mjhjmtu

We have a topsecret@remote.org SSH account that can be accessed with SSH key pair ts_key.pub/ts_key.priv from our gateway server (gateway.org). We have many sysadmins that need to access that account. Each of them has its own SSH account on gateway.org, like sysadmin1@gateway.org.

Is there a way to keep ts_key.pub/ts_key.priv on gateway.org and enable sysadmins to use it, but without exposing it to the sysadmins? So if one of them leaves his job, and his account on gateway.org is closed, then he will not be able to use ts_key.pub/ts_key.priv anymore.

Update: I was suggested (by nice people on IRC/#OpenSSH) to encrypt the private key with a passphrase and then to use ssh-agent/ssh-add. However I didn't figured out the details...

As an alternative, you could prefix the key in the authorized_keys file of topsecret@remote.org with a "from=ip.address.of.gateway.org", effectively making the key work only if the connection comes from the gateway system.

See "man sshd" for more details.

Another possibility would be to have the private key on a separate account on gateway.org that has logins disabled. Let's call that account secretkeeper for example. Then you could give the sysadmins limited sudo access to that account like this (sudoers file syntax):

User_Alias ADMINUSERS=sysadmin1, sysadmin2, sysadmin3 #...etc.

ADMINUSERS ALL=(secretkeeper) /usr/bin/ssh secretremote

Have ~secretkeeper/.ssh/config specify as much of the connection parameters as possible, for user-friendliness:

Host secretremote
 User topsecret
 HostName remote.org
 EscapeChar none
 IdentityFile /some/where/ts_key.priv

Now your sysadmin1 and others will be able to run sudo -u secretkeeper ssh secretremote, but no other commands via sudo (unless there are other sudoers definitions). secretremote is just a keyword that can be anything, as long as it is the same in both the sudoers and ~secretkeeper/.ssh/config files.

Since the command specified in the sudoers file includes parameters, only that specific command will be accepted. Then sudo will run the command (and only that command) as the secretkeeper user, which can read the SSH configuration file and the private key, and then establish the connection. And since the sudo session is only running that one ssh command, once SSH is disconnected, the sudo session will end; there will be no interactive shell running as the secretkeeper user.

Of course, all this requires that your sysadmin users must not have root access to the gateway.org system.