Audiobuzz
28d31e436c
F-02/P-17 SSH host-cert flow was proven end-to-end on comet-beacon-54
(2026-07-11); these fix the correctness/scoping/cleanup defects the bench
surfaced:
- ssh-hostcert: derive the FQDN principal <hostname>.<domain> from the DHCP
search domain at runtime (resolv.conf), alongside the short hostname, so an
admin `@cert-authority *.<domain>` line accepts by-FQDN logins instead of
"name is not a listed principal". Never baked (invariant #1). + tests.
- ssh-ca-bootstrap.sh: export the SSH host CA public key in OpenSSH wire format
(ssh-keygen -i -m PKCS8), not the PEM/PKCS8 that `step crypto keypair` writes
-- a PEM @cert-authority anchor is unparseable and silently falls back to TOFU.
- ssh-ca-bootstrap.sh: fail loudly (and verify enableSSHCA=true) if the
provisioner SSH-enable step fails, instead of swallowing it and shipping a CA
that 502s every runtime sign.
- dot1x-bench: point the co-located broker at https://localhost:8443, not the
fleet dnsmasq name ca.fleet.lab (unresolvable from the broker's host netns ->
"no such host" at sign time). localhost is in the CA cert SAN.
- serving: remove the mock-signer enrol-broker copy -- two host-networked
brokers collide on 9090/9443 and the mock issued untrusted certs. The real
broker lives with step-ca (dot1x-bench); nginx /enrol/ still proxies to it on
loopback.
- enrol-broker: retire the HTML admin console; the fleet-manager passkey SPA now
drives the mTLS JSON API (/pending, /approve|deny). Removes a weaker,
client-cert-only parallel human-approve path.
Design-doc bench note deferred: docs/ssh-host-certificate-design.md lives on the
secure-ntp branch (fbb8100), not here -- to be added there / on reconcile.
153 lines
7.4 KiB
Bash
Executable File
153 lines
7.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ssh-ca-bootstrap.sh — enable the fleet SSH host CA so booted hosts can get their
|
|
# per-boot SSH HOST key signed VIA THE ENROL-BROKER (files/ssh-hostcert →
|
|
# fleet-ssh-hostcert → broker host plane → step-ca), killing per-boot TOFU
|
|
# (F-02 / POA&M P-17). Run ONCE after bootstrap.sh, from serving/dot1x-bench/.
|
|
# Pairs with docs/ssh-host-certificate-design.md.
|
|
#
|
|
# 1. enable step-ca's SSH CA (generate host+user CA keys; add the ssh block)
|
|
# 2. enable SSH host-cert issuance on the existing 'enrol' JWK provisioner
|
|
# (the broker already authenticates to step-ca with it)
|
|
# 3. issue the broker HOST-PLANE server cert (fleet-signed; the booted host
|
|
# verifies it against radius-ca.pem) + a root+intermediate client-CA bundle
|
|
# (verifies the host's TPM identity cert)
|
|
# 4. export the SSH HOST CA public key (-> the admin @cert-authority line)
|
|
#
|
|
# The signing path is BROKER-mediated: step-ca stays behind the single front door;
|
|
# hosts never reach it directly. `step` runs INSIDE the CA container. Flags vary
|
|
# across step / step-ca versions — this is a BENCH-VERIFY scaffold. Reads .env.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
[ -f .env ] && . ./.env
|
|
CA_DNS=${CA_DNS:-ca.fleet.lab}
|
|
CA_PORT=${CA_PORT:-8443}
|
|
CA_CONNECT=${CA_CONNECT:-localhost}
|
|
CA_URL="https://${CA_CONNECT}:${CA_PORT}"
