Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

In order to launch an EC2 instance you need a key pair. How do you handle the situation where an engineer with acccess to the private key for that key pair leaves the company? Would it work to add individual ssh access, and deauthorize the initial key pair, immediately after instance launch?

share|improve this question
1  
redeploy new instances of the EC2 instances and remove the old ones with the old key pair? – sdolgy Oct 11 '11 at 18:07

migrated from stackoverflow.com Oct 12 '11 at 3:22

2 Answers

up vote 4 down vote

When an employee or contractor leaves the company, you need to disable any privileged access they had to company resources. This includes (but is not limited to) your ssh key concerns:

  1. Remove the public ssh key from all authorized_keys files on all running instances. Replace them with a newly generated public ssh key which is known only to the people who should have access.

  2. Remove all keypair entries in EC2 that were known by the departed so that new instances cannot be started with those keypairs. Replace them with new keypair entries, perhaps with the same names if your

The alternative method you propose is also good and is one that I use: Disable the initial ssh key and add individual public ssh keys for each developer so they can log in with their normal private ssh key. This can be done for login to a shared account or with each developer getting their own individual user account (my preferred).

After an employee leaves, you'll not only have to clean up running servers, but also the process that adds the ssh keys to new servers. And, when an employee joins, you'll need to do the reverse: Add ssh keys to running servers and update the new server process.

This can be a bit more work to maintain lots of ssh keys across lots of servers, but that's where automation comes in.

share|improve this answer
up vote 1 down vote

See Amazon's documentation on access credential rotation.

Use something like puppet or solid ssh script to run around and replace all the instances of the old key if you don't want to relaunch everything... or just relaunch everything.

share|improve this answer
I think he doesn't talk about the account keys that you can rotate but more about the .pem private key to log to ssh. – lc2817 Oct 11 '11 at 19:40
1  
The ssh login is controlled by the ~/.authorized_keys entries. Those are initially seeded by the EC2 launch process, hence the need to use puppet or scripting to replace them or relaunch. – Jeff Ferland Oct 11 '11 at 19:49
alright. I didn't know that :). – lc2817 Oct 11 '11 at 19:58
Yes, that's right. For normal accounts I could have sshd use LDAP, and thus be able to deactivate a user once from LDAP. But the launch keys are managed by AWS. So I think the puppet/chef solution of removing a launch key from each server's authorized_keys file is the way to go. I think I'd also want each admin to have their own AWS launch key, so I'm only removing a single user's access at a time. – Jeff Oct 13 '11 at 1:29
@Jeff If SSH is configured to reference LDAP and ignore authorized_keys, then the launch key will only matter for controlling instance launch and termination. That depends on how you build your image. – Jeff Ferland Oct 13 '11 at 1:32
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.