My company has some remote Ubuntu servers. The access to these servers is controlled by ssh keys. Managing these keys is quite a pain, especially when an employee leaves or joins the company.

Is there a good solution for central key management on Ubuntu?




Canonical's Landscape makes it very easy to manage many machines at once.

You could just have a centralised key store and, on demand, push out changes to every machine's known_hosts file.


Alternatively, if you don't want to use Landscape, how about simply synchronising the known_hosts via rsync? I'm not all that familiar with all this enterprisy business, but it should work very well.

Assuming the company's computers get shut down every night, i would do this:

  • Have on some server a centralised known_hosts file that you manage manually.
  • write a very simple program that, at boot time, tries to fetch that file and replace the current one
  • on the administrative side, test all changed to the master-file before pushing it out, which you do by just replacing the one all the clients try to access.

you could use RCS, an old sysadmin's favourite, to manage different versions of your master-file.

Note that many sysadmins will tell you that centralising things is a security risk, and generally not a great idea.


Now, I'm not a sysadmin (and therefore not to be trusted on this matter). You really should ask this question on serverfault

LDAP seems to come up there quite a lot. Here's a bit information about fetching SSH Public Keys from LDAP, and here's some more.

This question might also be of interest to you.

I hope this is helpful. As you've discovered yourself, managing ssh access in large setups really is quite complicated.

  • Look into setting LDAP, and mount the user's $HOME via NFS. When the user leaves the company, delete his LDAP account and you're done. (user needs to exist before verifying ssh key) – csgeek Nov 22 '10 at 15:10
  • 1
    I think he meant authorized_keys not known_hosts, though both are very important. – SpamapS Nov 28 '10 at 1:03
  • Made it community wiki, because - as I said - I'm not a sysadmin. Edit this answer to make it better. – Stefano Palazzo Nov 28 '10 at 1:26
  • How do you do this with Landscape? I don't see the option. – vcardillo Sep 3 '15 at 6:46

It is possible to use certification authorities and revoke markers in the "known hosts" file. Another option is probably to use some "enterprise" PAM authentication method instead.

|improve this answer|||||
  • 2
    A link would be extremely useful. – Adam Matan Nov 22 '10 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.