Skip to content

Commit 353826f

Browse files
ddpbsdddpbsd
committed
updates
1 parent 722719e commit 353826f

File tree

16 files changed

+351
-20
lines changed

16 files changed

+351
-20
lines changed

‎_sources/elk/elastic/shards.rst.txt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
======
32
shards
43
======
@@ -82,3 +81,14 @@ But sometimes you just gotta.
8281
8382
cluster.routing.allocation.node_concurrent_recoveries
8483
84+
see the max shards per node
85+
^^^^^^^^^^^^^^^^^^^^^^^^^^^
86+
87+
`cluster.max_shards_per_node` default: `1000`
88+
89+
This will show up as `-1` which is unlimited
90+
91+
.. code-block:: console
92+
93+
GET _cluster/settings?include_defaults=true&filter-path=cluster.routing.allocation.total_shards_per_node
94+

‎_sources/openssh/certificates.rst.txt‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
==========================
2+
certificate authentication
3+
==========================
4+
5+
The basic instructions are coming from `How to Generate and Configure SSH Certificate-based Authentication <https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication>`_
6+
7+
Information on using a yubikey for the CA can be found at https://gist.github.com/jamesog/b156c7a85e7f95046ca8b95f6f857f70
8+
9+
Complicated PKI stuff.
10+
11+
* blah blah host signing key pair
12+
* user signing key pair
13+
14+
create the CA keypair
15+
^^^^^^^^^^^^^^^^^^^^^
16+
17+
The first set will be for signing host keys.
18+
19+
* ~~I do not know if it requires the `rsa` type, but I want to find out.~~ `rsa` is not required, better keys work
20+
* `-C host_ca` is a comment, and I think that's weak sauce.
21+
* If `rsa` keys are used, make sure to use a bigger keysize like `-b 4096`
22+
23+
.. code-block:: console
24+
25+
ssh-keygen -t ed25519 -f host_ca -C host_ca
26+
27+
And the pair for signing the user certs:
28+
29+
.. code-block:: console
30+
31+
ssh-keygen -t ed25519 -f user_ca -C user_ca
32+
33+
create a host key and sign it
34+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
35+
36+
Generate the key with `ssh-keygen`:
37+
38+
.. code-block:: console
39+
40+
ssh-keygen -f ssh_host_key -N '' -t ed25519
41+
42+
And finally sign it.
43+
44+
* `-I hostname` is the certificate's identity, using the hostname makes management easier
45+
* `-n hostname` is a comma-separated list of principals that will be valid, FQDN and/or short names that you'll be using are the proper values
46+
* `-V +52w` is the validity period, in thie case 52 weeks, if unset they will be valid forever
47+
48+
.. code-block:: console
49+
50+
ssh-keygen -s host_ca -I host.wafflelab.online -h -n host.wafflelab.online,host -V +52w ssh_host_key.pub
51+
52+
Add the following to the server's `sshd_config` and make sure to load the private key as well:
53+
54+
.. code-block:: console
55+
56+
HostCertificate /etc/ssh/ssh_host_key.pub
57+
HostKey /etc/ssh/ssh_host_key
58+
59+
.. warning::
60+
61+
Using the `Hostname` option in your ssh config file for a host can cause a mismatch between the host and the principals.
62+
For instance, I have the IP address for a host in the `Hostname` field, so SSHing to the system's hostname causes a mismatch.
63+
Commenting out that configuration option "fixes" the issue (as would adding the IP address to the principals).
64+
65+
create a user key and sign it
66+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
67+
68+
Generate the key as usual:
69+
70+
.. code-block:: console
71+
72+
ssh-keygen -f USER-user-key -t ed25519
73+
74+
And sign it:
75+
76+
.. code-block:: console
77+
78+
ssh-keygen -s user_ca -I USERNAME -n USERNAME -V +1d USER-user-key.pub
79+
80+
* `-s user_ca` is the key to sign with
81+
* `-I USERNAME` is something to identify the key, a username or email address makes it easy
82+
* `-n USERNAME` the accounts the user can use to login with
83+
* `-V 1d` is the validity time, a short one is preferable
84+
85+
check the options that a key was signed with
86+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
87+
88+
.. code-block:: console
89+
90+
ssh-keygen -L -f USER-user-key.pub
91+
92+
add the user_ca.pub file to the server's sshd_config
93+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
94+
95+
Add the following to the `/etc/sshd_config`:
96+
97+
.. code-block:: console
98+
99+
TrustedUserCAKeys /etc/ssh/user_ca.pub
100+
101+
Of course, you'll have to copy that file to that location.
102+

