SSH: Best practices

Re:SSH: Best practices by rodionos on Sunday February 07, 2016 @04:19PM (#11054896)

Org question. We use a shared key and a shared account to manage our servers. When someone leaves the team we have to regenerate the key for the account. I'm sure it's not recommended, so what's a good way to manage ssh access in a team setting? I'd like avoid sharing the key so that access can be revoked from user without regenerating the key for everyone?

[ Parent | on HN ]

Re:SSH: Best practices by aris_ada on Sunday February 07, 2016 @04:22PM (#11054915)

Have each team member generate his own key. Copy everyone's key in a folder and have a script to generate an authorized_keys file. Use puppet or chef (or anything else) to dispatch the authorized_keys on every server.

A single shared key is a security disaster waiting to happen.

[ Parent | on HN ]

Re:SSH: Best practices by throwaway2048 on Monday February 08, 2016 @02:53AM (#11056858)

did you read the article? ssh certificates with revokation are a much more workable solution

[ Parent | on HN ]

Re:SSH: Best practices by aris_ada on Monday February 08, 2016 @03:02AM (#11056885)

I wrote the article.

[ Parent | on HN ]

Re:SSH: Best practices by Piskvorrr on Tuesday February 09, 2016 @09:57AM (#11065665)

There's the up-front cost of setting them up, and perhaps tool support (pubkey/agent auth is widely supported; X.509...not so much).

[ Parent | on HN ]

Re:SSH: Best practices by throwaway2048 on Tuesday February 09, 2016 @12:04PM (#11066767)

ssh certificates are not x.509, though they are designed around a PKI.

[ Parent | on HN ]

Re:SSH: Best practices by Piskvorrr on Wednesday February 10, 2016 @07:41AM (#11072321)

Thanks for the correction.

[ Parent | on HN ]

Re:SSH: Best practices by frutiger on Sunday February 07, 2016 @05:10PM (#11055161)

SSH actually supports the usage of certificates that you can use to sign individual keys with a finite lifetime and key revocation. For some reason, very few people know about this and assume SSL/TLS whenever you say "certificates".

You can read about this in the `CERTIFICATES` section of ssh-keygen(1).

[ Parent | on HN ]

Re:SSH: Best practices by deathanatos on Sunday February 07, 2016 @04:35PM (#11054976)

We have a shared account to manage servers as well. However, the individuals still have individual accounts, and individual SSH keys. They log in as themselves, and `sudo -iu` into the shared user. This can be done without giving the user root (i.e., sudo supports only giving access to the shared account).

It's still not a great setup, because it makes auditing a nightmare. (Unfortunately, a particular software package we use essentially requires it due to its bad architecture.)

[ Parent | on HN ]

Re:SSH: Best practices by Nelson69 on Sunday February 07, 2016 @05:23PM (#11055224)

This is interesting: http://serverfault.com/questions/653792/ssh-key-authenticati...

[ Parent | on HN ]