0

In the company where I work, we have several clients hosted on a server that use the same project, they use the same code base, but are different users on the server (using WHM / CPanel) As our repo is private, they are all authenticated by SSH keys, but we have about 80 clients that way, so in the github account you have almost 80 keys stored.

The question is, is there any way to get these users to use the same key? To avoid creating a new key for each user. Or this is not a good approach to do, and better to keep making a key for each one

5
  • You should familiarise yourself with GitHub terms of service: docs.github.com/en/github/site-policy/…. What you are talking about is against their rules of not sharing accounts. Every user should have their own account and you should create an organisation to shepherd the code. If you don't like GitHub's ToS you can self-host with gogs or GitLab. So, while sharing ssh private keys between people is a bad idea in any case, there are furthermore legal considerations which you're bound by when running a company.
    – cryptarch
    Feb 3, 2021 at 18:42
  • I think you got me wrong, or I got it wrong what you mean now. Account will not be shared between people, but between users within the same server (which will not be used by people either). What I was trying to say would be for example, I create a ssh key and copy and paste it into all the .ssh folders of each user on the server
    – R. Pêgo
    Feb 3, 2021 at 19:32
  • My comment was based on this: "so in the github account you have almost 80 keys stored".
    – cryptarch
    Feb 3, 2021 at 19:39
  • indeed one key for each user on server. My english is still very bad, I may have expressed the request badly Sorry
    – R. Pêgo
    Feb 3, 2021 at 19:42
  • 1
    Maybe you mean you have a git user on the server? If this is what you mean, then you should accept @dirkt's answer, since he is spot on that ssh certificates are the best way to do what you want. I do this myself, have a git user which other users can access using certificates instead of needing to manage a hundred different public keys.
    – cryptarch
    Feb 3, 2021 at 19:45

2 Answers 2

5

You can set up ssh to accept certificates signed by a single certificate authority (CA).

So you create a single certificate for this authority, provide this certificate to where ever you want to use the SSH keys for your n users, and then each of the n users gets a certificate signed with the CA certificate. You can add more users without changing anything.

So this is nearly the same as having each user use the same key (you only need to manage the CA certificate once), but each user still gets a different certificate, so you can distinguish users.

Github supports CAs.

Here is an article with more details (the CLI from smallstep is also pretty helpful for these things).

1
  • 1
    I took some time here and read about it now, that's what I really needed, thanks.
    – R. Pêgo
    Feb 3, 2021 at 20:34
0

That may be possible but could be considered a bad idea. Basically, it is easy to add people who need access (by their ssh keys) to ~/.ssh/authorized_keys. However, what do you do if one of these people leaves the company, or they do something nasty? If everyone has their own, individual personal key you can remove individual access rights without anyone else needing to change their keys. If they share a key you need to de-authorise the single key everyone is using which creates a lot of work.

Auditing (who did what, where) is also easier with individual keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .