Skip to content

Commit 3020d04

Browse files
ddpbsdddpbsd
committed
updates to ssh cert stuff
1 parent c9b9540 commit 3020d04

File tree

10 files changed

+212
-13
lines changed

10 files changed

+212
-13
lines changed

‎_sources/misc/mynet/pine.rst.txt‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
====
2+
pine
3+
====
4+
5+
Stuff for pine.
6+
7+
fstab
8+
^^^^^
9+
10+
.. code-block:: console
11+
12+
e344b2be6eb2cce4.b none swap sw
13+
e344b2be6eb2cce4.a / ffs rw 1 1
14+
e344b2be6eb2cce4.k /home ffs rw,nodev,nosuid 1 2
15+
e344b2be6eb2cce4.d /tmp ffs rw,nodev,nosuid 1 2
16+
e344b2be6eb2cce4.f /usr ffs rw,nodev 1 2
17+
e344b2be6eb2cce4.g /usr/X11R6 ffs rw,nodev 1 2
18+
e344b2be6eb2cce4.h /usr/local ffs rw,wxallowed,nodev 1 2
19+
e344b2be6eb2cce4.e /var ffs rw,nodev,nosuid 1 2
20+
e344b2be6eb2cce4.j /var/log-backup ffs rw,nodev,nosuid 1 2
21+
swap /var/log mfs rw,nodev,nosuid,-s=200m,-P=/var/log-backup 0 0
22+
77a302db418c8098.d /usr/src ffs rw,nodev,softdep,noauto 0 0
23+
77a302db418c8098.e /usr/ports ffs rw,nodev,softdep,noauto 0 0
24+

‎_sources/openssh/certificates.rst.txt‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Add the following to the server's `sshd_config` and make sure to load the privat
5353

5454
.. code-block:: console
5555
56-
HostCertificate /etc/ssh/ssh_host_key.pub
56+
HostCertificate /etc/ssh/ssh_host_key-cert.pub
5757
HostKey /etc/ssh/ssh_host_key
5858
5959
.. warning::
@@ -62,6 +62,17 @@ Add the following to the server's `sshd_config` and make sure to load the privat
6262
For instance, I have the IP address for a host in the `Hostname` field, so SSHing to the system's hostname causes a mismatch.
6363
Commenting out that configuration option "fixes" the issue (as would adding the IP address to the principals).
6464

65+
check the host cert
66+
^^^^^^^^^^^^^^^^^^^
67+
68+
Add the following to your `known_hosts` file to specify the public CA cert as one to use as a `cert-authority`:
69+
70+
.. code-block:: console
71+
72+
@cert-authority HOSTNAME ssh-ed25519 ...
73+
74+
Change `HOSTNAME` to something that identifies the hosts that will use that CA.
75+
6576
create a user key and sign it
6677
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6778

@@ -82,6 +93,17 @@ And sign it:
8293
* `-n USERNAME` the accounts the user can use to login with
8394
* `-V 1d` is the validity time, a short one is preferable
8495

96+
adjust the user's config
97+
^^^^^^^^^^^^^^^^^^^^^^^^
98+
99+
`CertificateFile` and `IdentityFile` should be added to your `.ssh/config` file for the appropriate host.
100+
These will be passed to the server for authentication and verification.
101+
102+
.. code-block:: console
103+
104+
CertificateFile ~/.ssh/id_ed25591-cert.pub
105+
IdentityFile ~/.ssh/id_ed25519
106+
85107
check the options that a key was signed with
86108
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
87109

@@ -98,5 +120,5 @@ Add the following to the `/etc/sshd_config`:
98120
99121
TrustedUserCAKeys /etc/ssh/user_ca.pub
100122
101-
Of course, you'll have to copy that file to that location.
123+
Of course, you'll have to copy this CA file to the specified location.
102124

‎_sources/operating_systems/linux/systemd/systemctl.rst.txt‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,20 @@ show enabled but not running services
77

88
`failed` is probably the state I'm really curious about.
99

10-
```
11-
systemctl list-units -all --state=inactive
12-
systemctl list-units -all --state=failed
13-
```
10+
.. code-block:: console
11+
12+
systemctl list-units -all --state=inactive
13+
systemctl list-units -all --state=failed
14+
15+
check if a service is running
16+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
17+
18+
.. code-block:: console
19+
20+
systemctl is-active SERVICENAME
21+
## or quietly
22+
systemctl is-active --quiet SERVICENAME
23+
1424
1525
systemctl enable SOMETHING.something: "Failed to execute operation: No such file or directory"
1626
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

