Hacker News Reader

In terms of the problem of removing SSH public keys from authorized_keys, etc we solve that problem by means of Ansible. If a developer leaves the company, he/she is removed and that Ansible task is applied to all the servers. Works fine too.

View on HN

This. The author presents a different solution which is equally not scalable without automation and suggests you automate his new layer instead of just using ansible to automate handling of ssh keys.

And certificate revocation lists (CRLs) are potentially more brittle in my experience, too.

It’s pretty easy to audit a server for a key in a file or a key file on disk.

Hi, I'm new at using ansible. This is the module you're referring to right?

https://docs.ansible.com/ansible/latest/collections/ansible/...

Actually we wrote our own, just leveraging built in modules within Ansible, but that one looks good. Give it a shot, and loop through a datasource e.g a variable.

Reply on news.ycombinator.com