Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a server with multiple users which each have multiple authorized SSH keys. Is there any effective way (command line utility?) to keep track of which key belongs to who and to quickly remove/add keys (apart from ssh-copy-id)?

share|improve this question
1  
shell scripts can easily track login times from logs and manipulate the files in .ssh...I know that's not what you are looking for, so it's a comment not an answer –  hbdgaf Feb 10 '11 at 5:32
1  
Use the last part of each lines in .ssh/authorized_keys is intended for comments (from man sshd: "Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment."). And to answer the question, I use vim but any editor should do it. –  shellholic Feb 12 '11 at 21:39
    
Of course if every user do have separate user account, there is no problem, as long as all entries are in everyone's home folder (or actually in .ssh/authorized_keys, but anyway). –  Olli Feb 13 '11 at 19:33
    
@shellholic, you have a good answer. Post it so it can be marked as such :) –  djeikyb Feb 16 '11 at 8:02
    
@djeikyb ok, done, but I should complete a bit –  shellholic Feb 16 '11 at 10:10
add comment

3 Answers

You can use the last part of each lines in .ssh/authorized_keys is intended for comments. From man sshd:

Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.

And to answer the question, I use vim but any editor should do it.

My comments usually contains:

  • creation date
  • physical location: creation computer / USB stick (I prefer not to move private key but generate/revoke them and know where they are)
  • 1-2 words about purpose (for which login, for which client, for which script)
share|improve this answer
add comment

I'd checkout the Monkeysphere project. It uses OpenPGP's web of trust concepts to manage ssh's authorized_keys and known_hosts files, without requiring changes to the ssh client or server.

share|improve this answer
add comment

There's also ssh-import-id, which can securely import users' SSH public keys from Launchpad.net.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.