6

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all the keys based on the server's private ssh key, but I'm looking for a more robust solution that a) other people can do and b) doesn't require as much manual work. What I'm thinking, and would like feedback on:

  • Create a shared private key, protected with a strong passphrase
  • Encrypt all necessary passwords with this key, store those keys in a config file
  • When a new server is brought up, copy the ssh key, remove the passphrase

Any issues with this? The passphrase-encrypted private key will be "publicly" accessible, that is to everyone in the company.

2

Read up on Kerberos and develop a strategy to deploy Kerberos at your company.

ssh has Kerberos integration via the GSSAPI (you may need to rebuilt ssh.)

Kerberos will solve your key management problems and its APIs should dove tail into your own APIs.

Why do I suggest going down the Keberos path?

Because many of the activities you are doing sound exactly like problems that Kerberos has already solved (strong passphase, key management, etc.)

Kerberos is the more robust solution that you seek.

1

seems that you look for a solution like fabric

tl;dr: remote-control for automated set of commands that run via ssh

"Fabric is a Python (2.5-2.7) library and command-line tool for streamlining the use of SSH for application deployment or systems administration tasks.

It provides a basic suite of operations for executing local or remote shell commands (normally or via sudo) and uploading/downloading files, as well as auxiliary functionality such as prompting the running user for input, or aborting execution."

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.