Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a server with multiple users which each have multiple authorized SSH keys. Is there any effective way (command line utility?) to keep track of which key belongs to who and to quickly remove/add keys (apart from ssh-copy-id)?

share|improve this question
1  
shell scripts can easily track login times from logs and manipulate the files in .ssh...I know that's not what you are looking for, so it's a comment not an answer –  hbdgaf Feb 10 '11 at 5:32
1  
Use the last part of each lines in .ssh/authorized_keys is intended for comments (from man sshd: "Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment."). And to answer the question, I use vim but any editor should do it. –  shellholic Feb 12 '11 at 21:39
    
Of course if every user do have separate user account, there is no problem, as long as all entries are in everyone's home folder (or actually in .ssh/authorized_keys, but anyway). –  Olli Feb 13 '11 at 19:33
    
@shellholic, you have a good answer. Post it so it can be marked as such :) –  djeikyb Feb 16 '11 at 8:02
    
@djeikyb ok, done, but I should complete a bit –  shellholic Feb 16 '11 at 10:10

4 Answers 4

You can use the last part of each lines in .ssh/authorized_keys is intended for comments. From man sshd:

Protocol 1 public keys consist of the following space-separated fields: options, bits, exponent, modulus, comment. Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.

And to answer the question, I use vim but any editor should do it.

My comments usually contains:

  • creation date
  • physical location: creation computer / USB stick (I prefer not to move private key but generate/revoke them and know where they are)
  • 1-2 words about purpose (for which login, for which client, for which script)
share|improve this answer

I'd checkout the Monkeysphere project. It uses OpenPGP's web of trust concepts to manage ssh's authorized_keys and known_hosts files, without requiring changes to the ssh client or server.

share|improve this answer

There's also ssh-import-id, which can securely import users' SSH public keys from Launchpad.net.

share|improve this answer

I am working on Geofront project. I believe it could help you.

Geofront is a simple SSH key management server. It helps to maintain servers to SSH, and authorized_keys list for them. Read the docs for more details.

Situations

  • If the team maintains authorized_keys list of all servers owned by the team:

    • When someone joins or leaves the team, all lists have to be updated.
    • Who do update the list?
  • If the team maintains shared private keys to SSH servers:

    • These keys have to be expired when someone leaves the team.
    • There should be a shared storage for the keys. (Dropbox? srsly?)
    • Everyone might need to add -i option to use team's own key.
  • The above ways are both hard to scale servers. Imagine your team has more than 10 servers.

Idea

  1. Geofront has its own master key. The private key is never shared. The master key is periodically and automatically regened.
  2. Every server has a simple authorized_keys list, which authorizes only the master key.
  3. Every member registers their own public key to Geofront. The registration can be omitted if the key storage is GitHub, Bitbucket,
    etc.
  4. A member requests to SSH a server, then Geofront temporarily (about 30 seconds, or a minute) adds their public key to authorized_keys of the requested server.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.