Dustin C. Hatch
88f165363d
The `ssh-bootstrap` script, which is run by the *ssh-bootstrap.service* systemd unit, requests SSH host certificates for each of the existing SSH host keys. The certificates are issued by the *POST /sshkeys/sign* operation of *dch-webhooks* web service. The *step-ssh-renew* timer/service runs `step ssh renew`, in a container, on a weekly basis to renew the SSH host certificate. A host certificate must already exist, and its private key is used to authenticate to the CA server. Since `step ssh renew` can only operate on one certificate/key file at a time, the `step-ssh-renew@.container` defines a template unit. The template instance specifies the key type (i.e. `rsa`, `ecdsa`, or `ed25519`), which in turn defines which certificate and private key file to use. The timer unit activates a target unit, which depends on the concrete service units. Note that the target unit must have `StopWhenUnneeded=yes` so that it can be restarted again the next time the timer fires.
36 lines
833 B
Bash
36 lines
833 B
Bash
#!/bin/sh
|
|
# vim: set sw=4 ts=4 sts=4 et :
|
|
|
|
gen_sshd_config() {
|
|
{
|
|
for x in ssh_host_*_key-cert.pub; do
|
|
printf 'HostCertificate /etc/ssh/%s\n' "${x}"
|
|
done
|
|
} > sshd_config.d/10-hostcertificate.conf
|
|
}
|
|
|
|
parse_response() {
|
|
jq -r '.certificates | to_entries | .[] | .key + " " + .value' \
|
|
| while read filename contents; do
|
|
[ -n "${filename}" ] || continue
|
|
echo "${contents}" > "${filename}" || return
|
|
done
|
|
}
|
|
|
|
request_sign() {
|
|
set -- \
|
|
https://bootstrap.pyrocufflink.blue/sshkeys/sign \
|
|
-H 'Accept: application/json' \
|
|
-F hostname=$(hostname -f)
|
|
for f in /etc/ssh/ssh_host_*_key.pub; do
|
|
set -- "$@" -F keys=@"${f}"
|
|
done
|
|
curl -fsSL "$@"
|
|
}
|
|
|
|
cd /etc/ssh || exit
|
|
request_sign | parse_response
|
|
gen_sshd_config
|
|
|
|
systemctl reload sshd
|