How does google compute engine create users and how to disable them

coreosgoogle-cloud-platformgoogle-compute-enginessh-keysuser-management

I've got a CoreOS cluster running on GCE and one issue that I've noticed with all GCE instances is that as long as you're auth'd with the project on Google Cloud platform, you can login in as pretty much anything on the servers. This is an issue for me because anyone on the team, or anyone who gets into the project, can ssh right in as anyone to the server. I would like to disable this and just use users I've created in my cloud-config file that have specified ssh keys and passwords that expire. In doing this, I'm curious how google creates the users on GCE? And has anyone found a way to disable this?

Best Answer

You can prevent a GCE instance from adding accounts by ensuring the google-account-manager service does not run. On CoreOS you can stop this service with sudo systemctl stop google-accounts-manager.service and then disable it permanantly with sudo systemctl disable google-accounts-manager.service.

You may want to make an image with the service pre-disabled (or even delete the unit file) so that when you create instances it doesn't create accounts before you disable the service.

Related Solutions

Google Compute Engine Network Internal DNS

As suggested previously by Kamran, if you are using third-party name registrar, you will need to update your domain's name servers to use Cloud DNS. For more information on how to do this, see this updating your domain's name servers guide.

Additionally, you can retrieve the list of name servers that are configured to serve DNS queries for your zone by running gcloud dns managed-zones describe [EXAMPLE_ZONE] command as indicated in this Look up your Cloud DNS name servers section.

Expose port 80 and 443 on Google Container Engine without load balancer

Yep, through externalIPs on the service. Example service I've used:

apiVersion: v1
kind: Service
metadata:
  name: bind
  labels:
    app: bind
    version: 3.0.0
spec:
  ports:
    - port: 53
      protocol: UDP
  selector:
    app: bind
    version: 3.0.0
  externalIPs:
    - a.b.c.d
    - a.b.c.e

Please be aware that the IPs listed in the config file must be the internal IP on GCE.

Best Answer

Related Solutions

Google Compute Engine Network Internal DNS

Expose port 80 and 443 on Google Container Engine without load balancer

Related Topic