Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find good software to handle SSH keys in my organization.

So far I've found keymaster by Envylabs. SKM by Jerome Boismartel. Both could be option if we had only couple of users but since our organization has dozens of users manually keeping track of users isn't viable.

Best solution would be something that supported AD/OpenLDAP or OS X Server's directory. We could generate keys when creating user accounts and have them synced from LDAP into development/project servers and developers own machines.

Any tips would be welcome! And I'd love to know how other people are handling SSH keys.


migration rejected from Mar 10 '14 at 9:58

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by kce, mdpc, Jenny D, Rex, Falcon Momot Mar 10 '14 at 9:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – kce, mdpc, Jenny D, Rex, Falcon Momot
If this question can be reworded to fit the rules in the help center, please edit the question.

SSH Kerberos Auth.

Credit: O'Reilly

OpenSSH supports Kerberos-based authentication.. If you already have Active Directory deployed, then you already have a functioning Kerberos realm.

Here's an interesting method using a configuration management tool such as Puppet for distributing public keys. I'm not sure if that's an option in your environment, but either using Active Directory's Kerberos or something like Puppet (or perhaps both) should cover quite a bit of ground.


You can use Bcfg2 with bcfg2-accounts to distribute authorized_keys. As added bonus, you'll have ability to control users and groups.

Bcfg2 enables pain-free maintenance of /etc/ssh/ssh_known_hosts with SSHbase as well.

Bcfg2 is quite extensible, and if you want to have your key, users and groups information to come from AD, you should be able to with small connectors similar to generic or even with it (without python code development).


There is OpenSSH patch which allows fetching public keys from LDAP.


Not the answer you're looking for? Browse other questions tagged or ask your own question.