2

Is there a way to automate to create SSH keys for large number(Nearly 9000) of servers for almost 30 users

7
  • 2
    Can you describe in detail what you really need done?
    – ewwhite
    Oct 10, 2014 at 10:17
  • All the servers belong to differnt customers with different servers with different login.. Can we make it a uniform arrangement without any compromise of security for all the customers in same manner.. My goal is to automate file transfer after creating ssh keys
    – Gokul
    Oct 11, 2014 at 12:33
  • 1
    How do you manage/monitor the servers now? If you don't have a method for doing that, I can't imagine how you can work with 9,000 systems!
    – ewwhite
    Oct 11, 2014 at 12:34
  • In short , all the servers are managed individually based on the demand for UnifiedCommunication and contact center upgrade ( call center, Enterprise Call handling softwares) by 30 different users .We transfer the upgrade files,do infrastructure verification(Basic Checks to validate if the system is ready for software upgrade ) on the server and finally we perform the upgrade for the given servers for different customers based on the their maintenance window . I would like to understand can we do automation on file transfer and backups by creating ssh keys for all the customers
    – Gokul
    Oct 12, 2014 at 10:49
  • 2
    You may want something like puppetlabs.com.
    – ewwhite
    Oct 12, 2014 at 11:02

5 Answers 5

11

If you have 9,000 servers under the same management, you'd likely have some form of configuration management in place. That could be in the form of Puppet, Chef, Ansible, etc. You can distribute public keys that way.

For 30 users, this is also something that could be handled via central directory authentication (LDAP, Active Directory).

1
  • Thanks a lot for your answer.. Can you see my comments above for your question
    – Gokul
    Oct 11, 2014 at 12:35
10

You probably do it wrong.

Each user (of the 30) has to create his own (thus private!) key. The public key of each user goes to every server (of the 9000) he should have access to.

Don't do it the other way around.

8

If your servers use decently recent openssh version (> 5.4 I think), you should take a look at the certificate-based authentication there. You'll find an introduction to this feature here: http://neocri.me/documentation/using-ssh-certificate-authentication/ or in ssh package documentation.

To make short,

  • users generate their private/public key pair.
  • you (admin) create one or more SSH CA-certificate (your-user-ca) that you will use to sign users public keys.
  • you (admin) sign users public keys using with one CA-certificate. for example "ssh-keygen -s your-user-ca -I "username" -Z username -V +52w user-key.pub". This creates a user-key-cert.pub you need to send back to appropriate user.
  • you (admin) install the trusted SSH CA-certificate in sshd config of your 9000 servers. You don't need to declare each public key of each user.
  • users can connect.

hth.

2

I would use Puppet to distribute the public host keys to all machines, so that users can log in and not have to maintain a known_hosts file (as long as they are SSHing within these 9,000 machines).

Host keys:

  1. Have each node create a public/private key. It is safest to generate a key on the machine that uses it, that way the private key never leaves the host and doesn't need to be secured.

  2. Use Puppet's "exported resources" feature to send the Private Key to a central database.

  3. On all nodes, pull in the "exported resources" to generate the known host keys file on this machine. Any new node will appear in all the other nodes within 2 puppet runs.

Here's an example of exported resources.

Here's a specific example of distributing SSH host keys.

User access:

You can use Puppet to set each hosts's sshd_config file to trust host keys and such, or whatever you want the policy to be:

augeas { 'sshd_config': context => '/files/etc/ssh/sshd_config', changes => [ 'set PermitRootLogin without-password', 'set ANOTHERSETTING VALUE', ], }

User accounts:

Puppet can also create the 30 accounts on all machines. I like the accounts module that comes with Puppet Enterprise. However it is easy to do if you have the open source version. Here's an example of how to do that.

Some general advice:

9,000 machines is a large environment. You'll want to keep your Puppet files in Git, use a Continuous Integration and testing framework such as Jenkins CI, and have a test environment that you try things out before you push. How we do this at Stack Exchange, Inc is documented in this blog post.

1
  • Thanks a lot Tom for a much detailed explanation. I really appreciate your help.I would review these documents and shoot up with queries if I would have .:)
    – Gokul
    Oct 12, 2014 at 11:06
1
  1. Have each user create a public/private key.

  2. Distribute the public key for each user to each server

  3. Profit.

All kidding aside, this is a classic configuration management problem. Consider that in addition to publishing the key you also need to at least create the home directory and the user accounts as well as the individual .ssh directories.

Instead of trying to solve all 30/9000 at once I'd start with automating one user on one server and build from there.

See generally: Puppet, Chef, Salt, Ansible for pointers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .