Commit Graph

67 Commits (2f60f20b0b2e2df785affa893a09e764b2030bd6)

Author SHA1 Message Date
max furman 2f60f20b0b lots of codes 3 years ago
max furman 7b5d6968a5 first commit 3 years ago
Mariano Cano fbd2208044 Close key manager for safe reloads when a cgo module is used. 3 years ago
Miclain Keffeler 7545b4a625 leverage intermediate_ca.crt for appending certs. 4 years ago
Anton Lundin 3e6137110b Add support for using ssh-agent as a KMS
This adds a new KMS, SSHAgentKMS, which is a KMS to provide signing keys
for issuing ssh certificates signed by a key managed by a ssh-agent. It
uses the golang.org/x/crypto package to get a native Go implementation
to talk to a ssh-agent.

This was primarly written to be able to use gpg-agent to provide the
keys stored in a YubiKeys openpgp interface, but can be used for other
setups like proxying a ssh-agent over network.

That way the signing key for ssh certificates can be kept in a
"sign-only" hsm.

This code was written for my employer Intinor AB, but for simplicity
sake gifted to me to contribute upstream.

Signed-off-by: Anton Lundin <glance@acc.umu.se>
4 years ago
Mariano Cano ef92a3a6d7 Move cas options under authority. 4 years ago
Mariano Cano 072adc906e Print root fingerprint for CloudCAS. 4 years ago
Mariano Cano 38fa780775 Add interface to get root certificate from CAS.
This change makes easier the configuration of cloudCAS as it does
not require to configure the root or intermediate certificate
in the ca.json. CloudCAS will get the root certificate using
the configured certificateAuthority.
4 years ago
Mariano Cano 60515d92c5 Remove unnecessary properties. 4 years ago
Mariano Cano bd8dd9da41 Do not read issuer and signer twice. 4 years ago
Mariano Cano aad8f9e582 Pass issuer and signer to softCAS options.
Remove commented code and initialize CAS properly.
Minor fixes in CloudCAS.
4 years ago
Mariano Cano 1b1f73dec6 Early attempt to develop a CAS interface. 4 years ago
Mariano Cano d30a95236d Use always go.step.sm/crypto 4 years ago
Mariano Cano e83e47a91e Use sshutil and randutil from go.step.sm/crypto. 4 years ago
Mariano Cano fcfc4e9b2b Fix ssh federated template variables. 4 years ago
Mariano Cano e3ae751b57 Use templates from authority instead of config. 4 years ago
Mariano Cano 6c844a0618 Load default templates if no templates are configured. 4 years ago
Mariano Cano c02fe77998 Close the key manager before shutting down. 4 years ago
Mariano Cano 4e544344f9 Initialize the required config fields on embedded authorities.
This change is to make easier the use of embedded authorities. It
can be difficult for third parties to know what fields are required.
The new init methods will define the minimum usable configuration.
4 years ago
Mariano Cano b5eab009b2 Rename method to NewEmbedded 4 years ago
Mariano Cano 824374bde0 Create a method to initialize the authority without a config file.
When the CA is embedded in a third party product like Caddy, the
config needed to use placeholders to be valid. This change adds
a new method `NewEmbeddedAuthority` that allows to create an
authority with the given options, the minimum options are a root
and intermediate certificate, and the intermediate key.

Fixes #218
4 years ago
Mariano Cano c49a9d5e33 Add context parameter to all SSH methods. 4 years ago
Mariano Cano 5c8c741fab Fix linting issues. 4 years ago
Mariano Cano 9021951f1a Fix types. 4 years ago
Mariano Cano e98d7832b9 Add options to read the roots and federated roots from a bundle. 4 years ago
Mariano Cano c62526b39f Add wip support for kms. 4 years ago
max furman 1e17ec7d33 Use x5cInsecure token for /ssh/check-host endpoint 5 years ago
max furman c2a3bcfab5 resolving merge 5 years ago
max furman 927784237d Use an actual Hosts type when returning ssh hosts 5 years ago
Mariano Cano 2f18a26d4f Add version endpoint. 5 years ago
max furman 35912cc906 change func def for getSSHHosts
* continue to return all hosts if injection method not specified
5 years ago
max furman c407a9319b Add getSSHHosts injection func 5 years ago
max furman 8b2105a8f9 Instrument getIdentity func for OIDC ssh provisioner 5 years ago
max furman 6ca1df5081 Add WithGetIdentityFunc option and attr to authority
* Add Identity type to provisioner
5 years ago
Mariano Cano 86a0558587 Add support for /ssh/bastion method. 5 years ago
Mariano Cano 43b663e0c3 Move Option type to a new file. 5 years ago
max furman a9ea292bd4 sshpop provisioner + ssh renew | revoke | rekey first pass 5 years ago
Mariano Cano e5da24f269 Fix list of user ssh public keys. 5 years ago
Mariano Cano 91ccc3802c Fix lint error. 5 years ago
Mariano Cano 38d735be6e Add support for federated keys. 5 years ago
Mariano Cano e84489775b Add support for multiple ssh roots.
Fixes #125
5 years ago
Mariano Cano caa2174efc Add support for user data in templates. 5 years ago
Mariano Cano 7b8bb6deb4 Add initial support for ssh config.
Related to smallstep/cli#170
5 years ago
Mariano Cano dc6ffb7670 Add initial implementation of ssh config. 5 years ago
max furman fe7973c060 wip 5 years ago
max furman e3826dd1c3 Add ACME CA capabilities 5 years ago
Mariano Cano 004ea12212 Allow to use custom SSH user/host key files. 5 years ago
Mariano Cano 1c8f610ca9 Add initial implementation of an SSH CA using the JWK provisioner.
Fixes smallstep/ca-component#187
5 years ago
Mariano Cano dbd3131068 Fix comments. 5 years ago
Mariano Cano fb6a1afd89 Fix typo. 5 years ago