‎_sources/openssh/index.rst.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Contents:
1111
commands
1212
config
1313
keys
14+
certificates
1415
misc
1516
sftp
1617

‎_sources/openssh/keys.rst.txt‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
1-
.. _openssh_keys:
2-
31
========
42
SSH keys
53
========
64

7-
Determine the fingerprint of a key
5+
determine the fingerprint of a key
86
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
97

108
`ssh-keygen` can provide this information.
@@ -44,7 +42,7 @@ Put libfido2 into debug mode
4442
Forwarding
4543
==========
4644

47-
Agent Forwarding
45+
agent forwarding
4846
^^^^^^^^^^^^^^^^
4947

5048
`ssh-agent` must be running on the original client computer.
@@ -60,7 +58,7 @@ The key should be added to the `ssh-agent` on the original destination automagic
6058
This can be checked by running `ssh-add -l` on the destination.
6159
The key should be listed in the output.
6260

63-
Restrictive Agent Forwarding
61+
restrictive Agent Forwarding
6462
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6563

6664
To use the restrictive ForwardAgent, there must be a key in `known_hosts` that matches the hostname of all destinations.
@@ -81,5 +79,3 @@ First add a constraint for the original destination, then add further constraint
8179
8280
$ ssh-add -h "ix.example.com" -h "ix.example.com>vmconnect.example.com" .ssh/id_rsa
8381
84-
85-

‎elk/elastic/index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ <h1>elasticsearch<a class="headerlink" href="#elasticsearch" title="Link to this
7070
<li class="toctree-l2"><a class="reference internal" href="shards.html#get-all-shards">get all shards</a></li>
7171
<li class="toctree-l2"><a class="reference internal" href="shards.html#get-cluster-shard-status-along-with-curent-health">get cluster shard status along with curent health</a></li>
7272
<li class="toctree-l2"><a class="reference internal" href="shards.html#increase-the-number-of-shards-that-can-be-in-the-relocating-state">increase the number of shards that can be in the relocating state</a></li>
73+
<li class="toctree-l2"><a class="reference internal" href="shards.html#see-the-max-shards-per-node">see the max shards per node</a></li>
7374
</ul>
7475
</li>
7576
<li class="toctree-l1"><a class="reference internal" href="tasks.html">Tasks</a><ul>

‎elk/elastic/shards.html‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,14 @@ <h2>increase the number of shards that can be in the relocating state<a class="h
101101
</pre></div>
102102
</div>
103103
</section>
104+
<section id="see-the-max-shards-per-node">
105+
<h2>see the max shards per node<a class="headerlink" href="#see-the-max-shards-per-node" title="Link to this heading"></a></h2>
106+
<p><cite>cluster.max_shards_per_node</cite> default: <cite>1000</cite></p>
107+
<p>This will show up as <cite>-1</cite> which is unlimited</p>
108+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">GET _cluster/settings?include_defaults=true&amp;filter-path=cluster.routing.allocation.total_shards_per_node</span>
109+
</pre></div>
110+
</div>
111+
</section>
104112
</section>
105113

