Best practice for VM logins/user management
So I'm thinking about switching from running all services on one bare metal machine to several VMs for better management and less clutter and easier diagnosis if failures occur. What I don't know, since all of the regarding knowledge is self-taught, is: How do you manage the VM users. To be more specific, which of those scenarios would represent best and worst practice:
(A) Using the same username/usergroup with the same password on each devices to login and manage the corresponding services.
(A.2) same as A but using additional new users to actually run the services.
(B) Same as A/A.2 but using different passwords.
(C) Using unique usernames and passwords for login and run services with under those users.
Let me know what your take on that is. Moreover, I've shortly read about Kerberos and somehow ended up at FreeIPA. Is that something one should/could use? I'm planning on having one VM as a Fileserver with NFS shares (for all the other linux VMs and my Laptop) and SMB shares (for the iPhone/iPad since they don't connect to NFS...). If I understand correctly, one either has to use Kerberos or dedicated allowed IPs to manage access to NFS shares?
Posted Feb 9, 2021, 8:55 AM UTC
In my opinion this very much depends on the actual use case. Do you have outward facing services, do you regularly spin up new instances, do you run an active directory/LDAP, do you only use Linux or als Windows?
Reason for all of the above - if you have for example a development environment that can't be accessed from outside then I don't see any harm in using the same user password for the various instances that you spin up (most will be short lived anyway) - on the other side of the spectrum things that are reachable from the outside I would definitely go for every possible security measure that's available for the corresponding service
I do have outward facing services (Nextcloud, Webserver, ssh). However, the long term plan would be to get a VPS with a reverse proxy to a Wireguard VPN tunnel to my homelab.
As for machines I only use Linux machines, and have an iPhone+iPad that I want to have access to certain folders on the file server.
I don't think I will regularly spin up new instances, and I currently do not run an active directory/LDAP. But I'm not yet entirely sure what benefits or overhead those might bring.