SSH key management software?

Question

I'm trying to find good software to handle SSH keys in my organization.

So far I've found keymaster by Envylabs. SKM by Jerome Boismartel. Both could be option if we had only couple of users but since our organization has dozens of users manually keeping track of users isn't viable.

Best solution would be something that supported AD/OpenLDAP or OS X Server's directory. We could generate keys when creating user accounts and have them synced from LDAP into development/project servers and developers own machines.

Any tips would be welcome! And I'd love to know how other people are handling SSH keys.

Answer 1

Credit: O'Reilly

OpenSSH supports Kerberos-based authentication.. If you already have Active Directory deployed, then you already have a functioning Kerberos realm.

Here's an interesting method using a configuration management tool such as Puppet for distributing public keys. I'm not sure if that's an option in your environment, but either using Active Directory's Kerberos or something like Puppet (or perhaps both) should cover quite a bit of ground.

Answer 2

There is OpenSSH patch which allows fetching public keys from LDAP.

Answer 3

You can use Bcfg2 with bcfg2-accounts to distribute authorized_keys. As added bonus, you'll have ability to control users and groups.

Bcfg2 enables pain-free maintenance of /etc/ssh/ssh_known_hosts with SSHbase as well.

Bcfg2 is quite extensible, and if you want to have your key, users and groups information to come from AD, you should be able to with small connectors similar to generic Ldap.py or even with it (without python code development).