880723 - Openssh key based user auth recommendation

Status: RESOLVED WONTFIX

(Security Assurance :: General, task)

Description

[Gene Wood [:gene]]

I need to establish individual user accounts on our AWS cloud servers for Services Ops and Identity users. I would like to establish users in code and inject their public keys into their authorized_keys files.

How do you recommend I do this? Here are some ideas :
* Somehow get our AWS installation whitelisted so each server can talk to the public ldap.mozilla.com interface and fetch all users public keys upon server provisioning to inject into authorized_keys. Downside, not sure how to provide IP based access control since the outbound IPs from AWS are not fixed
* Statically create in provisioning logic the list of users and their keys. Downside, when a person changes their public key in ldap it's not reflected in our servers. Downside, when a person leaves mozilla they continue having an account created on our servers. Upside, no ldap IP acl access is needed
* Enable openssh to query directly for the key from ldap ( http://code.google.com/p/openssh-lpk/ ) Downsides, still requires IP based acl from AWS
* Provision using the public keys stored in https://github.com/mozilla/identity-pubkeys . Downside, this public key store isn't our canonical key store even though it's the one used for everything in identity.
* Establish a nightly export that dumps all public keys out of ldap and servers them up on some public web interface. Upside, since the ldap data being revealed is limited to just public keys it probably wouldn't need IP acls like ldap normally does since there would be no passwords to attempt brute force against
* Other ideas I'm not coming up with

Comment 1

[Michal Purzynski [:michal`] (use NEEDINFO)]

Gene, how about having an extra VM in AWS set up, with EIP (so it's fixed) having LDAP access? It would query the LDAP and further distribute the keys as required.

Comment 2

[Michal Purzynski [:michal`] (use NEEDINFO)]

Ping?

Comment 3

[Gene Wood [:gene]]

Ah, in the intervening 5 months between this question back in June and now it looks like the rest of Services Ops has developed a puppet manifest that deals with user accounts. I'm not sure how it works but Daniel Thornton would. For now I'm just going to use his solution but if you're curious about it I'd recommend hitting him up.