---
title: SSH from your DevOps CI/CD securely
osem_url: https://osem.seagl.org/conferences/seagl2021/program/proposals/841
beginning: '2021-11-05T10:10:00.000-07:00'
end: '2021-11-05T10:40:00.000-07:00'
resources:
  internet_archive_identifier: SeaGL2021-Bri_Hatch-SSH_from_your_DevOps_CI_CD_securely
  slides_url: https://www.ifokr.org/bri/presentations/seagl-2021-ssh-cicd/
presenters:
- name: Bri Hatch
  affiliation: ExtraHop Networks
  osem_url: https://osem.seagl.org/users/68
  gravatar_id: e22b6ff68fa96ae5b60c4ad7f15ad77f
  biography: Bri Hatch is Director of IT at ExtraHop Networks, and Chief Hacker at
    Onsight, Inc. An adamant Open Source advocate and security buff, Bri is the author
    of Hacking Linux Exposed, Building Linux VPNs, and numerous online articles on
    the topics of Linux, security, and coding. He has been securing and breaking into
    systems since before he traded in his Apple II+ for his first Unix system.
---

Your CI/CD pipeline needs to make things happen, and often that means hitting other machines via SSH or rsync. Since no human is at the keyboard to type a password, how do you automate this securely? We'll show alternatives to passwordless keys in your repository (BAD!!!), describe the security implications, and how you can assure that these keys are usable only for the commands they require.
