From 5fdc308f07372d56ae82d1825151d94e28959d89 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 4 Oct 2026 15:03:44 +1100 Subject: [PATCH] Document sshca/signhost ssh signing in terraform-vault --- doc/vault/README.md | 39 ++++++++------------------------------- 1 file changed, 8 insertions(+), 31 deletions(-) diff --git a/doc/vault/README.md b/doc/vault/README.md index 42e079e..e0b3b23 100644 --- a/doc/vault/README.md +++ b/doc/vault/README.md @@ -88,36 +88,13 @@ # SSH Hostkey Signing -## create ssh engine, key, set ttl - vault secrets enable -path=ssh-host-signer ssh - vault write ssh-host-signer/config/ca generate_signing_key=true - vault secrets tune -max-lease-ttl=87600h ssh-host-signer +The `sshca` ssh engine, its `signhost` role, the `sshca/sign/signhost` policy and +the `sshsigner` approle are managed in terraform-vault: -## create role - vault write ssh-host-signer/roles/hostrole \ - key_type=ca \ - algorithm_signer=rsa-sha2-256 \ - ttl=87600h \ - allow_host_certificates=true \ - allowed_domains="unkin.net" \ - allow_subdomains=true \ - allow_baredomains=true +- `config/ssh_secret_backend/sshca.yaml` +- `config/ssh_secret_backend_role/sshca/signhost.yaml` +- `config/auth_approle_role/approle/sshsigner.yaml` +- `policies/sshca/sign/signhost.yaml` -## create policy to use hostrole - cat < sshsign-host.hcl - path "ssh-host-signer/sign/hostrole" { - capabilities = ["create", "update"] - } - EOF - - vault policy write sshsign-host-policy sshsign-host.hcl - - vault write auth/approle/role/sshsign-host-role \ - bind_secret_id=false \ - token_policies="sshsign-host-policy" \ - token_ttl=30s \ - token_max_ttl=30s \ - token_bound_cidrs="198.18.17.3/32,198.18.13.32/32,198.18.13.33/32,198.18.13.34/32" - -## get the sshsign-host-role approle id - vault read -field=role_id auth/approle/role/sshsign-host-role/role-id +## get the sshsigner approle id + vault read -field=role_id auth/approle/role/sshsigner/role-id