Skip to content
Register

What do you use for team SSH key management across clients?

Web Hosting by wilmaethqn44 24 replies 3K views
Doug

Member

New Jersey

#11
sofialund said:
The Vault free has tier for the users 25

Yeah and the learning curve is a cliff. Friend of mine spent a weekend on it and still couldn't get unseal working right. For two people? Overkill.

grabs popcorn, checks /r/drama
pauloserver

Member

#12

What I did when I was in this exact spot: each person generates ed25519, you append public keys to authorized_keys on each box, you keep a spreadsheet of who has access to what. Low tech. Survived two freelancers coming and going.

Not perfect. Better than shared root.

chill infrastructure for chill people 🦫
YuriDavid

Member

#13

Spreadsheet is where the rot starts. I have seen that spreadsheet. It has passwords in column B "for reference."

indentation is not optional
prague1983

Member

btw I use Arch

#14

Just use 

ssh-copy-id
and be done with it. If you are two people you do not have a key management problem you have a discipline problem. Disable password auth, set 
PermitRootLogin prohibit-password
, keep your private keys on hardware tokens if paranoid.

The rest is theatre.

oops: 0000 [#1] SMP
wilmaethqn44

Member OP

2 #15

What is a hardware token

frames, tables, still valid HTML
wendy

Member

#16
wilmaethqn44 said:
What is a hardware token

YubiKey. Nitrokey. Little USB thing that holds your private key and won't export it. You touch it to authenticate. Windows Hello supports some, macOS has native support, Linux needs a bit of udev fiddling.

Nice to have. Not required for your threat model.

Have you tried restarting it?
MA

Member

#17

Following this thread. Same situation, three people, mix of Hostinger VPS and a Hetzner box.

CO

Member

9 #18

If you are on Hostinger and InterServer you are probably using their control panel to get console access when you break SSH. Keep that in mind before you disable password auth entirely and lock yourself out testing configs. Ask me how I know.

wilmaethqn44

Member OP

8 #19

Oh god I didnt think of that

frames, tables, still valid HTML
NO

Member

#20

For the freelancer angle: consider a jump host. One small VPS they all tunnel through, you revoke one key there instead of chasing it across six client servers. I run a 3 euro Hetzner instance for this. Logs everything, single point to audit.

The clients never see the jump host IP in their logs, which some of them care about for compliance reasons.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft