Skip to content
Register

What do you use for team SSH key management across clients?

Web Hosting by wilmaethqn44 24 replies 3K views
wilmaethqn44

Member OP

4 #1

Hi everyone, sorry for the silly question but our little agency is growing and I'm getting worried about how we manage server access. Right now we just share a few passwords for root and I know thats probably bad

We have maybe 6 client servers on InterServer and some old boxes at Hostinger. Me and my business partner need to both get in, plus sometimes a freelancer. I keep hearing about SSH keys but I dont really understand how to do this for a team without giving everyone everything.

Is there a simple tool for this? I looked at some enterprise stuff and it was way too much. We are two people. I feel silly asking but I dont want to break a client site.

Thanks for any advice

frames, tables, still valid HTML
Doug

Member

New Jersey

5 #2

"team" of two people, six shared passwords, asking about "scalable access control"

grabs popcorn, checks /r/drama
sofialund

Member

homelab heatstroke

#3

¡the tool simple exists my friend!

For the team small I recommend the Vault of HashiCorp or the Teleport of Gravitational! The keys SSH centralizan in server the central. The access you control with the roles.

¡but careful! The setup initial is complex a bit. For the team of two persons maybe the manual the key is sufficient. The server each with the key own and the sudo configure careful.

The password shared is the danger the big. ¡change immediate!

The Vault free has tier for the users 25. Very generous is. The audit logs have. The compliance the clients helps much.

¡the question not is silly! The security is important always.

hot air, steady hand, magic smoke
LO

Member

#4

GitOps streak still going strong here too

pauloserver

Member

#5

Shared passwords for root is rough, I did that once

chill infrastructure for chill people 🦫
cketbotcod

Member

Uptime Junkie

#6

Shared root passwords on client boxes is how you end up on the front page of The Register. Stop.

wilmaethqn44

Member OP

#7

Ok ok I get it its bad! But I looked at HashiCorp Vault and I dont even know what a token is. Is there something between "shared password" and "enterprise devops toolchain"?

frames, tables, still valid HTML
dadlime

Member

stable > testing

#8
wilmaethqn44 said:
Something between "shared password" and "enterprise devops toolchain"

Yes. Smallstep. Or just plain old OpenSSH CA if one of you is comfortable generating host and user certs. You run one command to sign a key, they last 24 hours or a week, done.

For two people and six servers this is twenty minutes of setup once.

LO

Member

8 #9

GitOps streak still going strong here too

panelkrakw

Member

Backup Paranoid

#10

I used Teleport for a team of four. The free tier is fine but the resource limits annoyed me fast. Also their pricing jumps hard at 100 nodes which you will never hit but still. I moved to a simple Ansible playbook that rotates keys weekly and logs to a file I rsync somewhere. Not elegant. Works.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft