How to prevent my additions to authorized keys from being overwritten by puppet?

Question

At my company all employees are given a private key, which get's renewed each year, that they should use to connect to VMs. The SA here have a puppet script which will look up my public key and save it into ~/.ssh/authorized_keys file on any VM so I can connect to it.

The problem is that they are overwriting the authorized_keys file. That means any other keys I add to the file are also overwritten. This frustrates me since I like to be able to connect from box A to box B, mostly so I can SCP, and I don't want to put my personal private key on box A since it's a box multuple users have sudo permissions on. I'd usually create a new ssh key per box and add that boxes public key to the other boxes authorized_users, but this keeps being erased by puppet.

Is there any means I can keep additional authorized keys from being overwritten without changing the puppet scripts themselves, which I don't maintain?

Failing that is there an easy way that the puppet scripts could be modified to not overwrite my additions, but still allow them to update my public key, that I could suggest to the SA's?

The VM's are centos machines.

Answer 1

Is there any means I can keep additional authorized keys from being overwritten without changing the puppet scripts themselves, which I don't maintain?

If you have administrative access on the server, you can configure sshd to look in multiple locations for your authorized keys. From sshd_config(5):

AuthorizedKeysFile

Specifies the file that contains the public keys used for user authentication.
The format is described in the AUTHORIZED_KEYS FILE FORMAT
section of sshd(8).  Arguments to AuthorizedKeysFile accept the tokens
described in the TOKENS section.  After expansion, AuthorizedKeysFile
is taken to be an absolute path or one relative to the user's home
directory.  Multiple files may be listed, separated by whitespace.
Alternately this option may be set to none to skip checking for user
keys in files.  The default is ".ssh/authorized_keys
.ssh/authorized_keys2".

---

Failing that is there an easy way that the puppet scripts could be modified to not overwrite my additions, but still allow them to update my public key, that I could suggest to the SA's?

That should also be easy. The ssh_authorized_key resource has a purge_ssh_keys flag (off by default) that controls whether or not it cleans out unmanaged keys from your authorized_keys file.