mrcharles
01197dd761
ci / audit (push) Failing after 39s
ED25519 user/host CA keys generated; enableSSHCA on JWK provisioner; 24h root principal cert issued and used to ssh into sectestbed 5104 (passwordless, no static key). Host onboarding = 1 file + reload. Rollout role queued in KNELIAC. Public CA key committed (private keys never leave tsys-ca). https://projects.knownelement.com/issues/385
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# SSH certificate CA runbook — step-ca on tsys-ca
|
|
|
|
> Ticket [#385](https://projects.knownelement.com/issues/385) · parent
|
|
> [#697](https://projects.knownelement.com/issues/697)/[#800](https://projects.knownelement.com/issues/800)
|
|
> Lane index https://community.turnsys.com/t/297
|
|
|
|
## Live state (2026-09-05)
|
|
|
|
- SSH CA enabled on the prod step-ca (same endpoint as ACME:
|
|
https://100.102.96.24:8443). Separate ED25519 signing keys:
|
|
`ssh_host_ca_key` + `ssh_user_ca_key` (in /opt/stepca-prod/data/secrets,
|
|
never leave the host). Public CA: `ssh-ca/fleet_user_ca.pub` in this repo
|
|
+ artifact mirror.
|
|
- Provisioner: JWK `admin` with `claims.enableSSHCA=true`.
|
|
- **VERIFIED e2e**: user cert (principal root, 24h) issued and used to SSH
|
|
into sectestbed 5104 — passwordless, no static key. PLAYBOOK RECORD in
|
|
journal of #385.
|
|
|
|
## Host onboarding (one file + one reload)
|
|
|
|
install -m 644 fleet_user_ca.pub /etc/ssh/fleet_user_ca.pub
|
|
echo "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub" > /etc/ssh/sshd_config.d/99-fleet-ca.conf
|
|
systemctl reload sshd
|
|
|
|
Rollout to the fleet = KNELIAC role (queued; sectestbed wave first, then
|
|
prod hosts under GLPI CR).
|
|
|
|
## Client flow (operators + automation)
|
|
|
|
step ssh certificate root-cert ./id_root --principal root \
|
|
--provisioner admin --provisioner-password-file <pw> \
|
|
--ca-url https://100.102.96.24:8443 --root fleet-root.crt \
|
|
--not-after 24h
|
|
ssh -i ./id_root -o CertificateFile=./id_root-cert.pub root@<host>
|
|
|
|
Better UX once keyed hosts trust the CA: `step ssh login` (agent-managed,
|
|
`step ssh` known-hosts propagation via `--ssh` host templates — queued).
|
|
|
|
## Hardening TODO (before prod wave)
|
|
|
|
- host certificates (`--host`) + sshd HostCertificate so CLIENTS also
|
|
verify servers (kills TOFU).
|
|
- JWK admin provisioner → per-operator provisioners; automation gets a
|
|
dedicated provisioner with restricted principals + short TTLs.
|
|
- Enable `--acme-strict-fqdn`-style hygiene: review principals allowed.
|