3

My company intends to hire an external contractor for some dev-ops jobs on our EC2 servers. We use Ubuntu accessed using a .pem certificate file.

For obvious reasons, I do not want to share my .pem key with an outsider - if the key is lost, anyone on the internet can access my machines.

I can add the contractor's ssh key to the .ssh/authorized_keys on all the servers, but that would be tedious and new servers won't be accessible by him unless I change the template server image.

Is there an easier way to grant temporary, revokable access to EC2 machines?

7
  • You say you use keys to access your servers, but it's not clear in your question whether the public keys are setup in a per-user basis(i.e. everyone with access to the server has an account) or you access the same accounts on the servers.
    – dawud
    May 18, 2014 at 15:50
  • 1
    If adding an SSH authorized key is tedious, you need a configuration management system like Ansible.
    – ceejayoz
    May 18, 2014 at 15:58
  • I am the only employee for now, so I have my .pem file on all the machines. For a safety measure, I have also placed my own id_rsa.pub file on all of them.
    – Adam Matan
    May 18, 2014 at 15:58
  • What I'm asking is if you have your own account or just log as root everywhere.
    – dawud
    May 18, 2014 at 15:59
  • 1
    What safety do you think that keeping your public key on your servers affords you?
    – EEAA
    May 18, 2014 at 19:07

1 Answer 1

2

If there is a centralized authentication system in place:

Yes, this can be done quite easily, for obvious reasons. Simply enable/disable the contractor's account in your centralized authentication system (LDAP, Kerberos, AD, ...). You can have a personal account for this specific contractor, or decide to use a generic third-party-people account. The former can retain auditability, if that matters.

If there is not a centralized authentication system in place:

Create a key pair for the contractor and place it in your machines using your configuration management of choice. If you don't have one, you can use ansible's shell module, which requires nothing at the client side, or, as a last resort, you can still use mussh or script yourself something around ssh-copy-id(1). Remove the key, revoke access in sshd_config, or both, once she/he has finished her/his job.

4
  • 1
    I'm so glad to see ansible being presented in more and more answers here. I've been using it for the past 4 months or so, and am completely smitten by it. :)
    – EEAA
    May 18, 2014 at 20:07
  • 1
    In this case, the agentless architecture of ansible is very convenient.
    – dawud
    May 18, 2014 at 20:27
  • +1 Thanks. Do you know any recommended getting-started guide to ansible's shell?
    – Adam Matan
    May 19, 2014 at 6:03
  • The project's online documentation is quite good.
    – dawud
    May 19, 2014 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .