Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a web application which takes users ssh-public key via the browser just like github or gitorious does. It grants ssh access to the user by placing the key in the users home directory.

Now I want to copy this key to other servers to grant access to the other servers for users. Is there any sane way of doing this and copying this ssh key on demand to other servers?

I am storing the public key in the database.

There is an ldap server which has accounts for all the users. There are a couple of servers in the backend like a git server, a test server, a deploy server etc. And the web application and git server are on the same node.

Now the key is getting added in the git server and I would like to place the ssh key automatically on test and deploy servers, so that they can login there. Heard of something called keychain but couldn't understand it totally. Will keychain help me to do the server-server communication? Hope I am putting it the right way now.

share|improve this question
1  
If you have key in your own database (which may be bad idea, after all), then what's the problem to get it?.. Is "secure server-to-server communication channels" a question? –  keltar Oct 12 '12 at 11:49
    
The public key is a file like any other - if you are creating home directories and accounts for these users across servers upon demand you can just add the key as part of that process. The public key is intended to be public, so the security concerns are low. It is difficult to understand what the question is from the description. –  Paul Oct 12 '12 at 12:59
    
Ok, There is an ldap server which has accounts for all the users. There are a couple of servers in the backend like a git server, a test server, a deploy server etc. And the web application and git server are on the same node. Now the key is getting added in the git server and I would like to place the ssh key automatically on test and deploy servers, so that they can login there. Heard of something called keychain but couldn't understand it totally. Will keychain help me to do the server-server communication? Hope I am putting it the right way now. –  Medhamsh Oct 12 '12 at 13:34
add comment

2 Answers

up vote 0 down vote accepted

As you are using ldap for authentication, you could consider using the patch to ssh that allows authorised keys to be used during authentication. This way you don't need to distribute the keys at all.

http://code.google.com/p/openssh-lpk/

Otherwise, as you are using git, you could keep the user folders and authorised keys in git and do a git pull periodically to add them in.

share|improve this answer
add comment

In ldap there is a schema for authenticating users over ssh and if you have your ssh version below 6.2 then you gotta patch it with "openssh-lpk", for openssh version 6.2 you dont need to patch. Once this setup is done the real problem of yours can be solved by using ssh-agent.

share|improve this answer
    
What is the way to pull the ssh-key into the schema? It is not so scalable to add it manually for every entry. One of my web apps, takes the users keys and stores in its database. How can I make sure to populate that key in the ldap schema automatically w/o me adding it in the ldiff or schema? –  Medhamsh Sep 14 '13 at 12:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.