install CA in authorized_keys for user. renewal once a day, not fix at 4o'clock.

This commit is contained in:
Denis Knauf 2020-09-30 20:45:28 +02:00
parent 9cbe617309
commit 255a4ab9f5
3 changed files with 29 additions and 6 deletions

1
.gitignore vendored
View file

@ -22,3 +22,4 @@ tags
# ---> Ansible
*.retry
/meta/.galaxy_install_info

View file

@ -1,8 +1,10 @@
[Unit]
Description=Renewal ssh host certificate %i
After=network.target
[Install]
WantedBy=timers.target
[Timer]
OnCalendar=4:00
OnUnitActiveSec=24h
OnActiveSec=1m

View file

@ -5,7 +5,18 @@
register: host_pub
slurp:
src: '{{ssh_cert_host_pub_path}}'
- name: Fetch CA pub
remote_user: root
delegate_to: '{{ssh_ca_host}}'
register: _ca_pub
become: yes
become_user: '{{ssh_ca_user}}'
slurp:
src: '{{ssh_ca_base_dir}}/ca.pub'
- set_fact:
ca_pub: '{{_ca_pub.content | b64decode}}'
host_pub_type: '{{(host_pub.content | b64decode).split(" ")[0]}}'
host_pub_hash: '{{(host_pub.content | b64decode).split(" ")[1]}}'
principals: "{{lookup( 'flattened',
@ -47,8 +58,8 @@
- name: Push ca pub
copy:
src: '{{ssh_cert_host_capub_path}}'
dest: '{{ssh_cert_host_capub_path}}'
content: '{{ca_pub}}'
mode: 0644
owner: root
group: root
@ -132,6 +143,15 @@
state: started
with_items: '{{ssh_cert_users}}'
- name: "Register certificate-role in user's authorized_keys"
when: ssh_cert_user_authorized_roles is defined
with_items: '{{ssh_cert_user_authorized_roles}}'
authorized_key:
user: '{{item.user}}'
state: present
key: '{{ca_pub}}'
key_options: 'cert-authority,principals="{{item.roles|default([item.user])|join(",")}}"'
- name: reload ssh
service:
name: ssh