cloudtools / ssh-ca Goto Github PK

View Code? Open in Web Editor NEW

258.0 258.0 24.0 65 KB

Management utilities to support a certificate authority for ssh keys

License: BSD 2-Clause "Simplified" License

Python 100.00%

ssh-ca's People

Contributors

Stargazers

Watchers

ssh-ca's Issues

get_cert doesn't work with SSH agents

In recent versions of gpg, it can serve as an SSH agent. This allows you to easily store your SSH key on a hardware device, like a yubikey.

Unfortunately, in this setup, if you're using ssh-ca, get_cert will fail with:

$ get_cert "<url>"
Unable to find private key matching certificate.

Because it tries to find the private key in ~/.ssh. Since the private key is stored on a hardware device, it doesn't find it.

A simple workaround is to just curl "<url>" ~/.ssh/id_rsa-cert.pub instead of using get_cert, but it would be nice if get_cert just worked.

make principals configurable in the config file

I'll handle this - just wanted to put it here so I don't forget.

Basically the fact we default to ec2-user & ubuntu is fine, until you want to use something else. Having to type --principal multiple times is annoying, and I'd much rather configure it.

Unclear failure from ssh-keygen

I forgot to throw a + in front of the time when signing a key and it caused the ssh-keygen command to fail with this output:

Invalid certificate life specification 4h

Unfortunately you don't see that from ssh-ca - instead you get a mostly unhelpful exception:

Invalid certificate life specification 4h
Traceback (most recent call last):
  File "/usr/local/bin/sign_key", line 5, in <module>
    pkg_resources.run_script('ssh-ca==0.1.0', 'sign_key')
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 489, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py", line 1214, in run_script
    exec script_code in namespace, namespace
  File "/Library/Python/2.7/site-packages/ssh_ca-0.1.0-py2.7.egg/EGG-INFO/scripts/sign_key", line 125, in <module>

  File "build/bdist.macosx-10.9-intel/egg/ssh_ca/__init__.py", line 55, in sign_public_key
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 575, in check_output
    raise CalledProcessError(retcode, cmd, output=output)
subprocess.CalledProcessError: Command '['ssh-keygen', '-z', '259', '-s', '/Users/mike/.ssh/ssh_ca_stage', '-I', '[email protected]', '-V', '4h', '-n', 'ubuntu,ec2-user', '/var/folders/57/m5_p33bx2cn75pyr8s4_c9040000gn/T/tmpyItSVz']' returned non-zero exit status 255

cloudtools / ssh-ca Goto Github PK

ssh-ca's People

Contributors

Stargazers

Watchers

Forkers

ssh-ca's Issues

get_cert doesn't work with SSH agents

make principals configurable in the config file

Unclear failure from ssh-keygen

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent