Solutions for centralized user management, sessions recording and jump server login on Linux debian

Question

I am managing about 30 Linux (Ubuntu) servers and we have a team of 20 IT staff members. Different members have access to different servers.

Currently, we have one single user on each server and I'm adding public IP keys for each IT member on the server he needs to access. This is now becoming very hard to maintain especially for leaving employees where we need to maintain manual user lists.

I am looking for a centralized users management solution with session recording possibilities, and also a jump in server login. One jump server (+ one redundancy) will host the centralized users management. A web Gui is mandatory.

Until now, I have tested Keybox and Teleport. Currently reading about LDAP and FreeLPA.

• Keybox: works well but no direct ssh login possible, only through their web interface

• Teleport: WE're forced to use tlh instead of ssh, not sure our staff members would like and have time to install tsh, moreover, I didn' found tsh client for MAC

Looking froward to hearing from you.

Answer 1

It is common to use LDAP as access protocol for Linux user-management.

For more complex requirements, e.g. authorization based on host groups, you may want to use full-featured solutions more dedicated to Linux/Unix:

• FreeIPA using 389-DS as back-end, preferably with sssd
• Æ-DIR using OpenLDAP as back-end, with any NSS/PAM implementation for LDAP (like sssd or nss-pam-ldap also known as nslcd), or in large setups preferably with aehostd

With Æ-DIR it's also possible to define an authorizing SSH proxy.

Full disclosure: I'm the project maintainer behind Æ-DIR and therefore I'm biased of course.

If you really need session recording you could check out Scribery. The author also gave some intro talks at FOSDEM and FrosCON. I did not try myself yet.