Mike Little mikelittle

Better SSH Authorized Keys Management

A seemingly common problem that people encounter is how to handle all of your users authorized_keys file.

People struggle over management, ensuring that users only have specific keys in the authorized_keys file or even a method for expiring keys. A centralized key management system could help provide all of this functionality with a little scripting.

One piece of functionality overlooked in OpenSSH is the AuthorizedKeysCommand configuration keyword. This configuration allows you to specify a command that will run during login to retrieve a users public key file from a remote source and perform validation just as if the authorized_keys file was local.

Here is an example directory structure for a set of users with SSH public keys that can be shared out via a web server:

OS X ENV (re)Install

This is my personal guide to restore my configuration and setup my system for a fresh install. I use it and keep it updated frequently. Hope it will inspire you on your own way =].

Backup

Before a fresh reinstall, don't forget to backup many things. A regular ghost made with CarbonCopyCloner or Clonezilla is a good solution, but if you can't, you should save the following:

	<?php
	/**
	* Plugin Name: WP PGP Email
	* Version: 0.1
	* Description: Provides mechanism to encrypt outgoing email using PGP
	* Author: Tim Nash
	* Author URI: https://timnash.co.uk
	* Plugin URI: https://timnash.co.uk/wordpress-pgp-email
	*
	*

	<?php
	/*
	Plugin Name: Bit.ly Shortlinks
	Version: 0.3
	Plugin URI: http://yoast.com/wordpress/bitly-shortlinks/
	Description: Use Bit.ly shortlinks instead of the shortlink WP generates. Works with Bit.ly Pro too, so you can immediately use the right URL.
	Author: Joost de Valk
	Author URI: http://yoast.com/
	*/

	From: Chris DeSalvo <[email protected]>
	Subject: Why we can't process Emoji anymore
	Date: Thu, 12 Jan 2012 18:49:20 -0800
	Message-Id: <[email protected]>

	--Apple-Mail=_6DEAA046-886A-4A03-8508-6FD077D18F8B
	Content-Transfer-Encoding: quoted-printable
	Content-Type: text/plain;
	charset=utf-8

	# to generate your dhparam.pem file, run in the terminal
	openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048