Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In order to launch an EC2 instance you need a key pair. How do you handle the situation where an engineer with acccess to the private key for that key pair leaves the company? Would it work to add individual ssh access, and deauthorize the initial key pair, immediately after instance launch?

share|improve this question

migrated from stackoverflow.com Oct 12 '11 at 3:22

This question came from our site for professional and enthusiast programmers.

1  
redeploy new instances of the EC2 instances and remove the old ones with the old key pair? –  sdolgy Oct 11 '11 at 18:07

3 Answers 3

When an employee or contractor leaves the company, you need to disable any privileged access they had to company resources. This includes (but is not limited to) your ssh key concerns:

  1. Remove the public ssh key from all authorized_keys files on all running instances. Replace them with a newly generated public ssh key which is known only to the people who should have access.

  2. Remove all keypair entries in EC2 that were known by the departed so that new instances cannot be started with those keypairs. Replace them with new keypair entries, perhaps with the same names if your

The alternative method you propose is also good and is one that I use: Disable the initial ssh key and add individual public ssh keys for each developer so they can log in with their normal private ssh key. This can be done for login to a shared account or with each developer getting their own individual user account (my preferred).

After an employee leaves, you'll not only have to clean up running servers, but also the process that adds the ssh keys to new servers. And, when an employee joins, you'll need to do the reverse: Add ssh keys to running servers and update the new server process.

This can be a bit more work to maintain lots of ssh keys across lots of servers, but that's where automation comes in.

share|improve this answer

See Amazon's documentation on access credential rotation.

Use something like puppet or solid ssh script to run around and replace all the instances of the old key if you don't want to relaunch everything... or just relaunch everything.

share|improve this answer
    
I think he doesn't talk about the account keys that you can rotate but more about the .pem private key to log to ssh. –  lc2817 Oct 11 '11 at 19:40
1  
The ssh login is controlled by the ~/.authorized_keys entries. Those are initially seeded by the EC2 launch process, hence the need to use puppet or scripting to replace them or relaunch. –  Jeff Ferland Oct 11 '11 at 19:49
    
alright. I didn't know that :). –  lc2817 Oct 11 '11 at 19:58
    
Yes, that's right. For normal accounts I could have sshd use LDAP, and thus be able to deactivate a user once from LDAP. But the launch keys are managed by AWS. So I think the puppet/chef solution of removing a launch key from each server's authorized_keys file is the way to go. I think I'd also want each admin to have their own AWS launch key, so I'm only removing a single user's access at a time. –  Jeff Oct 13 '11 at 1:29
    
@Jeff If SSH is configured to reference LDAP and ignore authorized_keys, then the launch key will only matter for controlling instance launch and termination. That depends on how you build your image. –  Jeff Ferland Oct 13 '11 at 1:32

You should never give this private key to end users. End users should be provisioned with their own means of login, such as public key authentication (using their OWN password-protected private key), followed by LDAP authorization.

Distributing the private key given to you by ec2 makes it impossible to de-provision users. This is exactly why the use of shared credentials is completely forbidden by all security and compliance regulations.

When you allow the use of shared credentials:

  • It's impossible to use logs to know who really is/was on a host
  • It's impossible to de-provision a user without de-provisioning all users (including emergency access, which is what that EC2 private key is really for)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.