Managing OS Accounts, Instances & Dynamic SSH Authentication

Overview

The LYNIO Cloud platform provides zero-trust, dynamic SSH authentication for Linux Virtual Machines. Instead of manually copying public SSH keys into /root/.ssh/authorized_keys or managing local user credentials across individual VMs, access is governed centrally via Lynio IAM:

1. User SSH Keys: Users upload their public SSH keys to their IAM profile under User Settings.
2. IAM Roles: Users are assigned one or more IAM Roles (e.g., SysAdmin, Developer, DevOps).
3. OS Accounts: OS Accounts define allowed Linux login usernames (e.g., sysadmin, ansible, deploy, postgres) and map them to IAM Roles.
4. VM Instances: VM Instances attach OS Accounts to grant access to authorized users automatically.
5. Dynamic Access Resolution: When an SSH connection is initiated, the guest agent validates access rules in real-time with the IAM platform and yields authorized public keys.

Console Operations

1. Creating and Managing OS Accounts

Navigate to Identity & Access Management > OS Accounts in the LYNIO Console.

• Create OS Account: Click Add OS Account. Enter a descriptive name (e.g., System Administrators), a description, and comma-separated Allowed OS Logins (e.g., sysadmin, ansible, deploy, postgres).
• View OS Account ID: The table displays the unique identifier (e.g., lid.osaccount.12345...) for API automation.
• Link IAM Roles: Click the Members/Roles icon (IconUsers) next to an OS Account row to link IAM Roles. Users holding any of the linked roles automatically gain SSH access for the allowed OS logins.

2. Registering VM Instances & Attaching OS Accounts

Under Identity & Access Management > OS Accounts, scroll to the Registered VM Instances section:

• Register Instance: Click Register Instance. Enter the Instance UID (e.g., lid.instance.378ec79d-4925-439b-a000-0c2e5ca485d6) and select which OS Accounts apply to this VM.
• Manage Attachments: Click the Edit icon next to any registered instance to attach or detach OS Accounts.

Testing Key Resolution

You can test SSH key retrieval on a registered instance using the guest CLI helper:

lynio-guest-agent ssh-auth sysadmin

If authorized users have uploaded active SSH keys and possess the necessary IAM Roles linked to the OS Account, the command outputs their public SSH keys.

HTTP API Reference

List OS Accounts

• Endpoint: GET /api/v1/os-accounts
• Description: Returns all OS Accounts defined within the tenant.

Create OS Account

• Endpoint: POST /api/v1/os-accounts
• Request Body:

  {
    "name": "System Administrators",
    "description": "Full access for infrastructure admins",
    "allowed_os_logins": ["sysadmin", "ansible", "deploy", "postgres"]
  }
  

Link Roles to OS Account

• Endpoint: POST /api/v1/os-accounts/:id/roles
• Request Body:

  {
    "role_ids": ["lid.role.admin", "lid.role.devops"]
  }
  

Register SSH Instance

• Endpoint: POST /api/v1/ssh-instances
• Request Body:

  {
    "id": "lid.instance.378ec79d-4925-439b-a000-0c2e5ca485d6",
    "account_ids": ["lid.osaccount.sysadmin"]
  }