john/janus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

variables

Browse Source
This commit is contained in:
John Lancaster
2026-01-04 11:03:58 -06:00
parent 7b7fba3f39
commit 6620d6c0a9
1 changed files with 30 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
scripts/ssh-server-check.sh
View File

@@ -4,6 +4,12 @@ GREEN_CHECK="\e[32m✔\e[0m"
RED_X="\e[31m✗\e[0m" RED_X="\e[31m✗\e[0m"
YELLOW_BANG="\e[33m!\e[0m" YELLOW_BANG="\e[33m!\e[0m"
SSH_CFG_DIR="/etc/ssh"
SSH_USER_CA="$SSH_CFG_DIR/ssh_user_ca.pub"
SSH_HOST_KEY="$SSH_CFG_DIR/ssh_host_ed25519_key"
SSH_HOST_PUBLIC_KEY="$SSH_HOST_KEY.pub"
SSH_HOST_CERT="$SSH_HOST_KEY-cert.pub"
# #
# Function Definition # Function Definition
# #
@@ -23,6 +29,18 @@ ssh_config_val() {
} }
sign_host_cert() {
local if="eth0"
local IP_ADDRESS=$(ip -4 addr show dev $if | awk '/inet /{print $2}' | cut -d/ -f1) && \
local hostname=$(hostname -s) && \
step ssh certificate --host --sign \
--principal "$hostname" \
--principal "$hostname.john-stream.com" \
--principal "$IP_ADDRESS" \
--provisioner admin \
"$hostname" "$SSH_HOST_PUBLIC_KEY"
}
check_ssh_files() { check_ssh_files() {
row_success() { row_success() {
@@ -113,6 +131,18 @@ check_cert_config() {
local base_dir="/etc/ssh/sshd_config.d" local base_dir="/etc/ssh/sshd_config.d"
local cfg_path="$base_dir/${1:-certs.conf}" local cfg_path="$base_dir/${1:-certs.conf}"
install_cert_config() {
mkdir -p $(dirname $cfg_path)
cat <<EOF > $cfg_path
TrustedUserCAKeys $SSH_USER_CA
HostKey $SSH_HOST_KEY
HostCertificate $SSH_HOST_CERT
EOF
echo -e "$GREEN_CHECK Configured sshd to use and accept SSH certs."
}
if [[ ! -e $cfg_path ]]; then if [[ ! -e $cfg_path ]]; then
echo -e "$YELLOW_BANG sshd not configured to use SSH certs" echo -e "$YELLOW_BANG sshd not configured to use SSH certs"
read -p "Do you want to configure sshd? (y/n) " -n 1 -r read -p "Do you want to configure sshd? (y/n) " -n 1 -r
@@ -124,22 +154,6 @@ check_cert_config() {
fi fi
} }
install_cert_config() {
local base_dir="/etc/ssh/sshd_config.d"
local cfg_path="${1:-$base_dir/certs.conf}"
mkdir -p $(dirname $cfg_path)
cat <<EOF > $cfg_path
TrustedUserCAKeys /etc/ssh/ssh_user_ca.pub
HostKey /etc/ssh/ssh_host_ed25519_key
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
EOF
echo -e "$GREEN_CHECK Configured sshd to use and accept SSH certs."
}
restart_sshd() { restart_sshd() {
if systemctl is-active --quiet sshd; then if systemctl is-active --quiet sshd; then
local sshd_pid=$(systemctl show --property MainPID --value sshd) local sshd_pid=$(systemctl show --property MainPID --value sshd)