github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Updated user-managementm docs for ssh-keys plugin

Browse Source
This commit is contained in:
Justin Clark
2016-07-05 13:43:08 -07:00
parent c8405ddf34
commit 9aef528edc
1 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
docs/deployment/user-management.md
View File

@@ -1,40 +1,41 @@
# User Management # User Management
While it is possible to use password-based authorization to push to Dokku, it is preferable to use key-based authentication for security. When pushing to Dokku, ssh key based authorization is the preferred authentication method, for ease of use and increased security.
Users in dokku are managed via the `~/dokku/.ssh/authorized_keys` file. While you *can* manually edit this file, it is **highly** recommended that you follow the below steps to manage users on a dokku server. Users in Dokku are managed via the `~/dokku/.ssh/authorized_keys` file. It is **highly** recommended that you follow the steps below to manage users on a Dokku server.
## SSHCommand ## Dokku ssh-keys command
Dokku uses the [`sshcommand`](https://github.com/dokku/sshcommand) utility to manage ssh keys for the dokku user. The following is the usage output for sshcommand. The `dokku ssh-keys` command(s) allow you to manage ssh keys used to push to the Dokku server. The following is the usage output for `dokku ssh-keys`:
``` ```
sshcommand create <user> <command> # creates a user forced to run command when SSH connects $ dokku ssh-keys:help
sshcommand acl-add <user> <ssh-key-name> # adds named SSH key to user from STDIN Usage: dokku ssh-keys[:COMMAND]
sshcommand acl-remove <user> <ssh-key-name> # removes SSH key by name
sshcommand help # displays the usage help message Manage public ssh keys that are allowed to connect to Dokku
Additional commands:
ssh-keys:add <name> [/path/to/key] Add a new public key by pipe or path
ssh-keys:list List of all authorized Dokku public ssh keys
ssh-keys Manage public ssh keys that are allowed to connect to Dokku
ssh-keys:remove <name> Remove SSH public key by name
``` ```
In dokku's case, the `<user>` section is *always* `dokku`, as this is the system user that the dokku binary performs all it's actions. Keys are given unique names, which can be used in conjunction with the [user-auth](/dokku/development/plugin-triggers/#user-auth) plugin trigger to handle command authorization. Keys are given unique names, which can be used in conjunction with the [user-auth](/dokku/development/plugin-triggers/#user-auth) plugin trigger to handle command authorization. In Dokku's case, the unique _name_ is just for ease of identifying the keys, the ssh (git) user is *always* `dokku`, as this is the system user that the `dokku` binary uses to perform all it's actions.
## Adding deploy users ## Adding deploy users
You can add your public key to the dokku user's `~/dokku/.ssh/authorized_keys` file with the following command: You can add your public key to Dokku with the following command:
`NAME` is the username prefer to use to refer to this particular key. Including the word `admin` in the name will grant the user privileges to add additional keys remotely.
```shell ```shell
# from your local machine $ dokku ssh-keys:add <NAME> <PATH/TO/KEY>
# replace dokku.me with your domain name or the host's IP
# replace root with your server's root user
# USER is the username you use to refer to this particular key
cat ~/.ssh/id_rsa.pub | ssh root@dokku.me "sudo sshcommand acl-add dokku USER"
``` ```
At it's base, the `sshcommand` *must* be run under a user with sudo access, as it sets keys for the dokku user. Admin users and root can also add keys remotely:
For instance, if you stored your public key at `~/.ssh/id_rsa.pub-open` and are deploying to EC2 where the default root-enabled user is `ubuntu`, you can run the following command to add your key under the `superuser` username:
```shell ```shell
cat ~/.ssh/id_rsa.pub-open | ssh ubuntu@dokku.me "sudo sshcommand acl-add dokku superuser" cat <PATH/TO/KEY> | ssh dokku@dokku.me ssh-keys:add <NAME>
``` ```
If you are using the vagrant installation, you can also use the `make vagrant-acl-add` target to add your public key to dokku (it will use your host username as the `USER`): If you are using the vagrant installation, you can also use the `make vagrant-acl-add` target to add your public key to dokku (it will use your host username as the `USER`):