What are some approaches or best practices for managing SSH access by many devops to many AWS instances? I'd like to have the ability to e.g. add or remove access for a user to multiple instances through a single simple and secure operation, instead of going instance by instance and adding/removing their public key from the authorized_keys. And of course, I wouldn't want the same private key to be used by more than one user...
2
-
Look into configuration management or LDAP.– ceejayozJan 31, 2016 at 18:52
-
2FreeIPA. Based on Kerberos and LDAP, is very flexible and has decent management interface.– Florin AsăvoaieJan 31, 2016 at 19:18
Add a comment
|
2 Answers
The two big methods here are:
- Use a central authentication system such as LDAP.
- Use a configuration management system to manage SSH keys and associated files.
The first isn't very Linuxy since it requires people to use a password on their first entry to a system. That said, it does allow large installations to work rather well.
The second can be engineered so access is granted via Pull Request or Merge Request into a code-repository, after code-review. A workflow software engineers understand rather well.
answered Feb 2, 2016 at 5:36
Check out userify.com. It's written by a hardcore security nut and is pretty much exactly the situation that you're describing.
Disclaimer: the creator is a friend of mine, but I don't get anything for recommending it.
