Give mentors ssh access to droplets

[dehnert]

When debugging issues with droplets, it would be helpful if mentors could ssh in.

It probably makes sense to implement this by putting an ssh key on a shared machine, and having mentors ssh into that machine with their own keys, and then ssh from there to the droplet, rather than ssh'ing directly -- that way, if a mentor joins after a droplet is created, they can still connect to it. There was some discussion of this on the GCI mentors stream.

[dehnert]

by putting an ssh key on a shared machine

If we could find an opensource tool like Akamai's authgate, that'd be great, but AFAICT that doesn't currently exist. (I, and a few other folks in the Zulip community, am familiar with authgate from having worked at Akamai.)

[dehnert]

Netflix's BLESS seems somewhat similar to authgate and might work. (I'm not sure how complete a solution it is, though.)

[dehnert]

Somebody else says:

Here’s a list of open source projects with goals similar to authgate:
https://github.com/Netflix/bless
https://github.com/continusec/geecert
https://github.com/uber/pam-ussh
https://github.com/cloudtools/ssh-cert-authority

I haven't looked at any of these in depth.

[Lyla-Fischer]

Quoth Tim from the mentors stream " ideally, we'd do a small project to add to zulip.git a tool that one can run to give a given GitHub username SSH access to a droplet, and then we can ask students to run it..."