What is the best practice you have found for managing lots of SSH keypairs?
I use SSH to connect to several systems, both at home and at work. I currently have a fairly small, manageable collection of keypairs for both work and home systems. I have a script that generates a named keypair so I can avoid confusion.
My home network is comprised of my laptop (ubuntu), two desktops (ubuntu/fedora dual boot, fedora/windows dual boot), and a media system (ubuntu). At work I have my personal laptop (which I use for working from home), my desktop (fedora), a production system (RHEL), and an a laptop with windows (sigh) and a VM (fedora). All good so far.
(I have no interest in either putting my home keypair on my work system, or my work keypair on my home systems. And we have virtual user accounts to mechanize file transfers with other systems, where the private key must reside on the production machine, to transfer files between other systems.)
But now comes Hadoop, a large cluster of 100+ systems, and with that more complexity, more users, and more keypairs. Now I need to manage keys.
(I need to clarify. I am a software developer consulting to a client who is deploying a Hadoop cluster. They need to manage keys. There will be many folks accessing the cluster, needing to place their public keys onto the system. As the resident Linux savant, they asked me for help. I advised hiring a system admin, but until they do, I am helping)
When I need to publish the public key to a remote system, all of the 'how-to' web pages suggest either overwrite (>) (destroying existing keys), or append (>>) (which is good, preserves existing keys). But I would think preserving each public key on the destination machine separately, and combining them would be better. I am looking for advice.
What is the best practice you have found for managing lots of keys?
Thank you!
Edit: One aspect is needing to place keys on lots of systems, and the concomitant CRUD (create, read, update, delete/disable) for specific users, which means needing to be able to identify which keys belong to which users.
sshfp
solves the hostkey issue by putting the public key's signatures in DNS. For user credentials you may want to look into either OpenSSH certificates or using something like Spacewalk or puppet to save all the key pairs to a central location and deploy them as needed. Sounds like you're probably wanting the latter since you would just set the new server up as a client and then deploy the latest version of the file.