diff --git a/tls_docs/ssh_ca/ssh_certs.md b/tls_docs/ssh_ca/ssh_certs.md index 6925a74..d48031e 100644 --- a/tls_docs/ssh_ca/ssh_certs.md +++ b/tls_docs/ssh_ca/ssh_certs.md @@ -156,25 +156,34 @@ case $CHOICE in "${HOST_CA}/hosts/${NAME}.pub" clear - echo "Reviewing HOST Certificate for ${NAME}:" - ssh-keygen -L -f "${HOST_CA}/hosts/${NAME}-cert.pub" - + cat << EOF **************************************************************************** ************************* Copy to Remote Host ****************************** **************************************************************************** +Host Certificate for ${NAME} +------------------------------------- +$(ssh-keygen -L -f "${HOST_CA}/hosts/${NAME}-cert.pub") +------------------------------------------ + ${NAME} Private Key -cat ${HOST_CA}/hosts/${NAME} +$(cat ${HOST_CA}/hosts/${NAME}) chmod 400 /etc/ssh/${NAME} -- + ${NAME} Public Key and Certificate +---------------------------------- echo "$(cat "${HOST_CA}/hosts/${NAME}.pub")" > /etc/ssh/${NAME}.pub echo "$(cat "${HOST_CA}/hosts/${NAME}-cert.pub")" > /etc/ssh/${NAME}-cert.pub -- + Trusted User CA +--------------- echo "$(cat "${USER_CA}/${USER_CA_KEY}.pub")" > /etc/ssh/${USER_CA_KEY}.pub -- + Edit ${NAME} sshd_config +------------------------ echo "HostKey /etc/ssh/${NAME}" >> /etc/ssh/sshd_config echo "HostCertificate /etc/ssh/${NAME}-cert.pub" >> /etc/ssh/sshd_config echo "TrustedUserCAKeys /etc/ssh/${USER_CA_KEY}.pub" >> /etc/ssh/sshd_config @@ -200,25 +209,34 @@ EOF "${USER_CA}/users/${NAME}.pub" clear - echo "Reviewing ${NAME} Client Certificate:" - ssh-keygen -L -f "${USER_CA}/users/${NAME}-cert.pub" cat << EOF **************************************************************************** ************************* Copy to client *********************************** **************************************************************************** +"${NAME} Client Certificate:" +$(ssh-keygen -L -f "${USER_CA}/users/${NAME}-cert.pub") +-------------------------- + ${NAME} Private key +------------------- cat ${USER_CA}/users/${NAME} chmod 400 ~/.ssh/${NAME} -- + ${NAME} Public Key and Certificate +---------------------------------- echo "$(cat "${USER_CA}/users/${NAME}.pub")" > ~/.ssh/${NAME}.pub echo "$(cat "${USER_CA}/users/${NAME}-cert.pub")" > ~/.ssh/${NAME}-cert.pub -- + Add Trusted host CA to ~/.ssh/known_hosts (edit domain wildcard and hostnames/IPs) +---------------------------------------------------------------------------------- echo "@cert-authority * $(cat "${HOST_CA}/${HOST_CA_KEY}.pub")" >> ~/.ssh/known_hosts -- + ~/.ssh/config template +---------------------- Host *.domain.com 192.168.1.* 192.168.2.* 192.168.3.* IdentityFile ~/.ssh/username IdentitiesOnly yes