Skip to content
Simple SSH key management service
Python Shell
Failed to load latest commit information.
docs Make master key possible to be found without token May 28, 2016
geofront regenerate() takes remote_set as RemoteSet type May 28, 2016
tests Make master key possible to be found without token May 27, 2016
.ackrc ack-grep configuration Apr 27, 2014
.coveragerc Test coverage Apr 19, 2014
.gitignore Generalize auth_nonce to state Jan 13, 2016
.travis.yml Move to codecov from coveralls May 19, 2016
CONTRIBUTING.rst How to contribute [ci skip] Apr 23, 2014
LICENSE Authentication and authorization Mar 30, 2014
README.rst Upgrade dependencies May 28, 2016
example.cfg.py typo May 1, 2014
runtests.sh Add a test for GitHubOrganization.authorize() Apr 26, 2014
setup.cfg EC2 driver doesn't raise KeyPairDoesNotExistError Jul 6, 2014
setup.py
tox.ini

README.rst

Geofront

Join the chat at https://gitter.im/spoqa/geofront Latest PyPI version Read the Docs https://travis-ci.org/spoqa/geofront.svg?branch=master

Geofront is a simple SSH key management server. It helps to maintain servers to SSH, and authorized_keys list for them. Read the docs for more details.

Situations

  • If the team maintains authorized_keys list of all servers owned by the team:
    • When someone joins or leaves the team, all lists have to be updated.
    • Who do update the list?
  • If the team maintains shared private keys to SSH servers:
    • These keys have to be expired when someone leaves the team.
    • There should be a shared storage for the keys. (Dropbox? srsly?)
    • Everyone might need to add -i option to use team's own key.
  • The above ways are both hard to scale servers. Imagine your team has more than 10 servers.

Idea

  1. Geofront has its own master key. The private key is never shared. The master key is periodically and automatically regened.
  2. Every server has a simple authorized_keys list, which authorizes only the master key.
  3. Every member registers their own public key to Geofront. The registration can be omitted if the key storage is GitHub, Bitbucket, etc.
  4. A member requests to SSH a server, then Geofront temporarily (about 30 seconds, or a minute) adds their public key to authorized_keys of the requested server.

Prerequisites

Author and license

Geofront is written by Hong Minhee, maintained by Spoqa, and licensed under AGPL3 or later. You can find the source code from GitHub:

$ git clone git://github.com/spoqa/geofront.git

Missing features

  • Google Apps backend [#3]
  • Bitbucket backend [#4]
  • Fabric integration
  • PuTTY integration

(Contributions would be appreciated!)

Something went wrong with that request. Please try again.