Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have a handful of developers and a dozen servers each with several accounts on them and manage our ssh public keys by manual ssh-copy-id.

Does anyone know of a tool/script to manage ssh authorizations to those hosts?

Some sort of central public-keys list, developer->account@server authorizations and means to deploy those keys with something like ssh-copy-id. I could think of some scripts that would do the job, but would be glad not to do so. And I couldn't find anything except complex Kerberos setups or some 'Universal SSH Key Manager' brochure.

share|improve this question
Simple, single user key-management is explained here: – flob Oct 5 '12 at 16:19
Sounds like a job for LDAP with all servers authenticating from there. – UtahJarhead Oct 5 '12 at 16:33
I know how to set up SSH to get rid of passwords, but that question shows now way to manage keys / account@server authorizations for more than one server/user... it just shows how to do the login without a password. – flob Oct 5 '12 at 16:52

3 Answers 3

up vote 2 down vote accepted

Wikimedia uses Puppet for this; see their admins.pp.

Kerberos is actually quite simple to set up.

share|improve this answer
That looks like a good start :) Thanks! – flob Oct 5 '12 at 17:19

I’ve been working on Geofront project. I think it could help you.

Geofront is a simple SSH key management server. It helps to maintain servers to SSH, and authorized_keys list for them. Read the docs for more details.


  • If the team maintains authorized_keys list of all servers owned by the team:

    • When someone joins or leaves the team, all lists have to be updated.
    • Who do update the list?
  • If the team maintains shared private keys to SSH servers:

    • These keys have to be expired when someone leaves the team.
    • There should be a shared storage for the keys. (Dropbox? srsly?)
    • Everyone might need to add -i option to use team's own key.
  • The above ways are both hard to scale servers. Imagine your team has more than 10 servers.


  1. Geofront has its own master key. The private key is never shared. The master key is periodically and automatically regened.
  2. Every server has a simple authorized_keys list, which authorizes only the master key.
  3. Every member registers their own public key to Geofront. The registration can be omitted if the key storage is GitHub, Bitbucket,
  4. A member requests to SSH a server, then Geofront temporarily (about 30 seconds, or a minute) adds their public key to authorized_keys of the requested server.
share|improve this answer

you may try secpanel. It has gui support for managing your keypairs and a gui for distributing keys to hosts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.