central certificate management for server access

Question

I am in charge to realize something similar to this:

We are an upcoming startup, expanding pretty fast. Our development team increases nearly every month by 3-5 developer. Our infrastructure now consists of ~20 ubuntu webservers with several portal software systems running either php based apps like wordpress, joomla and so on or spring based backend technology (java).

We are now about 35 developer working either on wordpress, joomla (the portals) or the backend.

As usual, sometimes someone leaves and we would have to change all passwords he got to know.

I want it another way:

Each dev gets a certificate to login to the servers. If someone leaves, we can easily revoke the corresponding key and he won't get ever access to the servers anymore.

Is there any software out there to manage these certificates eg like replicating it to all servers?

Thanks for any help!

Answer 1

There are good number of ways to archieve this:

First, you can use some directory service like OpenLDAP (that is someting similar to Windows Active Directory). Just don't use any local accounts and block ldap account when person leaves. I'm not sure if ldap can handle ssh keys, but it can hanlde user accounts (username+password+groups) easily.

Second, you can use some configuration management tool like puppet or cfengine or chef or something like that.

Lastly, I believe it's best to avoid having accounts on live machines for 'average' developers. It's better to have something like build/deployment machine and use different tools for deployment/monitporing/etc, which does not requies for every developer to have account on each machine.

PS: I believe it's time for you to consider hiring operations person.