I have five Linux machines with a service account on each under the same name. They all have a subnet connection to each other (192.168.1.{1,2,3,4,5}).

I have a script that parses /etc/hosts and adds the proper ip's to the proper host names. Each machine needs to be able to initiate password-less ssh to every other machine (15 non-trivial routes). This all works fine, but it is a lot of work managing if a new machine is added or a machine is removed. My question is this:

Given a fully connected network of machines, how do I manage connections on each machine at the same time? e.g. Make every machine talk to every other without manually adding keys and editing hosts


Long story short:

Host keys

  1. Create CA key for host keys:

    ssh-keygen -f host_ca
  2. Sign all host keys and copy them to the server:

    ssh-keygen -s host_ca -I host_foo -h -n foo.bar.com -V +52w /etc/ssh/ssh_host_rsa_key.pub 
  3. Configure server (/etc/ssh/sshd_config) to advertise certificates (in addidtion to host keys):

    HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
  4. Configure clients (/etc/ssh/ssh_known_hosts) (also your server if you search for mutual communication):

    @cert-authority *.bar.com ssh-rsa AAAAB3[...]== Comment

Authentication keys:

  1. Create CA key for users:

     ssh-keygen -f user_ca
  2. Configure server to accept keys signed by this CA (again in `/etc/ssh/sshd_config'):

    TrustedUserCAKeys /etc/ssh/user_ca.pub
  3. Sign the authentication key:

     ssh-keygen -s user_ca -I user_thomas -n thomas,thomas2 -V +52w /path/to/id_rsa.pub

More notes are available on habets.se or in manual page for sshd. It should answer all your questions, but if not, feel free to ask further.

  • This works with a centralized server, but how about a distributed network where they are all neither server nor client but both? – Luke Smith Mar 27 '16 at 15:04
  • It works in your configuration too, but you need to sign for every machine both host and authentication keys. – Jakuje Mar 27 '16 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.