106114

‎index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ <h1>Welcome to ddpbsd’s notes!<a class="headerlink" href="#welcome-to-ddpbsd-s
7171
<li class="toctree-l2"><a class="reference internal" href="openssh/keys.html">SSH keys</a></li>
7272
<li class="toctree-l2"><a class="reference internal" href="openssh/keys.html#hardware-keys">Hardware Keys</a></li>
7373
<li class="toctree-l2"><a class="reference internal" href="openssh/keys.html#forwarding">Forwarding</a></li>
74+
<li class="toctree-l2"><a class="reference internal" href="openssh/certificates.html">certificate authentication</a></li>
7475
<li class="toctree-l2"><a class="reference internal" href="openssh/misc.html">Disconnect from an SSH session</a></li>
7576
<li class="toctree-l2"><a class="reference internal" href="openssh/misc.html#disconnect-from-a-nested-ssh-session">Disconnect from a nested SSH session</a></li>
7677
<li class="toctree-l2"><a class="reference internal" href="openssh/misc.html#x11-forwarding-not-working">X11 forwarding not working</a></li>

‎objects.inv‎

4 Bytes
Binary file not shown.

‎openssh/certificates.html‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
<!DOCTYPE html>
2+
3+
<html lang="en" data-content_root="../">
4+
<head>
5+
<meta charset="utf-8" />
6+
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
7+
8+
<title>certificate authentication &#8212; notes 0.1 documentation</title>
9+
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=03e43079" />
10+
<link rel="stylesheet" type="text/css" href="../_static/basic.css?v=b08954a9" />
11+
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=27fed22d" />
12+
<script src="../_static/documentation_options.js?v=2709fde1"></script>
13+
<script src="../_static/doctools.js?v=9bcbadda"></script>
14+
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
15+
<link rel="index" title="Index" href="../genindex.html" />
16+
<link rel="search" title="Search" href="../search.html" />
17+
<link rel="next" title="Disconnect from an SSH session" href="misc.html" />
18+
<link rel="prev" title="SSH keys" href="keys.html" />
19+
20+
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
21+
22+
23+
24+
25+
26+
</head><body>
27+
28+
29+
<div class="document">
30+
<div class="documentwrapper">
31+
<div class="bodywrapper">
32+
33+
34+
<div class="body" role="main">
35+
36+
<section id="certificate-authentication">
37+
<h1>certificate authentication<a class="headerlink" href="#certificate-authentication" title="Link to this heading"></a></h1>
38+
<p>The basic instructions are coming from <a class="reference external" href="https://goteleport.com/blog/how-to-configure-ssh-certificate-based-authentication">How to Generate and Configure SSH Certificate-based Authentication</a></p>
39+
<p>Information on using a yubikey for the CA can be found at <a class="reference external" href="https://gist.github.com/jamesog/b156c7a85e7f95046ca8b95f6f857f70">https://gist.github.com/jamesog/b156c7a85e7f95046ca8b95f6f857f70</a></p>
40+
<p>Complicated PKI stuff.</p>
41+
<ul class="simple">
42+
<li><p>blah blah host signing key pair</p></li>
43+
<li><p>user signing key pair</p></li>
44+
</ul>
45+
<section id="create-the-ca-keypair">
46+
<h2>create the CA keypair<a class="headerlink" href="#create-the-ca-keypair" title="Link to this heading"></a></h2>
47+
<p>The first set will be for signing host keys.</p>
48+
<ul class="simple">
49+
<li><p>~~I do not know if it requires the <cite>rsa</cite> type, but I want to find out.~~ <cite>rsa</cite> is not required, better keys work</p></li>
50+
<li><p><cite>-C host_ca</cite> is a comment, and I think that’s weak sauce.</p></li>
51+
<li><p>If <cite>rsa</cite> keys are used, make sure to use a bigger keysize like <cite>-b 4096</cite></p></li>
52+
</ul>
53+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -t ed25519 -f host_ca -C host_ca</span>
54+
</pre></div>
55+
</div>
56+
<p>And the pair for signing the user certs:</p>
57+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -t ed25519 -f user_ca -C user_ca</span>
