Hacker News Reader

Comment by jethro_tell | Hacker News Reader

It's amazing to me how many people use ssh and don't have an ssh config. It would be easier to maintain a .ssh folder in version control then to install this on each host and ssh until it learns.

Your auto provision of servers with chef or puppet should be adding them to you .ssh/config with a pointer to the ssh key and special requirements like tunnels through jump hosts/ bastion hosts.

View on HN

Are there any resources you recommend on maintaining a .ssh folder? I've done a little reading, but I've never really needed to worry about working with multiple servers before, but I'm going to need to learn soon for a project at work.

My set up dotfiles in a git repo (~/configs) with a Makefile that symlinks them to the correct location.

I'm hoping someone chimes in with a bit of a better solution but there's no reason you couldn't have ~/.ssh/config symlinked in the same way.

Make sure you know which version/s of ssh you'll be dealing with and make the config work with the lowest version

Some HN articles/discussions:

https://news.ycombinator.com/item?id=4677049

https://news.ycombinator.com/item?id=7658459

Some stuff changed in OpenSSH 6+ so read the manpages, too.

There is actually a reason you can't have ~/.ssh/config symlinked the same way: ssh refuses to read a symlink for this file (for security purposes it is strict about the file type and permissions). My workaround is to copy the file instead of symlinking in my dotfile-setup script.

Oops! Thanks for the clarification

I version control the entire directory (ignoring the known_hosts file) somewhere like ~/config/ssh and symlink it to ~/.ssh. It contains a Makefile with a target that runs this command:

    ln -s ${PWD} ~/.ssh

Just make sure the directory is chmod 700 and the important files in it are chmod 600.

Also ignore any private keys. For security, but also each host should have a different key so you can burn one without burning them all.

Yep. 100% with you on that one. And it's not that hard to setup. I found this as a great resource: http://nerderati.com/2011/03/17/simplify-your-life-with-an-s...

Reply on news.ycombinator.com