tegwick
c31d70b53f
Deploy TrustedUserCAKeys, auth_principals from ssh_principals.yaml, and Makefile targets bootstrap-ssh-ca / bootstrap-ssh-ca-host (NET-WP-0020 T5).
86 lines
2.4 KiB
YAML
86 lines
2.4 KiB
YAML
---
|
|
- name: Require SSH CA public key path
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ssh_ca_pubkey_path is defined
|
|
- ssh_ca_pubkey_path | length > 0
|
|
fail_msg: >-
|
|
Set ssh_ca_pubkey_path to the OpenBao SSH CA public key file
|
|
(from railiance-platform openbao-configure-ssh).
|
|
|
|
- name: Stat SSH CA public key source
|
|
ansible.builtin.stat:
|
|
path: "{{ ssh_ca_pubkey_path }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: ssh_ca_pubkey_stat
|
|
|
|
- name: Fail when SSH CA public key is missing
|
|
ansible.builtin.fail:
|
|
msg: "SSH CA public key not found on controller: {{ ssh_ca_pubkey_path }}"
|
|
when: not ssh_ca_pubkey_stat.stat.exists
|
|
|
|
- name: Ensure SSH CA directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/ca
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Install SSH user CA public key
|
|
ansible.builtin.copy:
|
|
src: "{{ ssh_ca_pubkey_path }}"
|
|
dest: /etc/ssh/ca/ca_user.pub
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart sshd
|
|
|
|
- name: Configure SSH certificate trust
|
|
ansible.builtin.copy:
|
|
dest: /etc/ssh/sshd_config.d/20-ssh-ca.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
TrustedUserCAKeys /etc/ssh/ca/ca_user.pub
|
|
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u
|
|
notify: Restart sshd
|
|
|
|
- name: Ensure auth_principals directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/auth_principals
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Resolve principals for this host
|
|
ansible.builtin.set_fact:
|
|
ssh_ca_host_principals: >-
|
|
{{
|
|
(ssh_principals[inventory_hostname].users
|
|
if ssh_principals is defined
|
|
and inventory_hostname in ssh_principals
|
|
else {})
|
|
}}
|
|
|
|
- name: Deploy auth_principals files per user
|
|
ansible.builtin.copy:
|
|
dest: "/etc/ssh/auth_principals/{{ item.key }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: "{{ item.value | join('\n') }}\n"
|
|
loop: "{{ ssh_ca_host_principals | dict2items }}"
|
|
when: ssh_ca_host_principals | length > 0
|
|
notify: Restart sshd
|
|
|
|
- name: Warn when no principals configured for host
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
No principals in ssh_principals.yaml for {{ inventory_hostname }} —
|
|
CA trust installed; add users under hosts.<name>.users to enable cert login.
|
|
when: ssh_ca_host_principals | length == 0
|