‎misc/mynet/pine.html‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
<!DOCTYPE html>
2+
3+
<html lang="en" data-content_root="../../">
4+
<head>
5+
<meta charset="utf-8" />
6+
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
7+
8+
<title>pine &#8212; notes 0.1 documentation</title>
9+
<link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=03e43079" />
10+
<link rel="stylesheet" type="text/css" href="../../_static/basic.css?v=b08954a9" />
11+
<link rel="stylesheet" type="text/css" href="../../_static/alabaster.css?v=27fed22d" />
12+
<script src="../../_static/documentation_options.js?v=2709fde1"></script>
13+
<script src="../../_static/doctools.js?v=9bcbadda"></script>
14+
<script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
15+
<link rel="index" title="Index" href="../../genindex.html" />
16+
<link rel="search" title="Search" href="../../search.html" />
17+
18+
<link rel="stylesheet" href="../../_static/custom.css" type="text/css" />
19+
20+
21+
22+
23+
24+
</head><body>
25+
26+
27+
<div class="document">
28+
<div class="documentwrapper">
29+
<div class="bodywrapper">
30+
31+
32+
<div class="body" role="main">
33+
34+
<section id="pine">
35+
<h1>pine<a class="headerlink" href="#pine" title="Link to this heading"></a></h1>
36+
<p>Stuff for pine.</p>
37+
<section id="fstab">
38+
<h2>fstab<a class="headerlink" href="#fstab" title="Link to this heading"></a></h2>
39+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">e344b2be6eb2cce4.b none swap sw</span>
40+
<span class="go">e344b2be6eb2cce4.a / ffs rw 1 1</span>
41+
<span class="go">e344b2be6eb2cce4.k /home ffs rw,nodev,nosuid 1 2</span>
42+
<span class="go">e344b2be6eb2cce4.d /tmp ffs rw,nodev,nosuid 1 2</span>
43+
<span class="go">e344b2be6eb2cce4.f /usr ffs rw,nodev 1 2</span>
44+
<span class="go">e344b2be6eb2cce4.g /usr/X11R6 ffs rw,nodev 1 2</span>
45+
<span class="go">e344b2be6eb2cce4.h /usr/local ffs rw,wxallowed,nodev 1 2</span>
46+
<span class="go">e344b2be6eb2cce4.e /var ffs rw,nodev,nosuid 1 2</span>
47+
<span class="go">e344b2be6eb2cce4.j /var/log-backup ffs rw,nodev,nosuid 1 2</span>
48+
<span class="go">swap /var/log mfs rw,nodev,nosuid,-s=200m,-P=/var/log-backup 0 0</span>
49+
<span class="go">77a302db418c8098.d /usr/src ffs rw,nodev,softdep,noauto 0 0</span>
50+
<span class="go">77a302db418c8098.e /usr/ports ffs rw,nodev,softdep,noauto 0 0</span>
51+
</pre></div>
52+
</div>
53+
</section>
54+
</section>
55+
56+
57+
</div>
58+
59+
</div>
60+
</div>
61+
<div class="sphinxsidebar" role="navigation" aria-label="Main">
62+
<div class="sphinxsidebarwrapper">
63+
<h1 class="logo"><a href="../../index.html">notes</a></h1>
64+
65+
66+
67+
68+
69+
70+
71+
72+
<h3>Navigation</h3>
73+
<ul>
74+
<li class="toctree-l1"><a class="reference internal" href="../../db/index.html">databases</a></li>
75+
<li class="toctree-l1"><a class="reference internal" href="../../elk/index.html">elastic stuff</a></li>
76+
<li class="toctree-l1"><a class="reference internal" href="../../openssh/index.html">OpenSSH</a></li>
77+
<li class="toctree-l1"><a class="reference internal" href="../../operating_systems/index.html">Operating Systems</a></li>
78+
<li class="toctree-l1"><a class="reference internal" href="../../ossec/index.html">OSSEC</a></li>
79+
<li class="toctree-l1"><a class="reference internal" href="../../ssl/index.html">ssl</a></li>
80+
<li class="toctree-l1"><a class="reference internal" href="../../stupid_unix_tricks/index.html">Stupid Unix Tricks</a></li>
81+
<li class="toctree-l1"><a class="reference internal" href="../../tools/index.html">Tools</a></li>
82+
<li class="toctree-l1"><a class="reference internal" href="../../vendor_stuff/index.html">Vendor Stuff</a></li>
83+
<li class="toctree-l1"><a class="reference internal" href="../index.html">misc</a></li>
84+
</ul>
85+
86+
<div class="relations">
87+
<h3>Related Topics</h3>
88+
<ul>
89+
<li><a href="../../index.html">Documentation overview</a><ul>
90+
</ul></li>
91+
</ul>
92+
</div>
93+
<search id="searchbox" style="display: none" role="search">
94+
<h3 id="searchlabel">Quick search</h3>
95+
<div class="searchformwrapper">
96+
<form class="search" action="../../search.html" method="get">
97+
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
98+
<input type="submit" value="Go" />
99+
</form>
100+
</div>
101+
</search>
102+
<script>document.getElementById('searchbox').style.display = "block"</script>
103+
</div>
104+
</div>
105+
<div class="clearer"></div>
106+
</div>
107+
<!-- your html code here -->
108+
<div class="footer">
109+
<em>This information has a good chance of being wrong, inconsistent, out of date, or just bad. Use at your own risk.
110+
Feel free to notify me of any issues though.</em>
111+
</div>
112+
113+
114+
</body>
115+
</html>

