I want to have one place where I have defined ssh keys for my users. These users can be in different (multiple) roles on single server. So I defined ssh_authorized_key as virtual and then wanted to realize them in different roles. Example:

@ssh_authorized_key {
        tag     => ['deployer', 'developer', 'root'],
        key     => "xxx",
        type    => "ssh-dss",
        ensure  => present;
        tag     => ['deployer', 'root'],
        key     => "yyy",
        type    => "ssh-dss",
        ensure  => present;
        tag      => ['root', 'deployer'],
        key      => 'zzz',
        type => "ssh-rsa",
        ensure   => present;

And then realize them for multiple users on single node:

Ssh_authorized_key<| tag == 'root' |> {
    user    => 'root'

Ssh_authorized_key<| tag == 'deployer' |> {
    user    => 'deployer'

But puppet will install the certificates only for one user. I think that main concept of my solution is wrong. But I can't figure out how to install single certificate to multiple users?


You are correct that the main concept of your solution is wrong, but I think it is wrong far earlier than you suspect. The best practice is to not share accounts; each user should have an individual account and use sudo to perform tasks that require alternate privileges. If you honestly must share one or more accounts, then allow your users to sudo su - ACCOUNT instead of logging in directly as ACCOUNT. For example:

user { 'alice': groups => ['developer', 'deployer', 'root'] # other params... }
ssh_authorized_key { 'alice': #params }

Then add appropriate entries in your /etc/sudoers (also hopefully managed by puppet!):

# deployer group can run the deployment script without a password.
%deployer  ALL = NOPASSWD: /usr/local/bin/deploy
# developer group can run commands as 'developer'
%developer ALL = (developer) ALL
# or, if you actually *must* allow them to log in as 'developer'
%developer ALL = /usr/bin/su developer
| improve this answer | |
  • Although this does not answer my question. I admit that this is correct solution and everybody should do it this way. – Michal Bryxí Sep 13 '13 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.