Oops, I committed my private key: Automating security from with IoT and IaC
summary
After two accidental SSH key commits the project builds a personal secrets platform using Ansible, Packer, HashiCorp Vault, and inexpensive IoT: a three Raspberry Pis raft cluster each with a ZemKey HSM and Vault instance, PGP-encrypted Shamir shares (7 shares, threshold 4), plus backup YubiKeys and offsite backups. It issues short‑TTL certs and one‑time SSH passwords, automates unseal by quorum plus one manual key, and demonstrates reproducible, auditable secrets management that contains breaches.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker background
- 6:47Project goals and motivation
- 16:28Tools and their roles
- 22:50Vault cluster setup and unsealing
- 27:50Certificate authority and IoT security
- 30:42Preventing SSH key leaks
- 34:17Auditing and improvements
related talks
27mKeybase Vault Auto-Unseal
38mKeeping Secrets - A Practical Approach to Managing Credentials
29mBehind Closed Doors: Managing Passwords in a Dangerous World
36mEdge Security in Untrusted IoT Environments
26mHow To Keep A Secret
33mIterative Security...
30mBehind Closed Doors: Managing Passwords in a Dangerous World
57mSecuring the last mile of IoT solutions