yes, managing a text file, so fucking hard /s

Nodes must be updated with the tooling necessary to interact with internal services.
Keep a list of updated services (DNS) available to interact with it

see the point about CM

Usually, infrastructure enginners are a scarce team and keeping all these components updated are hard to tackle. Over time, these nodes will onboard more users and tooling, which will increase the complexity over managing these resources.

Which is why you write it once and use automation. I don't think we touched our sudoers or ssh key management module in years, it was written once then had some small changes but that's about it

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.