Search code examples
githubssh-keys

Deploy one SSH key for the entire organization


Is it possible to deploy one SSH key on organization level? That is, using this key the user would be able to access all repositories under this organization.

I tried to use the same key for multiple repositories but it's not possible (GitHub says key is already in use)

Thanks.


Solution

  • Probably not, and for good reasons. SSH keys should be unique and private per user. This is both for identification and security.

    Your ssh key is how Github identifies you. When you connect to Github via SSH you use a URL like git@github.com:org/repo.git. The git@ part means you, and everyone else, is connecting as the git user. Github identifies your account with your SSH key. If everyone in your project had the same ssh key Github couldn't tell you apart.

    Sharing authentication is poor security practice, whether it's passwords or keys. When someone leaves a project they should have their authentications revoked. If you have individual keys that's easy and routine. If everyone shares one ssh key then you need to distribute a new shared ssh key to everyone, wait until (or hope) everyone has updated, and revoke the old shared key. You also need to find all the places the shared key might have been installed and replace them with the new key.

    More likely this will be seen as a hassle and the project will go on using the now potentially compromised shared key.

    With individual keys if a key is compromised the damage is limited to what that one key could access. And, again, replacing the compromised key is simple. The compromised key can be immediately revoked while only inconveniencing one user. A compromised shared key effects your entire project. The attacker has access to everyone's accounts. Revoking the compromised key shuts down the entire project until a replacement is distributed; and this might make security hesitate to revoke the key.