Public key repository - does this exist?

4

1

This is one of those "Surely this already exists, and if not, I damn well better build it!" moments.

Here's my problem: I run a devteam, of around 10 individuals. Each of us has our own private key(s). When I go set up a new server for us, I have to import all of their keys to it. And if we start working with a contractor, I have to get his or her key too, and then import it and place it in .ssh/authorized_keys on the server.

Ideally I'd like to be able to do something along the lines of:

import_key allegroconmolto

And it would contact a public repository of public keys, see if there was a user named allegroconmolto, and if so, import their key and add it to my authorized_keys. Adding future users would then be as simple as running import_key for them. I could then scp the authorized_keys file to all my servers and be done!

This seems so obvious that I feel like it surely must exist somewhere.

tkrajcar

Posted 2011-11-18T00:40:18.083

Reputation: 152

How do I know that the public key in that repository is really allegroconmolto's? – Rhys Gibson – 2011-11-18T00:54:09.307

Building one yourself will be tough since people would have to trust you to deliver the correct keys. If you provide a public key that corresponds to a private key known by you, you could easily log into the server yourself. – Dennis – 2011-11-18T01:13:43.713

Hmm, good point, for sure. I can't really think of a good way around it, either. :| I suppose getting it directly from the keyholder is still the best method. – tkrajcar – 2011-11-18T02:56:24.287

Answers

1

LDAP servers are often used for this purpose - you indicate which ldap server you trust and which entities you trust... then you have your server services look up credentials as necessary in the server. It's probably more effort than it's worth in your dozen user scenario . A simple shell script that adds new keys to the right file (authrized_keys somewhere) is probably best -> of course that shell script is sensitive... cat < emailedPublicKey >> somewhere/authorized_keys is a reasonable solution at your scale IMO.

If you do want the LDAP route these will get you on your way:

Note that you don't get out of the problem of managing trust since you still have to indicate who you trust or how to determine who you trust since you have to either define a mapping to a third party server or maintain your own server.

Ram

Posted 2011-11-18T00:40:18.083

Reputation: 977

Asked: 2011-11-18T00:40:18.083

Viewed: 2 284 times

Active: 2012-06-18T07:31:39.163