0

I have a web application which takes users ssh-public key via the browser just like github or gitorious does. It grants ssh access to the user by placing the key in the users home directory.

Now I want to copy this key to other servers to grant access to the other servers for users. Is there any sane way of doing this and copying this ssh key on demand to other servers?

I am storing the public key in the database.

There is an ldap server which has accounts for all the users. There are a couple of servers in the backend like a git server, a test server, a deploy server etc. And the web application and git server are on the same node.

Now the key is getting added in the git server and I would like to place the ssh key automatically on test and deploy servers, so that they can login there. Heard of something called keychain but couldn't understand it totally. Will keychain help me to do the server-server communication? Hope I am putting it the right way now.

Improve this question
3
  • 1
    If you have key in your own database (which may be bad idea, after all), then what's the problem to get it?.. Is "secure server-to-server communication channels" a question?
    – keltar
    Oct 12, 2012 at 11:49
  • The public key is a file like any other - if you are creating home directories and accounts for these users across servers upon demand you can just add the key as part of that process. The public key is intended to be public, so the security concerns are low. It is difficult to understand what the question is from the description.
    – Paul
    Oct 12, 2012 at 12:59
  • Ok, There is an ldap server which has accounts for all the users. There are a couple of servers in the backend like a git server, a test server, a deploy server etc. And the web application and git server are on the same node. Now the key is getting added in the git server and I would like to place the ssh key automatically on test and deploy servers, so that they can login there. Heard of something called keychain but couldn't understand it totally. Will keychain help me to do the server-server communication? Hope I am putting it the right way now.
    – Medhamsh
    Oct 12, 2012 at 13:34

2 Answers 2

Reset to default
0

As you are using ldap for authentication, you could consider using the patch to ssh that allows authorised keys to be used during authentication. This way you don't need to distribute the keys at all.

http://code.google.com/p/openssh-lpk/

Otherwise, as you are using git, you could keep the user folders and authorised keys in git and do a git pull periodically to add them in.

Improve this answer
0

In ldap there is a schema for authenticating users over ssh and if you have your ssh version below 6.2 then you gotta patch it with "openssh-lpk", for openssh version 6.2 you dont need to patch. Once this setup is done the real problem of yours can be solved by using ssh-agent.

Improve this answer
1
  • What is the way to pull the ssh-key into the schema? It is not so scalable to add it manually for every entry. One of my web apps, takes the users keys and stores in its database. How can I make sure to populate that key in the ldap schema automatically w/o me adding it in the ldiff or schema?
    – Medhamsh
    Sep 14, 2013 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .