828726 - request to share SSL cert private key with developers

Status: RESOLVED FIXED

(Security Assurance :: General, task)

Description

[Gene Wood [:gene]]

In Bug 827601, we're tracking the name change of an AWS system named notoriousb2g.personatest.org to native-persona.org. This is in advance of the b2g launch. This system hasn't yet been productionized and is owned and administered by engineering.

https://github.com/mozilla-b2g/gaia/pull/7365

In order to get this system working with it's new name, we've had a cert issued for it in Bug 828486.

I'd like to confirm that the private key for the SSL cert can be installed on this dev owned box. I imagine that when this service gets moved into production we'll want to change the cert in order to keep it secure?

Comment 1

[Michal Purzynski [:michal`] (use NEEDINFO)]

So, we're moving the developer system in AWS to a production?

Comment 2

[Gene Wood [:gene]]

michal` jedp and I chatted in IRC and jedp is going to enable ssh access to opsec on the box.

Comment 3

[Andreas Gal :gal]

We will not block on this. Please try to get it done in time, if not, we will deliver the right url as a release note/follow-on patch.

Comment 4

[Joe Stevensen [:joe]]

I don't know the background or the context of this request, but we should not install the private ssl keys on dev boxes. I suspect this can be worked around?

Comment 5

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

(In reply to Joe Stevensen [:joes] from comment #4)
> I don't know the background or the context of this request, but we should
> not install the private ssl keys on dev boxes. I suspect this can be worked
> around?

Just the public keys - so they can ssh in

Comment 6

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

(In reply to Gene Wood [:gene] from comment #2)
> michal` jedp and I chatted in IRC and jedp is going to enable ssh access to
> opsec on the box.

Just waiting for michal` to email me public keys of anyone who needs ssh access to the box.  I'll install them as soon as I have them.

Comment 7

[Gene Wood [:gene]]

I've installed the infrasec_gen_1 key into the ec2-user on the machine. Connect with :

ssh [e-mail]

Comment 8

[Gene Wood [:gene]]

Joes, I've put the key on the dev box. I can take it off if need be.

Comment 9

[Joe Stevensen [:joe]]

Who setup/owns this host? I'd like to chat with them this morning.
Also, what AWS account is this under?

Comment 10

[Gene Wood [:gene]]

jparsons owns the host. I'm happy to join the conversation for technical consultation. Propose a time and I'll be there.

Comment 11

[Joe Stevensen [:joe]]

Met with Gene and Jed. We are ok with moving ahead on this. We'll work directly with Jed to secure this host in the meantime.

Comment 12

[Joe Stevensen [:joe]]

Nothing left to do here.