adding ssh host signing

2026-07-11 16:20:21 +09:30
parent b5d6c790c4
commit 2e318fba00
24 changed files with 1626 additions and 90 deletions
@@ -0,0 +1,33 @@
+# fleet-ssh-hostcert configuration — fleet-generic (no per-host data; invariant #1).
+# The host's SSH host key is signed by the fleet SSH CA (via the enrol-broker) so
+# admins trust every host with one `@cert-authority` line instead of per-boot TOFU
+# (F-02/P-17). Replace the DNS names per environment; the serving dnsmasq resolves
+# them. docs/ssh-host-certificate-design.md.
+
+# The enrol-broker's HOST PLANE endpoint (mTLS). The host authenticates with its
+# TPM identity; the broker (not the host) holds the step-ca provisioner credential
+# and signs the SSH host cert, keeping step-ca behind the single front door.
+SSH_HOSTCERT_BROKER_URL=https://boot.fleet.lab:9444/ssh/hostcert
+
+# Fleet CA bundle: verifies the broker's server cert. Same anchor as the RADIUS /
+# agent CA — reuse the one placeholder, replace per environment.
+SSH_HOSTCERT_CACERT=/etc/dot1x/radius-ca.pem
+
+# TPM identity (same key/cert as 802.1X, the NVMe hostnqn and agent mTLS) — used
+# as the mTLS CLIENT cert proving this is an enrolled host.
+SSH_HOSTCERT_HANDLE=0x81000100
+SSH_HOSTCERT_NVINDEX=0x01800100
+
+# The per-boot host key to certify and where its certificate is installed.
+SSH_HOSTCERT_HOSTKEY=/etc/ssh/ssh_host_ecdsa_key.pub
+SSH_HOSTCERT_OUT=/etc/ssh/ssh_host_ecdsa_key-cert.pub
+SSH_HOSTCERT_DROPIN=/etc/ssh/sshd_config.d/60-hostcert.conf
+
+# Cert principals. Empty => the binary uses the host's hostname (derived at
+# runtime, never baked). Set a comma list to add e.g. a per-env FQDN or wildcard
+# that admins connect by (must be covered by their `@cert-authority` line and
+# authorised by the broker's principal policy).
+SSH_HOSTCERT_PRINCIPALS=
+
+# Reload sshd after installing/renewing the cert so it takes effect immediately.
+SSH_HOSTCERT_RELOAD=true