centralized audit server solution for mutiple server management [closed]

Question

We have dozens of Linux servers, and several developers, and each of the developer covers parts of the servers.

Currently each server has an admin account, if someone want's to manage that server, his pubkey will be added to the server admin account's ssh authorized_keys, so he can access and edit this server. But is not a good solution:

• Each server's ssh port should not open to the public, it is dangerous.
• If one server is accessed by multiple person with the same account, we cannot tell who is logged in.
• It is hard to remove or revoke someone's ssh key for those server's.

So I think there should be a better solution:

• One centralized ssh audit and administration server.
• Each server only allow ssh port access from this server.
• This server can manage users account, and access privileges for each server.
• Developer use this audit server to do server ops, all the actions should be recorded and alert others when he is doing something dangerous.
• If this server is down, there are emergency access solution.

If anyone knows any solution like this? Thanks.

Answer 1

Each server's ssh port should not open to the public, it is dangerous.

This is not true, especially if you are using keys with good pass phrases and have disabled password logins (you have haven't you).

If one server is accessed by multiple person with the same account, we cannot tell who is logged in.

In your current scenario this is correct - shared accounts are not a Good Thing. However with suitably verbose sshd logs you can see who logged in when.

It is hard to remove or revoke someone's ssh key for those server's.

There are tools available that will allow this to be automated - puppet, chef, ansible etc - configuration management tools in general.

A general solution to you problem is to

• Provide everyone with their own account (automate it with a configuration management tool)
• Stop using shared accounts.
• Give everyone suitable sudo access.
• Use rsyslog to ship all the logs to a central log server.

This allows you to log the individual users accessing the system. With suitable education you can also log individual users use of the administrative account.

Answer 2

Maybe checkt out Monkeyspere. It enables you to setup a central keyserver where you can revoke user keys (think of it as Web of Trust for ssh keys)

http://web.monkeysphere.info/getting-started-admin/

Answer 3

Don't provide developers root access on servers! Use some central management tool like chef or cfengine3 and let developers to write teplates, which are applied to servers. You can push those templates to Git/SVN/Whatever to track changes.

Also, you can use VPN to access your servers. Your servers don't need to be open to whole world, it don't have to have public ip either.