Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to have one place where I have defined ssh keys for my users. These users can be in different (multiple) roles on single server. So I defined ssh_authorized_key as virtual and then wanted to realize them in different roles. Example:

@ssh_authorized_key {
    "user_a":
        tag     => ['deployer', 'developer', 'root'],
        key     => "xxx",
        type    => "ssh-dss",
        ensure  => present;
    "user_b":
        tag     => ['deployer', 'root'],
        key     => "yyy",
        type    => "ssh-dss",
        ensure  => present;
    "user_c":
        tag      => ['root', 'deployer'],
        key      => 'zzz',
        type => "ssh-rsa",
        ensure   => present;
}

And then realize them for multiple users on single node:

Ssh_authorized_key<| tag == 'root' |> {
    user    => 'root'
}

Ssh_authorized_key<| tag == 'deployer' |> {
    user    => 'deployer'
}

But puppet will install the certificates only for one user. I think that main concept of my solution is wrong. But I can't figure out how to install single certificate to multiple users?

share|improve this question

migrated from stackoverflow.com Oct 11 '11 at 17:42

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 2 down vote accepted

You are correct that the main concept of your solution is wrong, but I think it is wrong far earlier than you suspect. The best practice is to not share accounts; each user should have an individual account and use sudo to perform tasks that require alternate privileges. If you honestly must share one or more accounts, then allow your users to sudo su - ACCOUNT instead of logging in directly as ACCOUNT. For example:

user { 'alice': groups => ['developer', 'deployer', 'root'] # other params... }
ssh_authorized_key { 'alice': #params }

Then add appropriate entries in your /etc/sudoers (also hopefully managed by puppet!):

# deployer group can run the deployment script without a password.
%deployer  ALL = NOPASSWD: /usr/local/bin/deploy
# developer group can run commands as 'developer'
%developer ALL = (developer) ALL
# or, if you actually *must* allow them to log in as 'developer'
%developer ALL = /usr/bin/su developer
share|improve this answer
    
Although this does not answer my question. I admit that this is correct solution and everybody should do it this way. –  Michal Bryxí Sep 13 '13 at 13:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.