Re: Multiple authorized_keys2 files or how to achieve same effect.

On Thu, Sep 01, 2005 at 10:49:02AM -0400, Jeremy Eder wrote:
> My situation:  multiple admins needing root on hundreds of boxes.
>
> Currently:  using pubkeyauth on openssh (mostly bsd but linux and
> solaris too)
>
> Goal:  ease add/remove of credentials from machines (one-off or globally
> in our network)

Probably a better way to handle this is to install sudo on all the
machines in question, create accounts for all the admins on each of
the boxes on which they need them, and just have them log into the
machines as themselves, using sudo to do what they need to do.  This
also improves accountability, as you can see what they are doing quite
easily (assuming they don't just run a shell as root, but you can see
who is doing that, too).

> Each server may have a completely different (and still valid) list of
> users in the authkeys2 file.

This makes the above more complex, but presumably there is some rhyme
or reason, some kind of organization to the machines and who gets
access to them.  If so, you can script the account creation and/or
just maintain different master password files for each group of
machines...


-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

pgp7N74ym0yGV.pgp
Description: PGP signature