How to disable creating users in Google compute engine

Question

I've got a CoreOS cluster running on GCE and one issue that I've noticed with all GCE instances is that as long as you're auth'd with the project on Google Cloud platform, you'll be able to login in as just about anything on the servers.

This is a problem for me as anyone on the team, or anyone who gets into the project, can ssh right in as anyone to the server.

I would prefer to disable this and simply use users I've created in my cloud-config file that have such ssh keys and passwords that expire. How do I disable it?

Answer 1

You can stop a GCE instance from adding accounts by guaranteeing the google-account-manager service doesn't run.

On CoreOS you can stop this service with

sudo systemctl stop google-accounts-manager.service

and then disable it permanantly with

sudo systemctl disable google-accounts-manager.service.

You may need to create an image with the service pre-disabled (or even delete the unit file) so after you create instances it does not create accounts before you disable the service.