(Disclaimer, unicorn employee.) I'm confused. Are you implying people write company code on personally owned laptops? That's insane!
1. Company walks you through setting up FileVault (with key escrow) and VPN client, generating and uploading SSH public key immediately after unboxing laptop.
2. OneLogin + Duo (or pick your SSO/2FA scheme) for everything - internal webapps, GMail, etc.
3. SSH keys managed by Puppet.
4. 2FA verification of SSH logins (using pam-interactive), through a bastion (provided .ssh file makes it transparent), with OSX's default SSH agent, with pretty much all of those best practices configured except smartcards/certs.
5. Engineers have SSH access only to utility/development boxes. You can deploy code to production through a webapp (identifying the commit ID) but you can't get a shell as your application's user, and certainly not root.
6. Webapps moving behind a VPN.
In the rare case that you need to debug in production beyond what you can get from metrics/logs, you pair with a "blessed"/senior sysadmin type.
Thank you for this. I suppose I should have included the caveot that my rant applies mostly to early stage shops which are aren't ready to build out and ship a shiny new dev machine for every employee. Another problem for smaller startups is that if you're not careful almost everybody ends up being "blessed". And simply being a senior sysadmin type doesn't mean that you're automatically immune from all forms of social engineering attacks. I suppose your point is that even very early companies should opt for standardized hardware, I think you're right.
If you are using an ssh agent, it is a good idea to delete the keys when you lock the screen or sleep your laptop. On Mac OS X you can do this with Hammerspoon: http://fanf.livejournal.com/139925.html
1. Company walks you through setting up FileVault (with key escrow) and VPN client, generating and uploading SSH public key immediately after unboxing laptop.
2. OneLogin + Duo (or pick your SSO/2FA scheme) for everything - internal webapps, GMail, etc.
3. SSH keys managed by Puppet.
4. 2FA verification of SSH logins (using pam-interactive), through a bastion (provided .ssh file makes it transparent), with OSX's default SSH agent, with pretty much all of those best practices configured except smartcards/certs.
5. Engineers have SSH access only to utility/development boxes. You can deploy code to production through a webapp (identifying the commit ID) but you can't get a shell as your application's user, and certainly not root.
6. Webapps moving behind a VPN.
In the rare case that you need to debug in production beyond what you can get from metrics/logs, you pair with a "blessed"/senior sysadmin type.