Re: Multiple authorized_keys2 files or how to achieve same effect.

From: Derek Martin (code_at_pizzashack.org)
Date: 09/01/05

  • Next message: Mark Senior: "RE: Multiple authorized_keys2 files or how to achieve same effect."
    Date: Thu, 1 Sep 2005 11:40:04 -0400
    To: secureshell@securityfocus.com
    
    
    

    On Thu, Sep 01, 2005 at 10:49:02AM -0400, Jeremy Eder wrote:
    > My situation: multiple admins needing root on hundreds of boxes.
    >
    > Currently: using pubkeyauth on openssh (mostly bsd but linux and
    > solaris too)
    >
    > Goal: ease add/remove of credentials from machines (one-off or globally
    > in our network)

    Probably a better way to handle this is to install sudo on all the
    machines in question, create accounts for all the admins on each of
    the boxes on which they need them, and just have them log into the
    machines as themselves, using sudo to do what they need to do. This
    also improves accountability, as you can see what they are doing quite
    easily (assuming they don't just run a shell as root, but you can see
    who is doing that, too).

    > Each server may have a completely different (and still valid) list of
    > users in the authkeys2 file.

    This makes the above more complex, but presumably there is some rhyme
    or reason, some kind of organization to the machines and who gets
    access to them. If so, you can script the account creation and/or
    just maintain different master password files for each group of
    machines...

    -- 
    Derek D. Martin
    http://www.pizzashack.org/
    GPG Key ID: 0x81CFE75D
    
    



  • Next message: Mark Senior: "RE: Multiple authorized_keys2 files or how to achieve same effect."