Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several remote developers and several servers on EC2. Is there a way I can centrally manage the authorized_keys file on EC2, rather than having to add keys manually on each server?

share|improve this question

5 Answers 5

up vote 1 down vote accepted

If you manage to setup your base image to utilize itself as a Puppet client, you can make use of the ssh_authorized_key directive, or even manage a template file directly using the file type and pushing it to the .ssh/authorized_keys file.

Puppet also includes utilities to manage provisioning through EC2, so you can really make it all a one-stop shop.

share|improve this answer

I ended up adding back password authentication to SSH so I could just manage it with the user name and passwords on the server. Would be interested to see how other people approached this.

share|improve this answer
    
This doesn't centralize anything (and now you have passwords on each machine that can get out of sync in addition to the SSH keys), Plus it's a step backwards in terms of security: With centralized key management you'd be able to disable password authentication entirely. With this method you're forced to allow passwords for logging in, exposing you to brute force attacks. –  voretaq7 Feb 9 '12 at 23:50

One option is to have a tiny instance set up, you provide all your developers access to this machine. They SSH into it, and the machine has an authorized ssh key that allows them access to all the other machines. You can then use firewalls on the machines to prevent SSH logins from other IP addresses.

Another option would be to setup something like Puppet, which would be able to manage the authorized_keys file for you.

Yet another option is to setup a script to rsync the authorized_key file over to all the hosts when it's changed on one machine. You could use something like lsyncd to automate this.

Keep in mind that just because you revoke a developers SSH key, does not mean you have removed any access they might have to that machine. A malicious person with SSH access might setup something like a reverse shell, or add various types of backdoors to the code they are working on.

share|improve this answer

You can use LDAP, but you'll need to apply the OpenSSH patch and build it yourself. But you also get centralized account management as well.

share|improve this answer
    
This would be my choice: Centralized keys, centralized accounts. Only downside is you'd need to run an LDAP server (so either a separate instance (best option) or a few more CPU cycles on an existing one (cheapest option) to do that... –  voretaq7 Feb 9 '12 at 23:48

It's quite hard to manage keys to SSH into instances, and there are no easy solutions that come to my mind. Cloud management softwares such as RightScale and Scalr, solve this kind of problems. Scalr provides one-click SSH access to any of your instances using secure key access and lets you re-download keys if you lose them. Scalr is open source or available online through a hosted version.

PS: I work at Scalr

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.