58+
</pre></div>
59+
</div>
60+
</section>
61+
<section id="create-a-host-key-and-sign-it">
62+
<h2>create a host key and sign it<a class="headerlink" href="#create-a-host-key-and-sign-it" title="Link to this heading"></a></h2>
63+
<p>Generate the key with <cite>ssh-keygen</cite>:</p>
64+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -f ssh_host_key -N &#39;&#39; -t ed25519</span>
65+
</pre></div>
66+
</div>
67+
<p>And finally sign it.</p>
68+
<ul class="simple">
69+
<li><p><cite>-I hostname</cite> is the certificate’s identity, using the hostname makes management easier</p></li>
70+
<li><p><cite>-n hostname</cite> is a comma-separated list of principals that will be valid, FQDN and/or short names that you’ll be using are the proper values</p></li>
71+
<li><p><cite>-V +52w</cite> is the validity period, in thie case 52 weeks, if unset they will be valid forever</p></li>
72+
</ul>
73+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -s host_ca -I host.wafflelab.online -h -n host.wafflelab.online,host -V +52w ssh_host_key.pub</span>
74+
</pre></div>
75+
</div>
76+
<p>Add the following to the server’s <cite>sshd_config</cite> and make sure to load the private key as well:</p>
77+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">HostCertificate /etc/ssh/ssh_host_key.pub</span>
78+
<span class="go">HostKey /etc/ssh/ssh_host_key</span>
79+
</pre></div>
80+
</div>
81+
<div class="admonition warning">
82+
<p class="admonition-title">Warning</p>
83+
<p>Using the <cite>Hostname</cite> option in your ssh config file for a host can cause a mismatch between the host and the principals.
84+
For instance, I have the IP address for a host in the <cite>Hostname</cite> field, so SSHing to the system’s hostname causes a mismatch.
85+
Commenting out that configuration option “fixes” the issue (as would adding the IP address to the principals).</p>
86+
</div>
87+
</section>
88+
<section id="create-a-user-key-and-sign-it">
89+
<h2>create a user key and sign it<a class="headerlink" href="#create-a-user-key-and-sign-it" title="Link to this heading"></a></h2>
90+
<p>Generate the key as usual:</p>
91+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -f USER-user-key -t ed25519</span>
92+
</pre></div>
93+
</div>
94+
<p>And sign it:</p>
95+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -s user_ca -I USERNAME -n USERNAME -V +1d USER-user-key.pub</span>
96+
</pre></div>
97+
</div>
98+
<ul class="simple">
99+
<li><p><cite>-s user_ca</cite> is the key to sign with</p></li>
100+
<li><p><cite>-I USERNAME</cite> is something to identify the key, a username or email address makes it easy</p></li>
101+
<li><p><cite>-n USERNAME</cite> the accounts the user can use to login with</p></li>
102+
<li><p><cite>-V 1d</cite> is the validity time, a short one is preferable</p></li>
103+
</ul>
104+
</section>
105+
<section id="check-the-options-that-a-key-was-signed-with">
106+
<h2>check the options that a key was signed with<a class="headerlink" href="#check-the-options-that-a-key-was-signed-with" title="Link to this heading"></a></h2>
107+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">ssh-keygen -L -f USER-user-key.pub</span>
108+
</pre></div>
109+
</div>
110+
</section>
111+
<section id="add-the-user-ca-pub-file-to-the-server-s-sshd-config">
112+
<h2>add the user_ca.pub file to the server’s sshd_config<a class="headerlink" href="#add-the-user-ca-pub-file-to-the-server-s-sshd-config" title="Link to this heading"></a></h2>
113+
<p>Add the following to the <cite>/etc/sshd_config</cite>:</p>
114+
<div class="highlight-console notranslate"><div class="highlight"><pre><span></span><span class="go">TrustedUserCAKeys /etc/ssh/user_ca.pub</span>
115+
</pre></div>
116+
</div>
117+
<p>Of course, you’ll have to copy that file to that location.</p>
118+
</section>
119+
</section>
120+
121+
122+
</div>
123+
124+
</div>
125+
</div>
126+
<div class="sphinxsidebar" role="navigation" aria-label="Main">
127+
