6 ms·

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a pas

We use Ansible to deploy/manage peoples' SSH keys on our servers. From their laptop or a jumpbox (within the management VLAN) with their personal key (and a passphrase!) they are able to login in to all those servers. So logins are personal (as opposed to shared accounts which have to be updated when people leave). Now when new people arrive or when people leave we just run an Ansible playbook and all our 400+ servers are updated.

drinchev 9y ago
How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.
- lamby 9y ago
  Not the OP, but say you were populating a directory of keys, you would simply remove it via file's state=absent and then repopulate.
- janvdberg 9y ago
  Yes, we run it once/only when things (people) change.
- Spivak 9y ago
  There are two states that we're talking about. * Ensure that the following key is present. * Ensure that only the following keys are present. You can accomplish the second one with the 'exclusive' flag. http://docs.ansible.com/ansible/authorized_key_module.html http://docs.ansible.com/ansible/authorized_key_module.html
  - falcolas 9y ago
    There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed. That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.
- dkhenry 9y ago
  You can have Ansible generate the authorized_keys file from a list of public key files, then when that list changes ansible will detect that the file has changed and will copy over the new file.
- ruffrey 9y ago
  For a file, specify state=absent http://docs.ansible.com/ansible/file_module.html http://docs.ansible.com/ansible/file_module.html
nicklaw5 9y ago
We also use Ansible for managing SSH keys, though we only have around 20 servers to maintain. We are a small team and dont have a huge staff turnover so managing keys is not huge issue so far. As we grow, however, this procesure may need to be revisited.
blakesterz 9y ago
Do you use Ansible for SSL as well? How do you store the keys?
- throwaway18917 9y ago
  Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally). I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.
- atmosx 9y ago
  Using ansible-vault, check out this gist: https://gist.github.com/tristanfisher/e5a306144a637dc739e7 https://gist.github.com/tristanfisher/e5a306144a637dc739e7 Having a partly encrypted YAML file is also available since version 2.3.0 Key management and deployment are two different things. Installing up people's private keys on the hosts, doesn't involve any management. It's a standard sysadmin procedure. Key managements involves policies such as: key rotation, algorithms to use, access restriction control, etc. It is way more daunting and complex. I don't see how ansible what ansible has to do with this, vaultproject on the other hand has most of the these features (and more) build-in. Never used it, but I know about it through a podcast presentation of vault in "Arrested Devops" IIRC.
mbubb 9y ago
This works pretty well - we manage ~ 300 severs in a similar manner. One wrinkle is that I ask the new user to add their keys to their github account (ie github.com/<username>.keys ) which gives them the ability to add/del keys and jira me to update their user.

drinchev 9y ago

How do you manage to "remove" SSH keys. Since sensible is stateless, you probably run once for removing and once for adding a new key.

lamby 9y ago
Not the OP, but say you were populating a directory of keys, you would simply remove it via file's state=absent and then repopulate.
janvdberg 9y ago
Yes, we run it once/only when things (people) change.
Spivak 9y ago
There are two states that we're talking about. * Ensure that the following key is present. * Ensure that only the following keys are present. You can accomplish the second one with the 'exclusive' flag. http://docs.ansible.com/ansible/authorized_key_module.html http://docs.ansible.com/ansible/authorized_key_module.html
- falcolas 9y ago
  There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed. That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.
dkhenry 9y ago
You can have Ansible generate the authorized_keys file from a list of public key files, then when that list changes ansible will detect that the file has changed and will copy over the new file.
ruffrey 9y ago
For a file, specify state=absent http://docs.ansible.com/ansible/file_module.html http://docs.ansible.com/ansible/file_module.html

nicklaw5 9y ago

We also use Ansible for managing SSH keys, though we only have around 20 servers to maintain. We are a small team and dont have a huge staff turnover so managing keys is not huge issue so far. As we grow, however, this procesure may need to be revisited.

blakesterz 9y ago

Do you use Ansible for SSL as well? How do you store the keys?

throwaway18917 9y ago
Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally). I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.
atmosx 9y ago
Using ansible-vault, check out this gist: https://gist.github.com/tristanfisher/e5a306144a637dc739e7 https://gist.github.com/tristanfisher/e5a306144a637dc739e7 Having a partly encrypted YAML file is also available since version 2.3.0 Key management and deployment are two different things. Installing up people's private keys on the hosts, doesn't involve any management. It's a standard sysadmin procedure. Key managements involves policies such as: key rotation, algorithms to use, access restriction control, etc. It is way more daunting and complex. I don't see how ansible what ansible has to do with this, vaultproject on the other hand has most of the these features (and more) build-in. Never used it, but I know about it through a podcast presentation of vault in "Arrested Devops" IIRC.

mbubb 9y ago

This works pretty well - we manage ~ 300 severs in a similar manner. One wrinkle is that I ask the new user to add their keys to their github account (ie github.com/<username>.keys ) which gives them the ability to add/del keys and jira me to update their user.