ansible-sshd/examples/example-use-certificates.yml

24 lines
910 B
YAML
Raw Normal View History

---
- name: Use SSH certificates
hosts: all
tasks:
- name: Configure sshd to enable SSH Certificate login
ansible.builtin.include_role:
name: ansible-sshd
vars:
sshd:
# Disable password authentication, use SSH Certificates and configure authorized principals
PasswordAuthentication: false
TrustedUserCAKeys: /etc/ssh/trusted-user-ca-keys.pub
AuthorizedPrincipalsFile: "/etc/ssh/auth_principals/%u"
# List of trusted user CA keys
sshd_trusted_user_ca_keys_list:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwqRjI9gAwkQF9iIylhRVAOFy2Joodh3fXJ7CbGWqUd
# Key is the user in the os, values are *Principals* defined in the certificate
sshd_principals:
admin:
- frontend-admin
- backend-admin
somelinuxuser:
- some-principal-defined-in-certificate