‎objects.inv‎

11 Bytes
Binary file not shown.

‎openssh/certificates.html‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ <h2>create a host key and sign it<a class="headerlink" href="#create-a-host-key-
7474
</pre></div>
7575
</div>
7676
<p>Add the following to the server’s <cite>sshd_config</cite> and make sure to load the private key as well:</p>
77-
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">HostCertificate /etc/ssh/ssh_host_key.pub</span>
77+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">HostCertificate /etc/ssh/ssh_host_key-cert.pub</span>
7878
<span class="go">HostKey /etc/ssh/ssh_host_key</span>
7979
</pre></div>
8080
</div>
@@ -85,6 +85,14 @@ <h2>create a host key and sign it<a class="headerlink" href="#create-a-host-key-
8585
Commenting out that configuration option “fixes” the issue (as would adding the IP address to the principals).</p>
8686
</div>
8787
</section>
88+
<section id="check-the-host-cert">
89+
<h2>check the host cert<a class="headerlink" href="#check-the-host-cert" title="Link to this heading"></a></h2>
90+
<p>Add the following to your <cite>known_hosts</cite> file to specify the public CA cert as one to use as a <cite>cert-authority</cite>:</p>
91+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">@cert-authority HOSTNAME ssh-ed25519 ...</span>
92+
</pre></div>
93+
</div>
94+
<p>Change <cite>HOSTNAME</cite> to something that identifies the hosts that will use that CA.</p>
95+
</section>
8896
<section id="create-a-user-key-and-sign-it">
8997
<h2>create a user key and sign it<a class="headerlink" href="#create-a-user-key-and-sign-it" title="Link to this heading"></a></h2>
9098
<p>Generate the key as usual:</p>
@@ -102,6 +110,15 @@ <h2>create a user key and sign it<a class="headerlink" href="#create-a-user-key-
102110
<li><p><cite>-V 1d</cite> is the validity time, a short one is preferable</p></li>
103111
</ul>
104112
</section>
113+
<section id="adjust-the-user-s-config">
114+
<h2>adjust the user’s config<a class="headerlink" href="#adjust-the-user-s-config" title="Link to this heading"></a></h2>
115+
<p><cite>CertificateFile</cite> and <cite>IdentityFile</cite> should be added to your <cite>.ssh/config</cite> file for the appropriate host.
116+
These will be passed to the server for authentication and verification.</p>
117+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">CertificateFile ~/.ssh/id_ed25591-cert.pub</span>
118+
<span class="go">IdentityFile ~/.ssh/id_ed25519</span>
119+
</pre></div>
120+
</div>
121+
</section>
105122
<section id="check-the-options-that-a-key-was-signed-with">
106123
<h2>check the options that a key was signed with<a class="headerlink" href="#check-the-options-that-a-key-was-signed-with" title="Link to this heading"></a></h2>
107124
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -L -f USER-user-key.pub</span>
@@ -114,7 +131,7 @@ <h2>add the user_ca.pub file to the server’s sshd_config<a class="headerlink"
114131
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">TrustedUserCAKeys /etc/ssh/user_ca.pub</span>
115132
</pre></div>
116133
</div>
117-
<p>Of course, you’ll have to copy that file to that location.</p>
134+
<p>Of course, you’ll have to copy this CA file to the specified location.</p>
118135
</section>
119136
</section>
120137

