Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to find good software to handle SSH keys in my organization.

So far I've found keymaster by Envylabs. SKM by Jerome Boismartel. Both could be option if we had only couple of users but since our organization has dozens of users manually keeping track of users isn't viable.

Best solution would be something that supported AD/OpenLDAP or OS X Server's directory. We could generate keys when creating user accounts and have them synced from LDAP into development/project servers and developers own machines.

Any tips would be welcome! And I'd love to know how other people are handling SSH keys.

share

migration rejected from stackoverflow.com Mar 10 at 9:58

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by kce, mdpc, Jenny D, Rex, Falcon Momot Mar 10 at 9:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – kce, mdpc, Jenny D, Rex, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

SSH Kerberos Auth.

Credit: O'Reilly

OpenSSH supports Kerberos-based authentication.. If you already have Active Directory deployed, then you already have a functioning Kerberos realm.

Here's an interesting method using a configuration management tool such as Puppet for distributing public keys. I'm not sure if that's an option in your environment, but either using Active Directory's Kerberos or something like Puppet (or perhaps both) should cover quite a bit of ground.

share

There is OpenSSH patch which allows fetching public keys from LDAP.

share

You can use Bcfg2 with bcfg2-accounts to distribute authorized_keys. As added bonus, you'll have ability to control users and groups.

Bcfg2 enables pain-free maintenance of /etc/ssh/ssh_known_hosts with SSHbase as well.

Bcfg2 is quite extensible, and if you want to have your key, users and groups information to come from AD, you should be able to with small connectors similar to generic Ldap.py or even with it (without python code development).

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.