topic Re: Centralize ssh keys - is Radius server the answer? in Operating System - HP-UX

Centralize ssh keys - is Radius server the answer?

TwoProc — Mon, 19 May 2008 15:11:54 GMT

Hi all,

I want to centralize my ssh keys, so that I don't have so much work to do to keep up with the user key administration. Is a Redius server the answer? Recommendations of which one and where to get?

Many thanks in advance.

Re: Centralize ssh keys - is Radius server the answer?

Steven E. Protter — Mon, 19 May 2008 16:05:29 GMT

Shalom TwoProc,

I find it sufficient to have a central "master" server and distribute its ssh keys to all other servers, thereby permitting access.

This can be maintained by a simple script.

SEP

Re: Centralize ssh keys - is Radius server the answer?

TwoProc — Mon, 19 May 2008 16:17:59 GMT

Steven,

Thanks for your reply. I'm looking for a better solution b/c your solution would require me to slosh keys around server to server using a root login - which I'm supposed to try and get away from.

Would a radius server a possible good answer?

Re: Centralize ssh keys - is Radius server the answer?

TwoProc — Mon, 19 May 2008 21:25:32 GMT

Bummp

Re: Centralize ssh keys - is Radius server the answer?

Matti_Kurkela — Mon, 19 May 2008 23:17:34 GMT

We would need to know more about the question. So what exactly is giving you so much work?

Is password authentication disabled in your environment? Any other special restrictions? (If the users can use passwords and don't have any special restrictions on their accounts, they generally can set up their keys on their own.)

You obviously have some X number of machines, and your users might be ssh'ing into them and/or between them some combinations, right? Is it any-to-any or something more limited?
Are your users smart enough to use a SSH agent? Could you (as regards security requirements) allow the use of SSH agent forwarding in between your hosts?

Are your users SSHing in from a) machines you control, b) machines centrally controlled by someone else (e.g. domain-connected Windows PCs), c) some non-centrally maintained environment?

You obviously don't have centralized user home directories (on NFS or otherwise), else your problem would tend to solve itself.

MK