|
|
PKI=pki
|
|
PROVISIONER=${PROVISIONER:-enrol}
|
|
# The DNS name booted hosts dial for the broker host plane (must be in the server
|
|
# cert SAN and resolve via the fleet dnsmasq). Reuses boot.fleet.lab by default.
|
|
HOST_PLANE_CN=${HOST_PLANE_CN:-boot.fleet.lab}
|
|
|
|
PW="$PKI/stepca/password"
|
|
[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; }
|
|
[ -r "$PW" ] || { echo "ERROR: CA password $PW missing — run bootstrap.sh first." >&2; exit 1; }
|
|
CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}"
|
|
|
|
step() { docker compose exec -T step-ca step "$@"; }
|
|
incca() { docker compose exec -T step-ca "$@"; }
|
|
|
|
CA_JSON="$PKI/stepca/config/ca.json"
|
|
[ -f "$CA_JSON" ] || { echo "ERROR: $CA_JSON not found — is step-ca up?" >&2; exit 1; }
|
|
|
|
restart_ca() {
|
|
docker compose restart step-ca >/dev/null
|
|
for _ in $(seq 1 50); do curl -fsS -k "$CA_URL/health" >/dev/null 2>&1 && break; sleep 0.2; done
|
|
}
|
|
|
|
# --- 1. SSH CA keys + ca.json ssh block -------------------------------------
|
|
# step-ca signs SSH certs with dedicated SSH CA keys (separate from the X.509
|
|
# root). `step ca init --ssh` creates them at init; to add them to an already-
|
|
# initialised CA we generate two EC keypairs and reference them in ca.json.ssh.
|
|
# BENCH-VERIFY: key format/password expectations vary by version.
|
|
echo "==> generating SSH host/user CA keys (if absent)"
|
|
for kind in host user; do
|
|
if ! incca test -f "/home/step/secrets/ssh_${kind}_ca_key"; then
|
|
incca step crypto keypair \
|
|
"/home/step/secrets/ssh_${kind}_ca_key.pub" \
|
|
"/home/step/secrets/ssh_${kind}_ca_key" \
|
|
--kty EC --curve P-256 --no-password --insecure --force
|
|
fi
|
|
done
|
|
|
|
echo "==> patching ca.json ssh block (idempotent)"
|
|
if python3 - "$CA_JSON" <<'PY'
|
|
import json,sys
|
|
p=sys.argv[1]
|
|
c=json.load(open(p))
|
|
want={"hostKey":"/home/step/secrets/ssh_host_ca_key",
|
|
"userKey":"/home/step/secrets/ssh_user_ca_key"}
|
|
if c.get("ssh")==want: sys.exit(1) # already set — no restart needed
|
|
c["ssh"]=want
|
|
json.dump(c,open(p,"w"),indent=2)
|
|
PY
|
|
then
|
|
echo " ssh block added; restarting step-ca"; restart_ca
|
|
else
|
|
echo " ssh block already present"
|
|
fi
|
|
|
|
# --- 2. enable SSH host certs on the 'enrol' provisioner ---------------------
|
|
# The broker authenticates to step-ca with this JWK provisioner (signer.go). It
|
|
# must be allowed to issue SSH HOST certs. BENCH-VERIFY the exact subcommand/flag
|
|
# on your step version (some use `provisioner update <name> --ssh`).
|
|
echo "==> enabling SSH host-cert issuance on provisioner '${PROVISIONER}'"
|
|
# FAIL LOUDLY: a swallowed failure here leaves enableSSHCA=false, and every
|
|
# `step ssh certificate` at runtime dies with a 502 whose cause the operator
|
|
# can't see (bench 2026-07-11). If your `step` uses a different flag, fix it and
|
|
# re-run rather than shipping a half-configured CA.
|
|
if ! incca step ca provisioner update "${PROVISIONER}" --ssh; then
|
|
echo "ERROR: 'step ca provisioner update ${PROVISIONER} --ssh' failed. Your step" >&2
|
|
echo " version may use a different flag — check: step ca provisioner update --help" >&2
|
|
echo " Aborting so SSH host-cert signing isn't silently left disabled." >&2
|
|
exit 1
|
|
fi
|
|
restart_ca
|
|
# Verify it actually took — the CA only issues SSH host certs if enableSSHCA=true.
|
|
if ! python3 - "$CA_JSON" "$PROVISIONER" <<'PY'
|
|
import json,sys
|
|
c=json.load(open(sys.argv[1])); name=sys.argv[2]
|
|
for p in c["authority"]["provisioners"]:
|
|
if p.get("name")==name and p.get("claims",{}).get("enableSSHCA") is True:
|
|
sys.exit(0)
|
|
sys.exit(1)
|
|
PY
|
|
then
|
|
echo "ERROR: provisioner '${PROVISIONER}' still not SSH-enabled (enableSSHCA != true)" >&2
|
|
echo " after the update + restart. SSH host-cert signing would fail at runtime; aborting." >&2
|
|
exit 1
|
|
fi
|
|
echo " SSH host-cert issuance enabled on '${PROVISIONER}' (enableSSHCA=true)."
