<commit_before># SSH with Remote Keys storage

With my sysadmin background, being as lazy as possible, I always try to have the lowest overhead maintenance possible over systems.
Securely maintain ssh keys to access servers is a tricky business. Keys have to be rotated regularly, individuals join/leave projects/companies, ssh key passwords are forgotten, etc.

Typically, admins add ssh keys to ~/.ssh/authorized_keys or %h/.ssh/authorized_keys, others LDAP.
Updating these is a nightmare, even with packaging tools like ansile or puppet.
Some have crons to update these, but that can create a delay, and we all know what happens when you add delays.

Instead, I've opted to move away from managing keys in the instances, and move them to a centrally controlled location, where it is easy to update objects/permissions and have the instances check back on login attempt.

## Installation

[sshauth-install.sh](sshauth-install.sh) needs to be run in the instance.
You will need to modify "https://s3.amazonaws.com/BUCKET/userkeys.sh" to use your server personalised version.
The script will modify ssh_config, pull your custom [userkeys-github.sh](userkeys-github.sh)  or [userkeys-s3.sh](userkeys-s3.sh), and restart sshd.

## Usage

TODO: Write usage instructions
<commit_msg>add openssh manual<commit_after># SSH with Remote Keys storage

With my sysadmin background, being as lazy as possible, I always try to have the lowest overhead maintenance possible over systems.

Securely maintain ssh keys to access servers is a tricky business. Keys have to be rotated regularly, individuals join/leave projects/companies, ssh key passwords are forgotten, etc.



Typically, admins add ssh keys to ~/.ssh/authorized_keys or %h/.ssh/authorized_keys, others LDAP.

Updating these is a nightmare, even with packaging tools like ansile or puppet.

Some have crons to update these, but that can create a delay, and we all know what happens when you add delays.


Instead, I've opted to move away from managing keys in the instances, and move them to a centrally controlled location, where it is easy to update objects/permissions and have the instances check back on login attempt.

## Installation

[sshauth-install.sh](sshauth-install.sh) needs to be run in the instance.
You will need to modify [https://s3.amazonaws.com/BUCKET/userkeys.sh] to use your server personalised version.
The script will modify ssh_config, pull your custom [userkeys-github.sh](userkeys-github.sh)  or [userkeys-s3.sh](userkeys-s3.sh), and restart sshd.

## Usage

SSH AuthorizedKeysCommand was introduced in [2013's OpenSSH 6.1](https://www.openssh.com/txt/release-6.2), although you will only find is commonly around in OpenSSH 6.9 distro packages.

From the manual:
> sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to support fetching authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run under an account specified by an AuthorizedKeysCommandUser sshd_config(5) option.


{'fraction_non_alphanumeric': 0.06312292358803986, 'fraction_numerical': 0.006312292358803987, 'mean_word_length': 4.724334600760456, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 4, 'https://': 3, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3645564', 'n_tokens_mistral': 850, 'n_tokens_neox': 790, 'n_words': 407}