Is it possible to have ssh public key id_dsa.pub stored on a centralized server

Question

I would like to know if it is possible to have the public key used for ssh login to be stored on a centralized server and have all the servers i login to point to this centralized server for obtaining my public key. So that i don't have to copy my public key to each of the server i login and if that is possible how do i use ssh-agent and keychain to use in combination, to reduce the number of times i need to punch in to login to the servers. I don't want to use password-less private key as i am very much worried about my credentials falling into wrong hands.

Answer 1

Another solution would be exported resources and puppet.

Procedure

1. place the public ssh key on the puppet server
2. configure exported resources to place the file in $HOME/.ssh/authorized_keys
3. collect the keys on all the other boxes

This requires a centralized puppet infrastructure with a server. Exported resources are only available with a puppet server (which by coincidence is the default setup in nearly all of the howtos and documentation)

References

• https://puppet.com/docs/puppet/latest/lang_exported.html
• https://projects.puppetlabs.com/projects/puppet/wiki/Module_Ssh_Auth_Patterns

I'd prefer that over patching SSH since you can work with you default distro package this way without having to resort to you package (which then introduces the problem of installing that on all hosts, even with a repository you need to configure yum or apt to know about it).

Puppet too requires touching every single host. But only one time, after that you can manage everything from you workstation. And yes: it could be done with chef, bcfg2 or cfengine (or a fancy ssh for loop) I just happen to like puppet more than the other options.

Also: This is not a 5 minutes and I'm done solution. But once you manage your hosts you'll aks yourself why it all started with ssh keys, you won't need to log in after all (in a perfect world)

EDIT: Just read in the comment above/below (depending on your sorting) you don't have control over everything. I suggest you take a good look at it and decide wether it's worth the effort of introducing something like this. Fabric might be an alternative since you can run commands on a ton of hosts with a single password entry, therefore entering you password only once and distribute the key, then run fabric even without password if you find further uses for it.

Answer 2

One way to address this is by storing your public ssh keys on an ldap server. I'm not sure if any ssh implementations have this built in, but you can use patch OpenSSH with OpenSSH-LPK to make that work. I haven't tried it, and presumably that only works if you've already got an ldap infrastructure set up.

Answer 3

You could mount your home directory through automount. This way you will have one copy of your public key following you to what ever server you log in to.

Answer 4

Two answers:

1. Yes, theoretically you could do it with some really ugly symlinks and a NFS server. Use the /etc/skel directory to copy a symlink to some NFS mounted directory for .ssh. This can have all sorts of other really, really nasty repercussions, and is not something you should do.

2. If what you are looking to do is to be able to login to any machine you have privileges for passwordlessly after logging in once, and you already have an LDAP server setup, you and your LDAP administrator should look into combining LDAP with Kerberos. Once that is setup, you will have what is known as a Single Sign-On (SSO) solution - once you have been granted a "ticket" to login to one machine, that ticket can be forwarded securely to any other machine that you login to.