shim

t to shill too hard, but this exact "keys/perms/sudo drift" failure mode is why Userify exists (est. 2011): local accounts on every box + a tiny outbound-only agent that polls and overwrites desired state (keys, perms, sudo role). If scp/rsync/deploy steps clobber stuff, the next poll re-converges it (cloud default ~90s; self-host default ~10s; configurable). Removing a user also kills their sessions. No inbound ports to nodes, no PAM/NSS hooks, auditable. Shim (old but readable): https://github.com/userify/shim/blob/master/shim.py#L308 (obligatory): https://userify.com

st that's optional)

fy host). If a user no longer exists for that group, all sessions are actively killed (kill -9), the user account is deleted, and the home directory is renamed to /home/deleted:username so you can review the files in there at your convenience. If a user is later restored, that directory is automatically restored as well. No changes to the OS (no PAM modifications) and you can remove instantly. It's available via SaaS (Userify Cloud, zero-install) or you can install your own server in your VPC or LAN for data sovereignty. You can also integrate it with Active Directory so that a user who is deleted/locked-out/disabled in AD has the same status cascade through all of your Linux servers.

yet another avenue for mistakes and compromise... was that required, requisite, or optional? Ergo, obsolete. :) (imo) 1. (btw, We don't do server authentication. That is a key difference between a directory and Userify. We only distribute keys. The servers themselves authenticate their own users with Userify just like with the traditional model, whereas with a directory the LDAP/AD server itself performs every authentication.) 2. We also recommend purchasing and running Userify Enterprise locked down locally to your VPC/LAN, and our larger customers tend to prefer that as well (especially when connected to LDAP w/ the same disconnected model we designed into our core product). We also offer a free cloud-based edition for unlimited use because we're nice like that. 3. We're paranoid, just like you: we go through bi-monthly independent penetration tests, we encrypt all data w/ NaCl, we avoid using passwords where possible and has with bcrypt elsewhere, and we're hardened against XSS, CSRF, and any sort of injection. The shim source is available here: https://github.com/userify/shim (see https://userify.com/faq/ for more on the security stuff we do and we're open to more ideas) and, please, find our vulnerabilities. We'll pay you for them. https://support.userify.com/solution/articles/14000036246-fi... Sometimes even our larger partners don't do that unfortunately.. ( https://github.com/aws/aws-codedeploy-agent/issues/30 ) But, seriously, people who are happy with their current solution should probably stick with it. I don't expect to convince you to take another look, and I do agree that there are good arguments to be made that LDAP/AD is neither insecure nor obsolete. I just disagree with (most of) those arguments. ;) note: AD/LDAP connectivity in Userify: you can still authenticate natively via LDAP/AD, while Userify provides a user-friendly dashboard for key management for your teams. A particularly cool demo: remove or disable an account in Windows AD and seconds later watch all of the SSH sessions on all of the servers in all of the projects terminate. It's very slick.. and that's another thing that LDAP/AD directory authenticated solutions can't do.

r-driven ways from the last century, this is so much better; we can provide a full desktop app experience, make it feel more like a web page, or anywhere in between. AJAX changed everything. This is simply better. 1. https://userify.com 2. https://github.com/userify/shim

rify server(s). Only one jumpbox is needed across any network, depending on how you prefer to lockdown your network. (The HOWTO refers to EC2, but it can be built anywhere, exactly the same way.) sshmux looks like an interesting project, and love the simplicity. Wonder if Userify might automate the ProxyCommand setup! Seems really useful. > Good luck with Userify! Thanks! We have 350 companies on the platform right now and growing fast, and Userify Enterprise (on-premise) is in beta at several large enterprises as well. BTW, joushou, we're looking for brilliant SSH and golang hackers.. ping me if you get bored :)

u're talking about RH IPA, which is some nifty wrappers around LDAP. As someone who spent a lot of time implementing LDAP on UNIX at big companies, LDAP and centralized auth in general carries a lot of risks: for example, what happens if just a single one of your boxes is compromised, and rather than just sniff passwords, it starts DoS'ing your LDAP server? oops. now you can't get into any of your servers, even the ones they haven't yet owned.) We focus on a lot more than just authentication. That's just the beginning of the story. Userify Enterprise provides layered role-based access control, a user-friendly front-end for key updates, project functionality, and the ability to remove users across a single project or the entire companies. Ansible or Puppet don't offer any of those things. We have built-in deployment for Chef, for instance. We try hard not to duplicate functionality that you can get elsewhere (for example, systems management, log monitoring.) Those are designed for systems management, and they're good at that. We're designed for complex, multi-tiered user management with a focus on the user, not the system. (Hence our name) We view these as orthogonal directions, and it makes sense to use Userify with a good devops/cf system like Ansible/Chef/Puppet/Salt/etc. Small shops can still manually manage a dozen or so users across a few groups of servers. We've got a bunch of companies with hundreds of servers and less than 10 devops across all of them. For companies like that, Userify gives a bunch of other benefits.. for example, you can rotate your SSH keys without requesting a production code deployment, or update an SSH key without write access to git, or remove a contractor's account on their last day, etc. On-boarding and off-boarding get a lot easier, rotating keys is easier, training users is easier, managing lots of different role sets is easier, and Userify doesn't require any changes to PAM or NSS modules -- installing is a one-liner and it just uses /usr/sbin/adduser and /etc/sudoers.d. The shim is just a few hundred lines.. read through it at https://github.com/userify/shim

serify shim, even though you've answered my question: https://github.com/userify/shim/issues/4 -- you might still want to include a license file, or something along the lines of: http://www.tarsnap.com/legal.html in the readme. Might also want to have a free/open licensed spec of the api somewhere, so that if someone were to implement a self-hosting, free/open service that could be made api-compatible with userify, there'd be a clear way to do that legally.