|
|
|
|
# --- 3. broker host-plane server cert + fleet client-CA bundle --------------
|
|
# The host plane is mTLS: its SERVER cert must be FLEET-signed (the booted host
|
|
# verifies it against radius-ca.pem), and its CLIENT CA must verify the host's
|
|
# TPM identity leaf (root + intermediate).
|
|
echo "==> issuing broker host-plane server cert (CN ${HOST_PLANE_CN})"
|
|
incca mkdir -p /export/broker
|
|
step ca certificate "${HOST_PLANE_CN}" \
|
|
/export/broker/host-server.crt /export/broker/host-server.key \
|
|
--ca-url "$CA_URL" --root /export/root_ca.crt \
|
|
--provisioner "${PROVISIONER}" --provisioner-password-file "$CONTAINER_PW" \
|
|
--not-after 2160h --force
|
|
echo "==> building fleet client-CA bundle (root + intermediate) -> $PKI/broker/fleet-client-ca.crt"
|
|
mkdir -p "$PKI/broker"
|
|
cat "$PKI/root_ca.crt" > "$PKI/broker/fleet-client-ca.crt"
|
|
[ -f "$PKI/intermediate_ca.crt" ] && cat "$PKI/intermediate_ca.crt" >> "$PKI/broker/fleet-client-ca.crt"
|
|
|
|
# --- 4. export the SSH host CA public key (admin trust anchor) ---------------
|
|
# `step crypto keypair` writes the public key in PEM/PKCS8, but a known_hosts
|
|
# `@cert-authority` line needs the single-line OpenSSH wire format
|
|
# (`ecdsa-sha2-nistp256 AAAA…`). Emitting the PEM verbatim yields an unparseable
|
|
# anchor → ssh silently falls back to TOFU (bench 2026-07-11). Convert it.
|
|
echo "==> exporting SSH host CA public key (OpenSSH format) -> $PKI/ssh_host_ca.pub"
|
|
incca cp /home/step/secrets/ssh_host_ca_key.pub /export/ssh_host_ca_key.pem
|
|
command -v ssh-keygen >/dev/null 2>&1 || {
|
|
echo "ERROR: ssh-keygen not found — cannot convert the CA key to OpenSSH format." >&2
|
|
echo " Install openssh-clients; the raw PKCS8 key is at $PKI/ssh_host_ca_key.pem." >&2
|
|
exit 1
|
|
}
|
|
ssh-keygen -i -m PKCS8 -f "$PKI/ssh_host_ca_key.pem" > "$PKI/ssh_host_ca.pub"
|
|
rm -f "$PKI/ssh_host_ca_key.pem"
|
|
echo
|
|
echo "Admin rollout — add ONE line to each admin's ~/.ssh/known_hosts (or a system"
|
|
echo "known_hosts), so every fleet host is trusted via the CA instead of TOFU:"
|
|
echo
|
|
echo " @cert-authority *.${CA_DNS#ca.} $(cat "$PKI/ssh_host_ca.pub" 2>/dev/null || echo '<contents of pki/ssh_host_ca.pub>')"
|
|
echo
|
|
echo "Then enable the broker host plane (dot1x-bench compose already wires"
|
|
echo "BROKER_HOST_ADDR + the certs issued above) and rebuild the secure-path image."
|
|
echo "On a booted+enrolled host, ssh-hostcert.timer POSTs its host key to the broker"
|
|
echo "and installs /etc/ssh/ssh_host_ecdsa_key-cert.pub."
|