‎openssh/index.html‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ <h1>OpenSSH<a class="headerlink" href="#openssh" title="Link to this heading">¶
5959
<li class="toctree-l1"><a class="reference internal" href="certificates.html">certificate authentication</a><ul>
6060
<li class="toctree-l2"><a class="reference internal" href="certificates.html#create-the-ca-keypair">create the CA keypair</a></li>
6161
<li class="toctree-l2"><a class="reference internal" href="certificates.html#create-a-host-key-and-sign-it">create a host key and sign it</a></li>
62+
<li class="toctree-l2"><a class="reference internal" href="certificates.html#check-the-host-cert">check the host cert</a></li>
6263
<li class="toctree-l2"><a class="reference internal" href="certificates.html#create-a-user-key-and-sign-it">create a user key and sign it</a></li>
64+
<li class="toctree-l2"><a class="reference internal" href="certificates.html#adjust-the-user-s-config">adjust the user’s config</a></li>
6365
<li class="toctree-l2"><a class="reference internal" href="certificates.html#check-the-options-that-a-key-was-signed-with">check the options that a key was signed with</a></li>
6466
<li class="toctree-l2"><a class="reference internal" href="certificates.html#add-the-user-ca-pub-file-to-the-server-s-sshd-config">add the user_ca.pub file to the server’s sshd_config</a></li>
6567
</ul>

‎operating_systems/linux/systemd/index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ <h1>systemd<a class="headerlink" href="#systemd" title="Link to this heading">¶
4646
</li>
4747
<li class="toctree-l1"><a class="reference internal" href="systemctl.html">systemctl</a><ul>
4848
<li class="toctree-l2"><a class="reference internal" href="systemctl.html#show-enabled-but-not-running-services">show enabled but not running services</a></li>
49+
<li class="toctree-l2"><a class="reference internal" href="systemctl.html#check-if-a-service-is-running">check if a service is running</a></li>
4950
<li class="toctree-l2"><a class="reference internal" href="systemctl.html#systemctl-enable-something-something-failed-to-execute-operation-no-such-file-or-directory">systemctl enable SOMETHING.something: “Failed to execute operation: No such file or directory”</a></li>
5051
<li class="toctree-l2"><a class="reference internal" href="systemctl.html#bus-error-blah-blah">bus error blah blah</a></li>
5152
</ul>

‎operating_systems/linux/systemd/systemctl.html‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,18 @@ <h1>systemctl<a class="headerlink" href="#systemctl" title="Link to this heading
3838
<section id="show-enabled-but-not-running-services">
3939
<h2>show enabled but not running services<a class="headerlink" href="#show-enabled-but-not-running-services" title="Link to this heading"></a></h2>
4040
<p><cite>failed</cite> is probably the state I’m really curious about.</p>
41-
<p><code class="docutils literal notranslate"><span class="pre">`</span>
42-
<span class="pre">systemctl</span> <span class="pre">list-units</span> <span class="pre">-all</span> <span class="pre">--state=inactive</span>
43-
<span class="pre">systemctl</span> <span class="pre">list-units</span> <span class="pre">-all</span> <span class="pre">--state=failed</span>
44-
<span class="pre">`</span></code></p>
41+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">systemctl list-units -all --state=inactive</span>
42+
<span class="go">systemctl list-units -all --state=failed</span>
43+
</pre></div>
44+
</div>
45+
</section>
46+
<section id="check-if-a-service-is-running">
47+
<h2>check if a service is running<a class="headerlink" href="#check-if-a-service-is-running" title="Link to this heading"></a></h2>
48+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">systemctl is-active SERVICENAME</span>
49+
<span class="gp">#</span><span class="c1"># or quietly</span>
50+
<span class="go">systemctl is-active --quiet SERVICENAME</span>
51+
</pre></div>
52+
</div>
4553
</section>
4654
<section id="systemctl-enable-something-something-failed-to-execute-operation-no-such-file-or-directory">
4755
<h2>systemctl enable SOMETHING.something: “Failed to execute operation: No such file or directory”<a class="headerlink" href="#systemctl-enable-something-something-failed-to-execute-operation-no-such-file-or-directory" title="Link to this heading"></a></h2>

‎searchindex.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)