SSH Server Group Operations

To add or edit a new server group:

1. On the Server Groups tab, click Add or Edit.

   

   Figure 387: Add a Server Group

2. In the Add/Edit Server Group dialog, enter a name for the group in the Name field.

3. In the Owner dropdown, enter or select an Active Directory user with access to the Keyfactor Command Management Portal holding either the SSH Server Admin or SSH Enterprise Admin role (see SSH Permissions). Any users with one of these roles who have previously been made an owner on a server group or enrolled for an SSH key (see My SSH Key Operations) will appear in the Owner dropdown.

   Tip:  The owner can only be changed by a Keyfactor Command user who holds the SSH Enterprise Admin role (see SSH Permissions).
4. On an edit, the Server Group Id field will be viewable but cannot be modified. This GUID is useful when installing the Keyfactor Bash Orchestrator The Bash Orchestrator, one of Keyfactor's suite of orchestrators, is used to discover and manage SSH keys across an enterprise..

5. In the Schedule dropdown, select a frequency for the server synchronization job. Possible options are:

   • Interval—Enter an interval from every 1 minute to every 12 hours

   • Daily—Enter selected time

   • Weekly—Enter a selected day or days of the week at a selected time

   • Monthly—Enter a selected day of the month (1st through 27th) at a selected time

   Tip:  During initial configuration, you may want to set a short timeframe for job frequency and then extend it as the servers settle into a management routine.
6. If desired, check the Enforce Publish Policy box to set the server group to inventory and publish policy mode (see SSH).
7. Click Save to save the server group.

Using the Edit Access function you create mappings between Keyfactor Command user accounts associated with SSH keys and Linux logons in order to publish the SSH public keys to all the Linux servers that belong to the selected server group (see SSH). You can also remove the mappings from here, which causes the SSH public keys to be removed from the Linux servers belonging to the selected server group.

Before adding a logon to user mapping, be sure that you have switched either the server group or all servers in the group to which you will add your mapping to inventory and publish policy mode (see Server Manager) so that the key for the user will be published to the servers in the group. If the servers in the server group are in inventory only mode and you add a mapping for it in Keyfactor Command, the mapping will appear in Keyfactor Command only and the key for the user will not be published out to the servers in the server group. If only some servers in the server group are in inventory and publish policy mode, the key for the user will only be published to those servers.

To edit the access for a server group, create a mapping between a Linux logon and a Keyfactor Command user, and publish the user's key to all the SSH servers belonging to that server group:

1. In the Server groups grid, locate the server group that contains the servers you wish to publish an SSH key to by mapping a Keyfactor Command user to a Linux logon on that server group.
2. Right-click the server group and choose Edit Access from the right-click menu or highlight the row in the server groups grid and click Edit Access at the top of the grid.

   

   Figure 388: Edit Access for an SSH Server Group

3. On the Access Management page, select an existing Logon on the left side of the page. Logons only appear here if they exist with the same spelling on all servers in the server group. If you wish to add a new logon, enter the new logon name in the Logon field at the top of the left side of the page and click Add Logon. The new logon appears at the bottom of the Logon list. Click the Logon list title to sort the list, if desired. Select the new logon. Only one logon may be selected.

   Tip:   If you have enabled SSSD support for your Keyfactor Bash Orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. and are adding a domain user, specify the user in username@domain format. For example bbrown@keyexample.com (or, depending on SSSD configuration, such as the case-sensitivity setting; BBROWN@keyexample.com). Note that the logon may be modified by the SSSD configuration file in ways in which Keyfactor Command cannot know about. Refer to SSH-SSSD Case Sensitivity Flag for guidance on what to enter based on how the SSSD case sensitivity flag is configured.

4. In the Users dropdown at the top of the right side of the page, select a user or service account to associate the logon with. Only Keyfactor users that have keys stored in Keyfactor Command, that have been designated as server group owners, or AD users or groups that have been previously entered for association with a logon will appear in the dropdown. If desired, you may enter an Active Directory user or group name in this field. Using an Active Directory group to create Linux logon to Keyfactor user mappings will cause the keys stored in Keyfactor Command for any Active Directory users that are members of this group to be mapped to the selected Linux logon and published to the servers on which the Linux logon exists. Any Active Directory users that are members of this group but who do not have keys stored in Keyfactor Command will not be mapped to the selected Linux logon. Click Add User.

   Tip:  For keys created through the My SSH Key portal (see My SSH Key Operations), a Keyfactor user is an Active Directory user account. For keys created through the Service Account Keys page (see Service Account Key Operations), a Keyfactor user is a user-generated service account name of the form servicename@hostname The unique identifier that serves as name of a computer. It is sometimes presented as a fully qualified domain name (e.g. servername.keyexample.com) and sometimes just as a short name (e.g. servername)..
5. Repeat step 6 for any other user or service accounts that you wish to map to this logon on the servers in this server group.
6. Click Save.

To remove a mapping of a Linux logon to a Keyfactor Command user for all the servers in a server group, remove the public key In asymmetric cryptography, public keys are used together in a key pair with a private key. The private key is retained by the key's creator while the public key is widely distributed to any user or target needing to interact with the holder of the private key. from the Linux logon's authorized_keys files:

1. In the Server Groups grid, locate the server group that contains the servers you wish to remove an SSH key from by unmapping a Keyfactor Command user from a Linux logon on that server group.

2. Right-click the server group and choose Edit Access from the right-click menu or highlight the row in the server groups grid and click Edit Access at the top of the grid.

   

   Figure 389: Edit Access for an SSH Server

3. On the Access Management page, select a Logon on the left side of the page. Only one logon may be selected.

4. In the Users section on the right side of the page, select a user or service account to unmap from the logon. Click Remove Access under Users. The Linux logon to Keyfactor user mapping for the selected user will be removed and the user's SSH key will be removed from the authorized_keys files of the Linux logons on all the servers in the server group.

   Tip:  Clicking Remove Shared Access for Logon on the Logons side of the page removes all Linux logon to Keyfactor user mappings for the selected logon with one click without the need to select the users on the Users side of the page.

   If a logon has user mappings on some servers and not others in the group (see the example, below), these will not appear in the Server Group Edit dialog, and none of these user mappings will be removed. The Remove Shared Access for Logon option only removes user mappings that are visible in the Server Group Access dialog.

   This option does not delete the logon from any servers (see Add or Edit Access for an SSH Logon).

5. Repeat step 6 for any other user or service accounts that you wish to unmap from this logon on the servers in this server group.
6. Click Save.

To delete a server group, highlight the row in the server groups grid and click Delete at the top of the grid or right-click the group in the grid and choose Delete from the right-click menu.

To view the servers belonging to a server group, highlight the row in the server groups grid and click View Group Members at the top of the grid or right-click the group in the grid and choose View Group Members from the right-click menu. This will take you to the Servers tab with the advanced search populated by a query for the selected server group name.