Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Suppose I have 5 users and 100 Linux machines with remote shell enabled. How do I set the environments up to allow these few users to log in to any of the machines with the same credentials?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Set up LDAP domain

By using an LDAP domain every authentication request to any machine is redirected to the domain controller. As far as I know, some Linux distros can join a Windows domain, if you have already one active. With this you have full centralized control over all the users in the network. You can add and remove users immediately from a single machine.

Pros:

  • Easiest to maintain
  • Immediate effect of user management
  • Very useful and cheap if you have an already active domain in your company
  • Integrated with common domain management software (ie. if you use Windows)

Cons:

  • If the LDAP controller is not clustered, that would be a single-point-of-failure, so you have to take into account more servers
  • (continued) The extra server(s) for LDAP and cluster makes the solution more expensive
  • Slightly difficult to set up if you don't have a domain controller already running
  • AFAIK you can't use public key authentication

Distribute SSH keys from a centralized machine

This is very useful when you want to use stronger authentication with public keys. You can upload all the users' keys on a single box that runs a Cron job scping the pubkeys to the correct home directories at certain time intervals

Pros:

  • Fault tolerant. Any number of servers can crash but the available machines won't be affected
  • Easiest and cheapest to setup

Cons:

  • If you have more than "five" users, ie. you are working on a large corporate network, user management is extremely difficult
  • (continued from above) user creation, deletion, etc. must be done for each server, usually with a script that replicates commands
  • Public keys are updated in delay if you don't manually run the script

Mount the home directories in a shared network drive (NFS, SSHFS...)

This has the advantage of real-time effects of modification of public keys (since they are always read from network share). Also, if you make /etc/shadow a symlink to a shared drive you have real-time user management from your controller

Pros:

  • Not many except real-time modifications
  • Whole home directory is shared across servers (it often comes handy, believe me...)

Cons:

  • Fault tolerant as the LDAP domain. You need to replicate the home directories or you cannot authenticate
  • Trickier than both the solutions to set up and maintain
share|improve this answer
2  
I highly doubt you can symlink /etc/shadow to a network volume is going to work. In fact, I suspect that would result in an un-bootable system. –  Zoredache May 26 '12 at 7:27
    
Thanks. That part of the answer doesn't come from real-world experience. I believe why, but I didn't think when I wrote the text: that file is probably read before network services (consequently NFS services) are started up. –  djechelon May 26 '12 at 20:07
3  
You can absolutely use key auth in combination with LDAP. PAM will use the LDAP password for things like the sudo password, but will still look in the ~username/.ssh/authorize_keys when connecting with SSH. Additionally, newer versions of OpenSSH are able to pull public keys directly out of LDAP. –  EEAA May 26 '12 at 21:57
1  
There are a number of flaws in this. There are free clusterable LDAP servers (openLDAP being the most common). Configuration Management systems like Puppet or Chef could easily distribute the ssh keys (and configure systems to auth to LDAP or whatever). –  Bill Weiss May 28 '12 at 13:06
    
@Bill Weiss: Mentioning a Windows domain does not mean it works only with Windows. Many organizations already own a Windows AD controller, so the compatibility encourages them to implement this technique. Of course your contribution is very appreciated. I must rephrase the single-point-of-failure thing about the DC. Of course you can cluster it, but it gets more expensive (you need additional 2 or 3 machines to the previous 100), I almost meant the opposite –  djechelon May 28 '12 at 20:55

Below is how a large organization does it with Puppet and SSH keys. The puppetmaster distributes the user accounts, ssh settings directory for each user, and sets a password for each user.

http://itand.me/using-puppet-to-manage-users-passwords-and-ss

This can be replicated in any config management system, not just Puppet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.