Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is one of those "Surely this already exists, and if not, I damn well better build it!" moments.

Here's my problem: I run a devteam, of around 10 individuals. Each of us has our own private key(s). When I go set up a new server for us, I have to import all of their keys to it. And if we start working with a contractor, I have to get his or her key too, and then import it and place it in .ssh/authorized_keys on the server.

Ideally I'd like to be able to do something along the lines of:

import_key allegroconmolto

And it would contact a public repository of public keys, see if there was a user named allegroconmolto, and if so, import their key and add it to my authorized_keys. Adding future users would then be as simple as running import_key for them. I could then scp the authorized_keys file to all my servers and be done!

This seems so obvious that I feel like it surely must exist somewhere.

share|improve this question
    
How do I know that the public key in that repository is really allegroconmolto's? –  Rhys Gibson Nov 18 '11 at 0:54
    
Building one yourself will be tough since people would have to trust you to deliver the correct keys. If you provide a public key that corresponds to a private key known by you, you could easily log into the server yourself. –  Dennis Nov 18 '11 at 1:13
    
Hmm, good point, for sure. I can't really think of a good way around it, either. :| I suppose getting it directly from the keyholder is still the best method. –  tkrajcar Nov 18 '11 at 2:56

1 Answer 1

up vote 1 down vote accepted

LDAP servers are often used for this purpose - you indicate which ldap server you trust and which entities you trust... then you have your server services look up credentials as necessary in the server. It's probably more effort than it's worth in your dozen user scenario . A simple shell script that adds new keys to the right file (authrized_keys somewhere) is probably best -> of course that shell script is sensitive... cat < emailedPublicKey >> somewhere/authorized_keys is a reasonable solution at your scale IMO.

If you do want the LDAP route these will get you on your way:

Note that you don't get out of the problem of managing trust since you still have to indicate who you trust or how to determine who you trust since you have to either define a mapping to a third party server or maintain your own server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.