1139582 - Require Duo MFA for MAXIMUM security hosts

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Even if this would require multiple MFAs for those bouncing through a jumphost, it will help protect these critical hosts.

This may not be possible on OS X (mac signing servers).

Comment 1

[hwine]

Boilerplate from RRA review:

In an RRA[1], "MFA directly on the master" was proposed as a security improvement for PuppetAgain. PuppetAgain is rated as having an impact of MAXIMUM.

This bug is to:
 a) propose an implementation for "MFA directly on the master"
 b) estimate the effort of implementing "MFA directly on the master"
 c) estimate the risk reduction provided by "MFA directly on the master"
 d) make a recommendation on implementation.

[1] https://drive.google.com/open?id=1Fi8Ojmdazo2dxX2c00flad5ao540ydDeLpDZlTBNFZE&authuser=0

Comment 2

[Guillaume Destuynder [:kang] [this account is no longer active]]

Proposal: Use the 2nd opinion system spelled out in https://mana.mozilla.org/wiki/display/SECURITY/IAM#IAM-Keyarchitecturetechnologies (see tech diagram)

Comment 3

[Kendall Libby [:fubar] (he/him)]

Access to all releng hosts now go via a set of jumphosts with Duo that's separate from IT's Duo.