sshkey-audit

This is not an official Google product.

Example

$ cat keys.txt
ssh-rsa AAAAAhuteonhuneo… my-awesome-laptop
ssh-rsa AAAAhtuhsotiesi…  [email protected]
ssh-rsa AAAAhtuhutnuheo…  [email protected]
ssh-rsa AAAAhtuhuueoueo…  [email protected]

$ cat groups.txt
home    my-awesome-laptop [email protected]
work    [email protected]  [email protected]
laptops my-awesome-laptop [email protected]

$ cat accounts.txt
[email protected]                                  @home
[email protected]                               @work
[email protected]                               @laptops  [email protected]
[email protected]                                  @home @work @laptops
[email protected]:/etc/dropbear/authorized_keys @home

$ go get github.com/sirupsen/logrus
$ go build sshkey-audit.go
$ ./sshkey-audit --keys=keys.txt --groups=groups.txt --accounts=accounts.txt expand
[email protected]
  [email protected]
  my-awesome-laptop
[email protected]
  [email protected]
  my-awesome-laptop
  [email protected]
[email protected]
  [email protected]
  [email protected]
  my-awesome-laptop
[email protected]
  [email protected]
  [email protected]
  my-awesome-laptop
[email protected]
  [email protected]
  my-awesome-laptop

$ ./sshkey-audit --keys=keys.txt --groups=groups.txt --accounts=accounts.txt check
[… tool logs in to all accounts and checks that this is correct …]

$ ./sshkey-audit --keys=keys.txt --groups=groups.txt --accounts=accounts.txt --add_missing check
[… tool logs in to all accounts and adds any missing keys  …]

$ ./sshkey-audit --keys=keys.txt --groups=groups.txt --accounts=accounts.txt --delete_extra check
[… tool logs in to all accounts and deletes any extraneous keys  …]

$ # the 'fix' command is equal to 'check' with --add_missing and --delete_extra.

Adding the [email protected] key to allow logging in to [email protected] can sometimes be useful to ssh localhost.