Lightweight SSH key management on AWS EC2
Project description
Keymaker is the missing link between SSH and IAM accounts on Amazon AWS. It’s a stateless synchronization engine that securely manages the process of SSH public key sharing and verification, user and group synchronization, and home directory sharing (via optional EFS integration). You, the AWS account administrator, define or import user and group identities in IAM, and instances in your account dynamically retrieve and use those identities to authenticate your users. Keymaker is the modern, minimalistic alternative to LDAP or Active Directory authentication.
Installation
Run pip install keymaker.
On instances that accept SSH logins:
Run keymaker install.
Ensure processes launched by sshd have read access to IAM (most easily done by launching the instance with an instance profile/IAM role that has the IAMReadOnlyAccess policy attached).
Keymaker requires OpenSSH v6.2+, provided by Ubuntu 14.04+ and RHEL7+.
Usage
Run keymaker with no arguments to get usage information. In client mode (running on a computer that you will connect from), you can run keymaker <subcommand>, where subcommand is:
upload_key Upload public SSH key for a user. Run this command for each user who will be accessing EC2 hosts. list_keys Get public SSH keys for a given or current IAM/SSH user. disable_key Disable a given public SSH key for a given or current IAM/SSH user. enable_key Enable a given public SSH key for a given or current IAM/SSH user. delete_key Delete a given public SSH key for a given or current IAM/SSH user.
Principle of operation
Amazon Web Services IAM user accounts provide the ability to add SSH public keys to their metadata (up to 5 keys can be added; individual keys can be disabled). Keymaker uses this metadata to authenticate SSH logins. Keymaker provides an integrated way for a user to upload their public SSH key to their IAM account with keymaker upload_key.
Run keymaker install on instances that you want your users to connect to. This installs three components:
An AuthorizedKeysCommand sshd configuration directive, which acts as a login event hook and dynamically retrieves public SSH keys from IAM for the user logging in, using the default boto3 credentials (which default to the instance’s IAM role credentials).
A pam_exec PAM configuration directive, which causes sshd to call keymaker-create-account-for-iam-user early in the login process. This script detects if a Linux user account does not exist for the authenticating principal but an authorized IAM account exists with the same name, and creates the account on demand.
A cron job that runs on your instance once an hour and synchronizes IAM group membership information. Only IAM groups whose names start with a configurable prefix (by default, keymaker_*) are synchronized as Linux groups.
As a result, users who connect to your instances over SSH are given access based on information centralized in your AWS account. Users must have an active IAM account with active matching SSH public keys in order for authentication to succeed. Users’ UIDs and group memberships are also synchronized across your instances, so any UID-based checks or group-based privileges remain current as well.
EFS integration
Email kislyuk@gmail.com for details on the EFS integration.
Links
Bugs
Please report bugs, issues, feature requests, etc. on GitHub.
License
Licensed under the terms of the Apache License, Version 2.0.
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file keymaker-0.4.2.tar.gz.
File metadata
- Download URL: keymaker-0.4.2.tar.gz
- Upload date:
- Size: 10.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 87b5845e95e67565f20abb628fdbed40ef26babbbd5617140101fceb28896207 |
|
| MD5 | f6447623d55e95eeb8e0512d190b97c5 |
|
| BLAKE2b-256 | 4ed1a5074e6b05dcf63ec05c01379e9fd5e179cd1f9b6eb3f461d52182c52055 |
File details
Details for the file keymaker-0.4.2-py2.py3-none-any.whl.
File metadata
- Download URL: keymaker-0.4.2-py2.py3-none-any.whl
- Upload date:
- Size: 13.7 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 8d63736289dc6110cacc9919ed9ecc98c5106bec383bb9d0d0f37b8da5d438ed |
|
| MD5 | e3092702ee00d6025bf2fd61178c1f9f |
|
| BLAKE2b-256 | c0613ef8939f07abbb69957be80d51adad8b22a9fea2f16b595394338a41bda5 |