<div class="sphinxsidebarwrapper">
128+
<h1 class="logo"><a href="../index.html">notes</a></h1>
129+
130+
131+
132+
133+
134+
135+
136+
137+
<h3>Navigation</h3>
138+
<ul class="current">
139+
<li class="toctree-l1"><a class="reference internal" href="../db/index.html">databases</a></li>
140+
<li class="toctree-l1"><a class="reference internal" href="../elk/index.html">elastic stuff</a></li>
141+
<li class="toctree-l1 current"><a class="reference internal" href="index.html">OpenSSH</a><ul class="current">
142+
<li class="toctree-l2"><a class="reference internal" href="commands.html">Command note</a></li>
143+
<li class="toctree-l2"><a class="reference internal" href="commands.html#print-configuration">Print configuration</a></li>
144+
<li class="toctree-l2"><a class="reference internal" href="config.html">Automatically add ssh keys to ssh-agent</a></li>
145+
<li class="toctree-l2"><a class="reference internal" href="keys.html">SSH keys</a></li>
146+
<li class="toctree-l2"><a class="reference internal" href="keys.html#hardware-keys">Hardware Keys</a></li>
147+
<li class="toctree-l2"><a class="reference internal" href="keys.html#forwarding">Forwarding</a></li>
148+
<li class="toctree-l2 current"><a class="current reference internal" href="#">certificate authentication</a></li>
149+
<li class="toctree-l2"><a class="reference internal" href="misc.html">Disconnect from an SSH session</a></li>
150+
<li class="toctree-l2"><a class="reference internal" href="misc.html#disconnect-from-a-nested-ssh-session">Disconnect from a nested SSH session</a></li>
151+
<li class="toctree-l2"><a class="reference internal" href="misc.html#x11-forwarding-not-working">X11 forwarding not working</a></li>
152+
<li class="toctree-l2"><a class="reference internal" href="misc.html#get-a-fingerprint-from-a-public-key-in-your-known-hosts-file">get a fingerprint from a public key in your known_hosts file</a></li>
153+
<li class="toctree-l2"><a class="reference internal" href="sftp.html">message too long</a></li>
154+
</ul>
155+
</li>
156+
<li class="toctree-l1"><a class="reference internal" href="../operating_systems/index.html">Operating Systems</a></li>
157+
<li class="toctree-l1"><a class="reference internal" href="../ossec/index.html">OSSEC</a></li>
158+
<li class="toctree-l1"><a class="reference internal" href="../ssl/index.html">ssl</a></li>
159+
<li class="toctree-l1"><a class="reference internal" href="../stupid_unix_tricks/index.html">Stupid Unix Tricks</a></li>
160+
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Tools</a></li>
161+
<li class="toctree-l1"><a class="reference internal" href="../vendor_stuff/index.html">Vendor Stuff</a></li>
162+
<li class="toctree-l1"><a class="reference internal" href="../misc/index.html">misc</a></li>
163+
</ul>
164+
165+
<div class="relations">
166+
<h3>Related Topics</h3>
167+
<ul>
168+
<li><a href="../index.html">Documentation overview</a><ul>
169+
<li><a href="index.html">OpenSSH</a><ul>
170+
<li>Previous: <a href="keys.html" title="previous chapter">SSH keys</a></li>
171+
<li>Next: <a href="misc.html" title="next chapter">Disconnect from an SSH session</a></li>
172+
</ul></li>
173+
</ul></li>
174+
</ul>
175+
</div>
176+
<search id="searchbox" style="display: none" role="search">
177+
<h3 id="searchlabel">Quick search</h3>
178+
<div class="searchformwrapper">
179+
<form class="search" action="../search.html" method="get">
180+
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
181+
<input type="submit" value="Go" />
182+
</form>
183+
</div>
184+
</search>
185+
<script>document.getElementById('searchbox').style.display = "block"</script>
186+
</div>
187+
</div>
188+
<div class="clearer"></div>
189+
</div>
190+
<!-- your html code here -->
191+
<div class="footer">
192+
<em>This information has a good chance of being wrong, inconsistent, out of date, or just bad. Use at your own risk.
193+
Feel free to notify me of any issues though.</em>
194+
</div>
195+
196+
197+
</body>
198+
</html>

0 commit comments

Comments
 (0)