rstarkey-block

Bastion User Access Analysis - Synopsis

Objective: Discover which users have actually logged into the bastion hosts.

Method:

• Analyzed wtmp login records from 3 bastions: aam964.iad1, aam1402.sjc1b, aam1388.sjc1b
• Filtered for users with active shells (excluded /bin/false)
• Cross-referenced with /etc/passwd to confirm valid accounts

Result: 33 unique users have logged into bastions

rstarkey-block

SSH Host Key Signing Instructions

Setup

# Clone gh-ssh-certifier (required dependency)
cd ~/Development
git clone git@github.com:squareup/gh-ssh-certifier.git

# Clone tcp-salt and checkout the branch

rstarkey-block

Branch Promotion: main → stable

Problem

Deploying Salt configuration changes directly to production risks fleet-wide outages. A bad state can break authentication, networking, or services across hundreds of hosts simultaneously with no warning.

A simple two-branch model with full merges doesn't solve this either:

• Can't skip a PR that needs more canary time