[chef] Re: Deploying User Private Keys

[Curtis Stewart < >]

Thanks for the response, Arnold, I agree with your comments below about the 
‘fleshy’ users.

In regard to the other users, like a deploy user with access to a private git 
repo, do you store those keys in your repository as plain text?

Curtis

On Feb 3, 2014, at 3:32 PM, Arnold Krille 
<
 <mailto:
 >>
 wrote:

On Mon, 3 Feb 2014 21:06:54 +0000 Curtis Stewart
<
 <mailto:
 >>
 wrote:
I’m currently using the opscode-cookbooks/users cookbook to deploy
system users.

The users_manage resource uses data bags to deploy users, and this
does allow you to set an ‘ssh_private_key’ attribute, however, I
don’t want to store our private keys as plain text in our repository.

My plan is to use ChefVault to deploy users private keys (encrypted
data bags and a template/file resource), after the users have been
created with the users_manage resource.

Does anyone have suggestions for a better method, or best practice
for this case?

Why should your users hand their private keys to you as the admin to
feed it into some automated system???

The users (the fleshy ones) will give you their public keys to include
on machines so they don't need passwords when ssh-ing.

The private keys you store in chef is for automated things like
deployments getting source-code from a ssh-accessible git. Or for
jenkins-server logging into machines (but even that I did do with a
jenkins-cookbook creating the public/private keys and storing just the
public keys in chef).

- Arnold