I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system.

I am also running a NodeJS server that first checks REDIS for proper authentication then saves sensor data to Mongo.

Is there a more scalable and unified technique for managing authentication of webservers and SSHD?

  • PAM + LDAP + kerberos, IIRC, but your should switch to a commercial solution, since setting this up with popen-source-touls will drive you mad – that guy from over there May 4 '14 at 7:29

I think you should look at OpenSSH Certificates. With certificates you can have one central key (the CA) to give access to multiple servers. There is multiple guides out there on how to do this.

Here is one from digitalocean: https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu

I have also written a guide on how to do more fine grained access control using ssh certificates: https://framkant.org/2017/07/scalable-access-control-using-openssh-certificates/

  • I just noticed that this question was very old.. – Peter Jul 7 '17 at 13:29
  • 3
    It's not a problem that the question is old. Questions on this site are for both the asker and future visitors. – S.L. Barth - Reinstate Monica Jul 7 '17 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.