You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jan 22, 2025. It is now read-only.
On a secured server that you wish to use to run the CA chatbot:
36
-
37
-
```bash
38
-
git clone git@github.com:keybase/bot-sshca.git
39
-
cd bot-sshca/docker/
40
-
cp env.sh.example env.sh
41
-
keybase signup # Creates a new Keybase user to use for the SSH CA bot
42
-
keybase paperkey # Generate a new paper key
43
-
# Create `{TEAM}.ssh.staging`, `{TEAM}.ssh.production`, `{TEAM}.ssh.root_everywhere` as new Keybase subteams
44
-
# and add the bot to those subteams. Add users to those subteams based off of the permissions you wish to grant
45
-
# different users
46
-
nano env.sh # Fill in the values including the previously generated paper key
47
-
make generate # Generate a new CA key
48
-
```
49
-
50
-
Running `make generate` will output a list of configuration steps to run on each server you wish to use with the CA chatbot.
51
-
These commands create a new user to use with kssh (the `developer` user), add the CA's public key to the server, and
52
-
configure the server to trust the public key.
53
-
54
-
Now you must define a mapping between Keybase teams the users and servers that they are
55
-
allowed to access. If you wish to make the user foo available to anyone in team.ssh.bar,
56
-
create the file `/etc/ssh/auth_principals/foo` with contents `team.ssh.bar`.
57
-
58
-
More concretely following the current example setup:
59
-
60
-
* For each server in your staging environment:
61
-
1. Create the file `/etc/ssh/auth_principals/root` with contents `{TEAM}.ssh.root_everywhere`
62
-
2. Create the file `/etc/ssh/auth_principals/developer` with contents `{TEAM}.ssh.staging`
63
-
* For each server in your production environment:
64
-
1. Create the file `/etc/ssh/auth_principals/root` with contents `{TEAM}.ssh.root_everywhere`
65
-
2. Create the file `/etc/ssh/auth_principals/developer` with contents `{TEAM}.ssh.production`
66
-
67
-
Now on the server where you wish to run the chatbot, start the chatbot itself:
68
-
69
-
```bash
70
-
make serve # Runs inside of docker for ease of use
71
-
```
72
-
73
-
Now download the kssh binary and start SSHing! See https://github.com/keybase/bot-sshca/releases to download the most
74
-
recent version of kssh for your platform.
75
-
76
-
```bash
77
-
sudo mv kssh-{platform} /usr/local/bin/kssh
78
-
sudo chmod +x /usr/local/bin/kssh
79
-
80
-
kssh developer@staging-server-ip # If in {TEAM}.ssh.staging
81
-
kssh developer@production-server-ip # If in {TEAM}.ssh.production
82
-
kssh root@server # If in {TEAM}.ssh.root_everywhere
83
-
```
84
-
85
-
We recommend building kssh yourself and distributing the binary among your team (perhaps in Keybase Files!).
86
-
87
-
# Network Architecture
88
-
89
-
Since all communication between the kssh client and the SSH CA server happens over Keybase chat, it is possible (and recommended)
90
-
to firewall off the SSH CA server so it cannot be reached from the general internet. Additionally, note that the SSH servers
91
-
that trust the SSH CA do not need to communicate with Keybase's servers or with the CA server and thus it is also possible
92
-
to firewall off the SSH servers from the general internet. Clients running kssh need to have Keybase running locally with
93
-
a connection to Keybase's servers.
94
-
95
-
# OS Support
96
-
97
-
It is recommended to run the server component of this bot on linux and running it in other environments is untested.
98
-
`kssh` is tested and works correctly on linux, macOS, and Windows. If running on windows, note that there is a dependency
99
-
on the `ssh` binary being in the path. This can be installed in a number of different ways including
100
-
[Chocolatey](https://chocolatey.org/packages/openssh) or the
101
-
[built in version](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse) on
102
-
modern versions of windows.
103
-
104
-
# Using kssh with jumpboxes and bastion hosts
105
-
106
-
kssh should work correctly with jumpboxes and bastion hosts as long as they are configured to trust the SSH CA and the usernames are correct. For example:
Note that this means that you do not need to modify your servers in any
8
+
way or run any additional processes on your servers other than a standard
9
+
OpenSSH daemon.
10
+
11
+
## Network Architecture
12
+
13
+
Since all communication between the kssh client and the SSH CA server happens over Keybase chat, it is possible (and recommended)
14
+
to firewall off the SSH CA server (where this bot is running) so it cannot be reached from the general internet. Additionally, note that the SSH servers
15
+
that trust the SSH CA do not need to communicate with Keybase's servers or with the CA server and thus it is also possible
16
+
to firewall off the SSH servers from the general internet. Clients running kssh need to have Keybase running locally with
kssh should work correctly with jumpboxes and bastion hosts as long as they are configured to trust the SSH CA and the usernames are correct. For example:
0 commit comments