Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

My company has some remote Ubuntu servers. The access to these servers is controlled by ssh keys. Managing these keys is quite a pain, especially when an employee leaves or joins the company.

Is there a good solution for central key management on Ubuntu?

Adam

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Landscape

Canonical's Landscape makes it very easy to manage many machines at once.

You could just have a centralised key store and, on demand, push out changes to every machine's known_hosts file.

Rsync

Alternatively, if you don't want to use Landscape, how about simply synchronising the known_hosts via rsync? I'm not all that familiar with all this enterprisy business, but it should work very well.

Assuming the company's computers get shut down every night, i would do this:

  • Have on some server a centralised known_hosts file that you manage manually.
  • write a very simple program that, at boot time, tries to fetch that file and replace the current one
  • on the administrative side, test all changed to the master-file before pushing it out, which you do by just replacing the one all the clients try to access.

you could use RCS, an old sysadmin's favourite, to manage different versions of your master-file.

Note that many sysadmins will tell you that centralising things is a security risk, and generally not a great idea.

LDAP

Now, I'm not a sysadmin (and therefore not to be trusted on this matter). You really should ask this question on serverfault

LDAP seems to come up there quite a lot. Here's a bit information about fetching SSH Public Keys from LDAP, and here's some more.

This question might also be of interest to you.


I hope this is helpful. As you've discovered yourself, managing ssh access in large setups really is quite complicated.

share|improve this answer
    
Look into setting LDAP, and mount the user's $HOME via NFS. When the user leaves the company, delete his LDAP account and you're done. (user needs to exist before verifying ssh key) –  csgeek Nov 22 '10 at 15:10
1  
I think he meant authorized_keys not known_hosts, though both are very important. –  SpamapS Nov 28 '10 at 1:03
    
Made it community wiki, because - as I said - I'm not a sysadmin. Edit this answer to make it better. –  Stefano Palazzo Nov 28 '10 at 1:26

It is possible to use certification authorities and revoke markers in the "known hosts" file. Another option is probably to use some "enterprise" PAM authentication method instead.

share|improve this answer
2  
A link would be extremely useful. –  Adam Matan Nov 22 '10 at 9:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.