Re:Show HN: SSH Permit A38 – Central Managment and Deploymen...
by jmcnulty on Monday March 19, 2018 @11:06PM
(#16625709)
You're much better off using AuthorizedKeysCommand as vertex-four suggested, and ditch passwords completely. It just needs to return the SSH public key of the login user. You can get that from any backend you like. If you have an LDAP server, great. But it doesn't have to be anything fancy; you could pull the user's key off a web server!
Distributing accounts and SSH keys via any configuration management system is clunky by comparison, and scales badly when you get to many hundreds of users and thousands of servers.
Re:Show HN: SSH Permit A38 – Central Managment and Deploymen...
by lima on Monday March 19, 2018 @05:14AM
(#16617048)
It doesn't. A bit faster maybe.
Ansible is perfect for deploying SSH keys.
Re:Show HN: SSH Permit A38 – Central Managment and Deploymen...
by mdekkers on Monday March 19, 2018 @01:39AM
(#16616364)
Nice. I do the same, with Saltstack. I manage all my users' access, including account creation and removal, password setting, and key management. Easy peasy.
Re:Show HN: SSH Permit A38 – Central Managment and Deploymen...
by tr0ut on Sunday March 18, 2018 @07:35PM
(#16615167)
Can you post an example of this? Link works too.
Re:Show HN: SSH Permit A38 – Central Managment and Deploymen...
by trashcan on Sunday March 18, 2018 @08:04PM
(#16615285)
Relevant documentation: http://docs.ansible.com/ansible/latest/authorized_key_module...
With Ansible, one can put the SSH keys into a .yml file in a format that is very similar to the examples in the OP, then the authorized_key module can be used to ensure that the key is present (or absent) on the remote servers. It's really-really trivial. Maybe the difference is that you can paste the SSH key into the CLI instead of a file... hm.