1

I have an AWS ubuntu server. Let's call the Key File "root-key.pem".

Let's suppose (for this example) that I have ten employees and we add a new employee every month and we let go of an existing employee every month. What would be the suggested way to enable users to access the server with admin credentials? They would need to be able to run sudo or have something like root privileges to be able to modify databases, ports, push/pull to git, etc.

  1. The 'easiest' way to do this would be to give everyone access to the "root-key.pem" file, but then whenever an employee is let go, we would need to create a new file and then make sure all existing employees have access to it (and perhaps any down time where a developer may not have access to it, or be waiting on it, etc.).

  2. The preferred way I think would be to create a user for each person (sudo adduser travis) and then add them to the sudoers file and add their pem key to .ssh/authorized_keys. This is the path I tried to implement. It works in that it gives the user access to the server and they can run sudo, however it's a nightmare when people are trying to push/pull to git (GitHub).

What would be the best way to accomplish #2? Or is this a very difficult item to implement, and #1, though it is a bit sloppier and inconvenient when someone is let go, is the preferred way to go for all but very large organizations?

  • 1
    Why is #2 a nightmare when pushing/pulling from github? – 0xF2 May 28 '18 at 22:06
  • @0xF2 to be honest, it's that I haven't been able to implement it properly. Even doing something clumsy like sudo chmod -R 777 .git/ doesn't work when other users try pulling. The original github repository is by the 'ubuntu' user, and all other users have been running into permission errors when trying to push/pull with their usernames. I guess it's more my limitations in doing this and it being a 'nightmare'. Could you please suggest how to go about this? – David542 May 29 '18 at 3:26
  • Typically one uses Etchkeeper to automatically track config changes before package operations. A nice trick is also to have an automated daily commit. A nice strategy is presented on this similar question: superuser.com/questions/1037211/… – 0xF2 May 30 '18 at 2:19
  • 2
    For git, during git init, make sure to use something like --shared=group to be able to have the same repository available read/write for multiple users (as long as they are in the same Unix group). Done correctly you never have to fiddle with Unix rights on the repository anymore afterwards. See its manual for more options. – Patrick Mevzek May 30 '18 at 15:10
  • In security, shared "secrets" like your "root-key.pem" are automatically a red flag. It lowers auditability and like I say "owned by everyone, managed by noone" (in case of problems, everyone will kind of say it is someone else). I am not sure to have understood what this key is, but in general, avoid cases where it is shared or needs to be changed as soon as there are changes in personnel. – Patrick Mevzek May 30 '18 at 15:12
0

You should have a key rotation strategy for your root-key.pem anyway. In the event someone potentially loses this key. However, number 2 is generally the right way to go about this. Credential sharing should never be the recommendation although I dont doubt it happens often. There are a lot of ways to potentially implement and manage number 2. Some type of directory service is the most common, but it isnt the only option. You should consider some type of configuration management to handle either 1 or 2 so that it reduces the overhead for your team.

0

Generally Speaking go for the #2.

In #1 when someone compromises the key every user has to rotate keys, instead if everyone has his own key only the affected user needs to do it and can be removed from the admin group.

Also in #2 you avoid to manage and transfer private keys, everyone can use is personal keys and you only need to know the public part.

Yet #2 is easily scriptable if you have programmatic access to the users public keys you can build an script or use some configuration management software to retrieve it from a public server. For example the public keys of a github user are exposed in https://github.com/<user>.keys you can write a script that grab the github keys, write on the associated authorized_keys of the user and give the user admin privileges only knowing your user's github names.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.