Added support to manage ssh certificates

2026-09-19 17:54:45 +02:00 · 2014-02-09 23:38:30 +01:00
parent 6e418aa945
commit 47211d0648
5 changed files with 104 additions and 41 deletions
@@ -1,30 +1,43 @@
-sshd_config:
-  Port: 22
-  Protocol: 2
-  HostKey:
-    - /etc/ssh/ssh_host_rsa_key
-    - /etc/ssh/ssh_host_dsa_key
-    - /etc/ssh/ssh_host_ecdsa_key
-  UsePrivilegeSeparation: yes
-  KeyRegenerationInterval: 3600
-  ServerKeyBits: 768
-  SyslogFacility: AUTH
-  LogLevel: INFO
-  LoginGraceTime: 120
-  PermitRootLogin: yes
-  StrictModes: yes
-  RSAAuthentication: yes
-  PubkeyAuthentication: yes
-  IgnoreRhosts: yes
-  RhostsRSAAuthentication: no
-  HostbasedAuthentication: no
-  PermitEmptyPasswords: no
-  ChallengeResponseAuthentication: no
-  X11Forwarding: yes
-  X11DisplayOffset: 10
-  PrintMotd: no
-  PrintLastLog: yes
-  TCPKeepAlive: yes
-  AcceptEnv: "LANG LC_*"
-  Subsystem: "sftp /usr/lib/openssh/sftp-server"
-  UsePAM: yes
+openssh:
+  sshd_config:
+    Port: 22
+    Protocol: 2
+    HostKey:
+      - /etc/ssh/ssh_host_rsa_key
+      - /etc/ssh/ssh_host_dsa_key
+      - /etc/ssh/ssh_host_ecdsa_key
+    UsePrivilegeSeparation: yes
+    KeyRegenerationInterval: 3600
+    ServerKeyBits: 768
+    SyslogFacility: AUTH
+    LogLevel: INFO
+    LoginGraceTime: 120
+    PermitRootLogin: yes
+    StrictModes: yes
+    RSAAuthentication: yes
+    PubkeyAuthentication: yes
+    IgnoreRhosts: yes
+    RhostsRSAAuthentication: no
+    HostbasedAuthentication: no
+    PermitEmptyPasswords: no
+    ChallengeResponseAuthentication: no
+    X11Forwarding: yes
+    X11DisplayOffset: 10
+    PrintMotd: no
+    PrintLastLog: yes
+    TCPKeepAlive: yes
+    AcceptEnv: "LANG LC_*"
+    Subsystem: "sftp /usr/lib/openssh/sftp-server"
+    UsePAM: yes
+
+  auth:
+    joe:
+      - name: JOE_VALID_SSH_PUBLIC_KEY
+        present: True
+        enc: ssh-rsa
+        comment: main key
+      - name: JOE_NON_VALID_SSH_PUBLIC_KEY
+        present: False
+        enc: ssh-rsa
+        comment: obsolete key - removed
+