Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is the situation.

I have 5000 servers broken into "groups" of 100.
Each "group" has 1 SSH key pair, that will allow access to any of the servers in the group. I have 60 users(some human, some not) that need to access all 5000 servers. The users are all on different computers, some PC (putty) some Linux(ssh).

manually: Adding a new server to a "group" seems to be simple. Adding/updating a user would be a nightmare. Adding/updating a new group would be a nightmare. Syncing group keys to user stations would be a nightmare.

ssh-agent/pageant works for a single user, on a single workstation, but doesn't seem to be scalable.

Is there software that can handle this management? Some kind of proxy perhaps? Or automated server based key retrieval protocol?

EDIT

I appreciate the help so far, however I think I am not being clear or not understanding the suggestions.

Some more information: Each of the servers is a remote system with no access to the Internet and the connection speed is generally slow. Each server has only one entry in its authorized_keys file. I do not want or need individual user keys. I just want many different people to use the same key for each group. Right now we are using password authentication, and keep a list of a passwords for each group on a piece of paper. This works for our team. But it will not work if we switch to key based authentication.

Do the suggestions still make sense? If so, can you please be more specific as to implementation details.

share|improve this question

migrated from security.stackexchange.com May 11 at 22:11

This question came from our site for Information security professionals.

1  
Puppet? Chef? NIS? –  tylerl Apr 22 at 5:58
    
@edvinas - These talk about changes on the servers. The servers configuration will be static. I need to handle changes to the users systems. –  AllenKll Apr 22 at 13:16
    
@tylerl Puppet and Chef seems to be for configuring servers. Not managing key distribution to users. I'm not sure how I would implement NIS for this solution, can you explain? –  AllenKll Apr 22 at 13:20
    
It's not a proper answer, but more a suggestion, so I won't post an answer for that, but I think you can manage to authenticate ssh against kerberos, which could use ldap directory, to allow, or not user to access a given server. I'm sure about the kerberos stuff, not about the granularity though. Another idea is to use the AuthorizedKeysCommand against a database, which would ease the process of adding a user, if you don't want to get into kerberos or ldap. A simple php / mysql app should be able to help you, then the AuthorizedKeysCommand would juse use mysql cli. Hope this helps. –  aif May 11 at 22:41

3 Answers 3

up vote 2 down vote accepted

Except it puts its own key on to the server, where instead I need it to use the keys I provide it.

I've had a couple of ppl ask for that. I added a way to specify the key pair in the latest release.

https://github.com/skavanagh/KeyBox/releases

https://github.com/skavanagh/KeyBox#supplying-a-custom-ssh-key-pair

Let me know if you have any issues. Thx!

share|improve this answer
    
This is very close, and I will mark it as correct as this is the closest to an answer I've found. Except I need to specify a separate key-pair for each Profile of systems. –  AllenKll Jun 11 at 15:37

You could look at using LDAP with public keys http://code.google.com/p/openssh-lpk/

That would make it significantly easier to re-issue a key to a user if one gets compromised. Each user's private key can be either managed by that user or saved onto storage only they have access to (e.g. home directory).

share|improve this answer
    
This seems targeted to configure servers instead distributing keys to users. User's don't have private keys. There is one key on the server that all the users would use to access the server. –  AllenKll Apr 22 at 13:23
    
Ok, I clearly misunderstood your question, so the authorized_keys on your servers will be static and your not looking for a way to change them, but your looking for a method of distributing the corresponding private keys to ~60 users? –  Hybrid Apr 23 at 4:15
    
That is correct. I found Keybox. sshkeybox.com This almost does what I need. Except it puts its own key on to the server, where instead I need it to use the keys I provide it. –  AllenKll Apr 23 at 17:56

Check out Userify, manages user accounts, SSH keys, and sudo roles, and doesn't need a central directory server that can go down (locking you out of all your instances.. been there.)

It's pretty easy to deploy using AWS's User Data (under the Advanced tab of instance launch) or stick it right in the UserData script for an autoscaling group or whenever you're launching an instance by hand, which is great because it works before you even log in. (Or you can just paste the one-liner into your server console, but that's not nearly as fun..)

It supports Chef and stuff like that, too, and each user (developer/admin/etc) gets his own web login to update keys. decent interface, pretty painless.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.