Suppose I have 5 users and 100 Linux machines with remote shell enabled. How do I set the environments up to allow these few users to log in to any of the machines with the same credentials?


Set up LDAP domain

By using an LDAP domain every authentication request to any machine is redirected to the domain controller. As far as I know, some Linux distros can join a Windows domain, if you have already one active. With this you have full centralized control over all the users in the network. You can add and remove users immediately from a single machine.


  • Easiest to maintain
  • Immediate effect of user management
  • Very useful and cheap if you have an already active domain in your company
  • Integrated with common domain management software (ie. if you use Windows)


  • If the LDAP controller is not clustered, that would be a single-point-of-failure, so you have to take into account more servers
  • (continued) The extra server(s) for LDAP and cluster makes the solution more expensive
  • Slightly difficult to set up if you don't have a domain controller already running
  • AFAIK you can't use public key authentication

Distribute SSH keys from a centralized machine

This is very useful when you want to use stronger authentication with public keys. You can upload all the users' keys on a single box that runs a Cron job scping the pubkeys to the correct home directories at certain time intervals


  • Fault tolerant. Any number of servers can crash but the available machines won't be affected
  • Easiest and cheapest to setup


  • If you have more than "five" users, ie. you are working on a large corporate network, user management is extremely difficult
  • (continued from above) user creation, deletion, etc. must be done for each server, usually with a script that replicates commands
  • Public keys are updated in delay if you don't manually run the script

Mount the home directories in a shared network drive (NFS, SSHFS...)

This has the advantage of real-time effects of modification of public keys (since they are always read from network share). Also, if you make /etc/shadow a symlink to a shared drive you have real-time user management from your controller


  • Not many except real-time modifications
  • Whole home directory is shared across servers (it often comes handy, believe me...)


  • Fault tolerant as the LDAP domain. You need to replicate the home directories or you cannot authenticate
  • Trickier than both the solutions to set up and maintain
  • 2
    I highly doubt you can symlink /etc/shadow to a network volume is going to work. In fact, I suspect that would result in an un-bootable system. – Zoredache May 26 '12 at 7:27
  • Thanks. That part of the answer doesn't come from real-world experience. I believe why, but I didn't think when I wrote the text: that file is probably read before network services (consequently NFS services) are started up. – usr-local-ΕΨΗΕΛΩΝ May 26 '12 at 20:07
  • 3
    You can absolutely use key auth in combination with LDAP. PAM will use the LDAP password for things like the sudo password, but will still look in the ~username/.ssh/authorize_keys when connecting with SSH. Additionally, newer versions of OpenSSH are able to pull public keys directly out of LDAP. – EEAA May 26 '12 at 21:57
  • 1
    There are a number of flaws in this. There are free clusterable LDAP servers (openLDAP being the most common). Configuration Management systems like Puppet or Chef could easily distribute the ssh keys (and configure systems to auth to LDAP or whatever). – Bill Weiss May 28 '12 at 13:06
  • @Bill Weiss: Mentioning a Windows domain does not mean it works only with Windows. Many organizations already own a Windows AD controller, so the compatibility encourages them to implement this technique. Of course your contribution is very appreciated. I must rephrase the single-point-of-failure thing about the DC. Of course you can cluster it, but it gets more expensive (you need additional 2 or 3 machines to the previous 100), I almost meant the opposite – usr-local-ΕΨΗΕΛΩΝ May 28 '12 at 20:55

Below is how a large organization does it with Puppet and SSH keys. The puppetmaster distributes the user accounts, ssh settings directory for each user, and sets a password for each user.


This can be replicated in any config management system, not just Puppet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.