LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   SSH Keys across clustered servers (https://www.linuxquestions.org/questions/linux-security-4/ssh-keys-across-clustered-servers-4175491184/)

SamanthaCruz 01-13-2014 08:40 PM

SSH Keys across clustered servers
 
I have a 10 node cluster and multiple clustered resources on the cluster have IP Addresses that move between different servers in the cluster when the application is migrated.

This causes RSYNC and other tools that use SSH to fail because from the remote server the key it has in known_hosts for this virtual server no longer matches the one used by the node that is now hosting the application.

I am considering making the host keys identical across all of the cluster nodes but wanted to ask first and see if that is the best solution and if it's even a good idea.

Better ideas are more than welcome.
Thanks

sundialsvcs 01-13-2014 09:13 PM

I'm no expert here, but it does intuitively seem to me that this is a situation that SSH is not quite programmed to recognize, viz: "even though the IP-addresses of these 10 machines are (of course ...) not the same, functionally they are 'a band of brothers.' "

Therefore, I think that I would, indeed, issue one common SSH host-key and associate it with all 10 of these addresses. Because, well, that best reflects the reality of this situation. All 10 of these IP's (but, none others!) are supposed to share the same credential . . .\\

(Any objections, dear experts?)

unSpawn 01-17-2014 12:55 AM

I'm wondering, even if you would be using UCARP or VRRP for public IP addresses, aren't those machines themselves connected to a separate management network with fixed IP addresses?..

SamanthaCruz 01-18-2014 10:51 AM

Each host has an IP address associated to the physical node however there are also IP Addresses associated to the clustered applications, and those applications move between physical nodes for load balancing and for cluster failover... - rsync needs to backup the application data regardless of which physical node it is on at the time.


All times are GMT -5. The time now is 06:38 AM.