A system for distributing SSH public keys
Need help managing developer authentication on our system. We have multiple CentOS servers (database, Web, Redis, etc.), and it is important to be able to control access to them in a centralized, (hopefully) simple manner. What we use right now is the authorized_keys file, where we copy the key data from the keys our developers have generated. This, however, is not so scalable and flexible, since we need to update several servers whenever someone enters / leaves the team.
One possibility we have available is to have a centralized file that gets copied to every server, before doing an
sshd restart. I am interested, however, in finding out if there is a better pattern or alternative way of doing this, before I invest the time implementing that.
What is the usual pattern for authenticating several users, particularly in a multi-server environment? Bonus points for a solution that also lets us define some sort of role, to encapsulate access (i.e. front-end developers may not need to access the database servers, as a very contrived example).
Thanks very much!