<p>What is the easiest way to manage the authorized_keys file for openssh across a large number of hosts? If I need to add or revoke a new key to an account on 10 hosts say, I must login and add the public key manually, or through a clumsy shell script, which is time consuming. </p>

<p>Ideally there would be a central database linking keys to accounts@machines with some sort of grouping support (IE, add this key to username X on all servers in the web category). There's fork of SSH with ldap support, but I'd rather use the mainline SSH packages.</p>

[{'answer_id': 74523, 'author': 'JBB', 'author_id': 12332, 'author_profile': 'https://Stackoverflow.com/users/12332', 'pm_score': 0, 'selected': False, 'text': '<p>I\'ve always done this by maintaining a "master" tree of the different servers\' keys, and using rsync to update the remote machines. This lets you edit things in one location, push the changes out efficiently, and keeps things "up to date" -- everyone edits the master files, no one edits the files on random hosts.</p>\n\n<p>You may want to look at projects which are made for running commands across groups of machines, such as Func at <a href="https://fedorahosted.org/func" rel="nofollow noreferrer">https://fedorahosted.org/func</a> or other server configuration management packages. </p>\n'}, {'answer_id': 74538, 'author': 'Allan Wind', 'author_id': 9706, 'author_profile': 'https://Stackoverflow.com/users/9706', 'pm_score': 0, 'selected': False, 'text': '<p>Have you considered using clusterssh (or similar) to automate the file transfer?  Another option is one of the centralized <a href="http://en.wikipedia.org/wiki/Comparison_of_open_source_configuration_management_software" rel="nofollow noreferrer">configuration systems</a>.</p>\n\n<p>/Allan</p>\n'}, {'answer_id': 74557, 'author': 'Chris AtLee', 'author_id': 4558, 'author_profile': 'https://Stackoverflow.com/users/4558', 'pm_score': 4, 'selected': True, 'text': '<p>I\'d checkout the <a href="http://web.monkeysphere.info/" rel="noreferrer">Monkeysphere</a> project.  It uses OpenPGP\'s web of trust concepts to manage ssh\'s authorized_keys and known_hosts files, without requiring changes to the ssh client or server.</p>\n'}, {'answer_id': 5407319, 'author': 'Cristian Măgherușan-Stanciu', 'author_id': 673288, 'author_profile': 'https://Stackoverflow.com/users/673288', 'pm_score': 2, 'selected': False, 'text': '<p>I use Puppet for lots of things, including this.\n(using the ssh_authorized_key resource type)</p>\n'}]
['https://Stackoverflow.com/questions/74443', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/11105/']