Re: Multiple authorized_keys2 files or how to achieve same effect.

From: Derek Martin (code_at_pizzashack.org)
Date: 09/01/05

  • Next message: Mark Senior: "RE: Multiple authorized_keys2 files or how to achieve same effect." 
    Date: Thu, 1 Sep 2005 11:40:04 -0400
To: secureshell@securityfocus.com

    On Thu, Sep 01, 2005 at 10:49:02AM -0400, Jeremy Eder wrote:
    > My situation: multiple admins needing root on hundreds of boxes.
    >
    > Currently: using pubkeyauth on openssh (mostly bsd but linux and
    > solaris too)
    >
    > Goal: ease add/remove of credentials from machines (one-off or globally
    > in our network)

    Probably a better way to handle this is to install sudo on all the
    machines in question, create accounts for all the admins on each of
    the boxes on which they need them, and just have them log into the
    machines as themselves, using sudo to do what they need to do. This
    also improves accountability, as you can see what they are doing quite
    easily (assuming they don't just run a shell as root, but you can see
    who is doing that, too).

    > Each server may have a completely different (and still valid) list of
    > users in the authkeys2 file.

    This makes the above more complex, but presumably there is some rhyme
    or reason, some kind of organization to the machines and who gets
    access to them. If so, you can script the account creation and/or
    just maintain different master password files for each group of
    machines... 

    -- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

  • Next message: Mark Senior: "RE: Multiple authorized_keys2 files or how to achieve same effect."

    Relevant Pages

    • Re: Psystar Is Willing To Fight
      ... go in their machines, only the ones that work best together. ... Expecting Leopard to not have an issue or two with it would ... like asking Vista to not have problems with 4+ year old wintel boxes. ... Powermac G5's are having problems with. ...
      (comp.sys.mac.advocacy)
    • XP Network Browse Problems
      ... Do the boxes still ping OK? ... >Win2000 Server, and workstations combined with one Xp ... If the Win2000 machines boot first, ... >boxes in the network neighborhood, ...
      (microsoft.public.windowsxp.network_web)
    • Re: HP : Massive strike and protest march today
      ... stuffing the boxes is all done by yet ... > has has to load packaging material into the boxing machines. ... robots production has gone up. ... replacing the humans with machines increased production ...
      (comp.os.vms)
    • Re: IPB sold ?!?
      ... will continue to be made by both IPB as a manufacturer and Pinball ... Taking all the parts overseas has to be co$ting a pretty penny. ... Seeing all those boxes and boxes that appear to have never been ... From what I understand too the spare parts issue in Aus has been festering for years, with more and more hacks being done to the machines to replace truly worn out parts. ...
      (rec.games.pinball)
    • Re: Anybody got a clever ideaq for computer caddy?
      ... >> If you have and need that many boxes (ie, ... I used trailing-edge machines from ... Rack mount only works well if the machines are designed for rack mount. ... You mentioned a KVM setup. ...
      (alt.home.repair)
    • Quantcast