views:

23

answers:

1

What are the options for secure password/credential storage on a host and propagation of changes across a fleet of hosts?

An example would be you have fleet of size N and you want to store credentials, such as AWS access keys, on those hosts. The simple approach is to store it in the source code or a config file, but this is bad because it's usually plain text. Also, if you make a change to the credentials you then want them to propagate to all of the hosts in the fleet.

Are there any solutions that would allow for something along these lines?

Credentials credentials = new Credentials();
system.doAction( credentials.getCredential("CredentialKeyId") );

This is assuming a non-Windows fleet.

A: 

Are you asking for something similar to NIS? To Kerberos, maybe?

ninjalj
Not exactly. I'm looking for something as simple as a daemon that runs on each host that is a secure repository of credentials. This daemon also keeps track of changes and propagates those changes to the daemons running on the other hosts in the fleet. In essence, I'm looking for a credential storage repository that can communicate updates across the fleet.
itshanney
A problem with what you describe is that each host is as trusted as the others. A compromised host could tell all of the fleet that everyone's new password is "secret", right?
Slartibartfast