<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Yes, it does. I don’t see what the problem is having to authenticate to each server. It is more secure that way, I think they are just used to being able to take shortcuts. I guess if they really fuss about it we could set up forwardable tickets. I would definitely prefer to have all of the service accounts be on the server rather than local<o:p></o:p> <o:p> </o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] On Behalf Of Dale Macartney Sent: Monday, June 04, 2012 10:37 AM To: freeipa-users@redhat.com Subject: Re: [Freeipa-users] SSH Keys?<o:p></o:p> </div> </div> <o:p> </o:p> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/06/12 18:28, Kline, Sara wrote: > <o:p></o:p> > Some of my users have expressed concerns about moving to<o:p></o:p> FreeIPA because they prefer to use SSH. The main reason behind<o:p></o:p> that is because they can use agent forwarding and only have to<o:p></o:p> sign on once. I did find information on forwardable Kerberos<o:p></o:p> tickets, kinit ?f. Has anyone used this in place of SSH keys, or<o:p></o:p> do you have other suggestions? There are a few service accounts<o:p></o:p> scripted to work with SSH keys so we may have to leave a few local<o:p></o:p> accounts on the servers. I don?t particularly like that idea. <o:p></o:p> > Hi Sara The big difference here is your users will see this as you taking something away from them. Yes kerberos tickets will work perfectly in this situation, I do this myself. The issue you need to be aware of is that they will expire, as they should. An SSH key is nothing more than bypassing an authentication process. I would recommend using centralized service accounts in place of more local accounts, as this way you will always be able to manage them in the future. Does this help? > <o:p></o:p> > <o:p></o:p> > Sara Kline <o:p></o:p> > <o:p></o:p> > System Administrator <o:p></o:p> > <o:p></o:p> > Transaction Network Services, Inc <o:p></o:p> > <o:p></o:p> > 4501 Intelco Loop, Lacey WA 98503 <o:p></o:p> > <o:p></o:p> > Wk: (360) 493-6736 <o:p></o:p> > <o:p></o:p> > Cell: (360) 280-2495 <o:p></o:p> > <o:p></o:p> > <o:p></o:p> > <o:p></o:p> > <o:p></o:p> > ------------------------- <o:p></o:p> > This e-mail message is for the sole use of the intended<o:p></o:p> recipient(s)and may <o:p></o:p> > contain confidential and privileged information of<o:p></o:p> Transaction Network Services. <o:p></o:p> > Any unauthorised review, use, disclosure or distribution is<o:p></o:p> prohibited. If you <o:p></o:p> > are not the intended recipient, please contact the sender by<o:p></o:p> reply e-mail and destroy all copies of the original message. <o:p></o:p> > <o:p></o:p> > <o:p></o:p> > <o:p></o:p> > _______________________________________________ <o:p></o:p> > Freeipa-users mailing list <o:p></o:p> > <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <o:p></o:p> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - <a href="http://enigmail.mozdev.org/">http://enigmail.mozdev.org/</a> iQIcBAEBAgAGBQJPzPItAAoJEAJsWS61tB+qtfEP/irmelW0sGNW9l2W80DX4piY E209XSH6/F6/5Duj6LpY3ISELjJdwS/eRikeG+49oivOZWbvEzZ9VSl3TE6TuI7U wnrpvMt6kdxcgeeTZ31f97nPRwYv50xO9iWU+4ymzW3tzWQt96Er1LXxO8UP++KN LQ5eUF2gxe0f5WMtKpWwJkTSZlqlCztco5red7Xadze4phUWt3y2OfzLJV3DUqig /Y44kgtrQfI+Qm8mjrNfZFTnqSALW6kgZ3Ad7hh+1SuNn7D6WyOOkedn5169fYlf UiDr28G2MM2wdWoh0l9ldqQN3acMDYFDdT0vHXeIq9ygbO1NfTBVC4iRnICCAc+O GWnmVPY2qGM6/qA7BY11YRNG5Y7PVgEjB6P/zAkMgTds9m87VLpH4QjiifT77R5h Gt/FNqnT/h9fTF2eoK9RjSdFHcPmplqCUDzfgoLrpDsscyS0RccG6O9z8QCKyeI5 wNl6NtSIb8yqGNN9wfZd3UAbGE5omaofDchMAOV7pcDnenYEju2bXXX9GU4VB09i GSloEpXRyK189B+oRgd/kmb1DlUuDDMoevHZ/161QI6TuriORyQkqtAq9dOl1Xwl H7RbwtW0iDxcYfslN3NlF+NOEXOemagQLb7uZU0ARPDbMFobJMdrVHSFTcDsa+Zg L85opgHXJxOWs0nBERcc =dvkx -----END PGP SIGNATURE-----<o:p></o:p> </div> <hr> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. </body> </html>