From 14144584e39cbd338252cfe6b9abbc94d2034ea3 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 15:48:44 +1000 Subject: [PATCH] Fix SSH host certificate signing for the sshca role (#153) Host signing returns 403 even though login succeeds: the policy grants the literal path sshca/sign/host, but the only role on the sshca mount is signhost, so the grant matches nothing. Hosts named directly under unkin.net also fall outside the role's allowed domains. - Rename the policy to sshca/sign/signhost and grant that path - Allow unkin.net alongside main.unkin.net and consul on the signhost role Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/153 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- config/ssh_secret_backend_role/sshca/signhost.yaml | 2 +- policies/sshca/sign/{host.yaml => signhost.yaml} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename policies/sshca/sign/{host.yaml => signhost.yaml} (84%) diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml index e3b71b4..fc8c1e5 100644 --- a/config/ssh_secret_backend_role/sshca/signhost.yaml +++ b/config/ssh_secret_backend_role/sshca/signhost.yaml @@ -3,6 +3,6 @@ algorithm_signer: rsa-sha2-256 ttl: 315360000 # 87600 * 3600 allow_host_certificates: true allow_user_certificates: false -allowed_domains: "main.unkin.net,consul" +allowed_domains: "unkin.net,main.unkin.net,consul" allow_subdomains: true allow_bare_domains: false diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/signhost.yaml similarity index 84% rename from policies/sshca/sign/host.yaml rename to policies/sshca/sign/signhost.yaml index 5f99869..4a5b474 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/signhost.yaml @@ -1,7 +1,7 @@ # Allow signing SSH host certificates --- rules: - - path: "sshca/sign/host" + - path: "sshca/sign/signhost" capabilities: - create - update