PointyHair -- Engineering, Technology : Collecting all SSH RSA keys, and redistributing them

Home

Stats

Wiki

Blogs

File Galleries

Last blog posts

1)	VoIP, telephony: Doorbell 2.0 Fri 11 of Dec, 2009 [03:11 UTC]
2)	VoIP, telephony: Unlimited incoming trunks... Fri 11 of Dec, 2009 [02:50 UTC]
3)	VoIP, telephony: Howto: recognizing one of many phone numbers and routing Fri 11 of Dec, 2009 [00:40 UTC]
4)	Network Security: denyhosts -- almost best thing since sliced bread Thu 19 of Nov, 2009 [07:25 UTC]
5)	Networking: Networking Asterisk with multiple uplinks Thu 19 of Nov, 2009 [07:19 UTC]
6)	Programming: Oracle 10g Express Edition vs. 64 bit client drivers Thu 19 of Nov, 2009 [06:45 UTC]
7)	Programming: C++ programming with Ubuntu 9.10 and Boost 1.40 Thu 19 of Nov, 2009 [06:35 UTC]
8)	Network Security: Using Pion for network security Mon 20 of Jul, 2009 [08:07 UTC]
9)	Network Security: Russian (caravan.ru) link spammers Mon 03 of Sep, 2007 [16:11 UTC]
10)	Network Security: SPAM on the rise... Sun 15 of Oct, 2006 [16:00 UTC]

Last changes

1)	HomePage
2)	VoIP Success Story
3)	Programming Language
4)	Floyd
5)	RoadWarrior
6)	lookupd
7)	Projects
8)	Software Engineering
9)	Etheric
10)	Code Reviews

Viewing blog post - Network Security

Return to blog

Collecting all SSH RSA keys, and redistributing them

posted by TaneliOtala on Mon 29 of May, 2006 [21:31 UTC]

Here's a handy script for those who like to create a revocable, per-user trust system...

This script will reach into all of your boxes, where you already run ssh (and have already run ssh-keygen). It will retrieve all of the .ssh/id_rsa.pub keys, concatenate them into a single file, and deliver that file to all the hosts as the .ssh/authorized_keys file.
Presto, all your hosts now share the same set of RSA keys, and you don't need to type passwords again.

If one of the machines gets compromised, you can revoke the key and redistribute easily again.

NOTE: There are much better ways of doing this — but this is simple, quick, and efficient...

# List your hosts (hostname, or FQDN) separated with spaces
HOSTS="hewey dewey lewey"

# Base file name
KEYFILE=authorized_keys

# Wipe out old temp file
rm $KEYFILE.new
# Collect (concatenate) public RSA keys from all hosts
# If you have errors, you may either be lacking the key -- use "ssh-keygen -t rsa"
# Of you might have a key that has changed (remove the offending key)
for i in $HOSTS ; do {
  echo "Host: $i"
  ssh $i cat .ssh/id_rsa.pub >>$KEYFILE.new
} ; done

chmod go-rw $KEYFILE.new

# Push newly built collection of all keys into all hosts
for i in $HOSTS ; do {
  echo "Host: $i"
  scp -p $KEYFILE.new $i:.ssh/$KEYFILE
} ; done

Permalink (referenced by: 0 posts references: 0 posts)