Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company intends to hire an external contractor for some dev-ops jobs on our EC2 servers. We use Ubuntu accessed using a .pem certificate file.

For obvious reasons, I do not want to share my .pem key with an outsider - if the key is lost, anyone on the internet can access my machines.

I can add the contractor's ssh key to the .ssh/authorized_keys on all the servers, but that would be tedious and new servers won't be accessible by him unless I change the template server image.

Is there an easier way to grant temporary, revokable access to EC2 machines?

share|improve this question
You say you use keys to access your servers, but it's not clear in your question whether the public keys are setup in a per-user basis(i.e. everyone with access to the server has an account) or you access the same accounts on the servers. – dawud May 18 '14 at 15:50
If adding an SSH authorized key is tedious, you need a configuration management system like Ansible. – ceejayoz May 18 '14 at 15:58
I am the only employee for now, so I have my .pem file on all the machines. For a safety measure, I have also placed my own file on all of them. – Adam Matan May 18 '14 at 15:58
What I'm asking is if you have your own account or just log as root everywhere. – dawud May 18 '14 at 15:59
What safety do you think that keeping your public key on your servers affords you? – EEAA May 18 '14 at 19:07
up vote 2 down vote accepted

If there is a centralized authentication system in place:

Yes, this can be done quite easily, for obvious reasons. Simply enable/disable the contractor's account in your centralized authentication system (LDAP, Kerberos, AD, ...). You can have a personal account for this specific contractor, or decide to use a generic third-party-people account. The former can retain auditability, if that matters.

If there is not a centralized authentication system in place:

Create a key pair for the contractor and place it in your machines using your configuration management of choice. If you don't have one, you can use ansible's shell module, which requires nothing at the client side, or, as a last resort, you can still use mussh or script yourself something around ssh-copy-id(1). Remove the key, revoke access in sshd_config, or both, once she/he has finished her/his job.

share|improve this answer
I'm so glad to see ansible being presented in more and more answers here. I've been using it for the past 4 months or so, and am completely smitten by it. :) – EEAA May 18 '14 at 20:07
In this case, the agentless architecture of ansible is very convenient. – dawud May 18 '14 at 20:27
+1 Thanks. Do you know any recommended getting-started guide to ansible's shell? – Adam Matan May 19 '14 at 6:03
The project's online documentation is quite good. – dawud May 19 '14 at 6:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.