2023-09-11 15:39:03 +02:00
|
|
|
---
|
|
|
|
|
- name: Use SSH certificates
|
|
|
|
|
hosts: all
|
|
|
|
|
tasks:
|
|
|
|
|
- name: Configure sshd to enable SSH Certificate login
|
|
|
|
|
ansible.builtin.include_role:
|
|
|
|
|
name: ansible-sshd
|
|
|
|
|
vars:
|
2024-10-24 18:59:04 +02:00
|
|
|
sshd_config:
|
2023-09-11 15:39:03 +02:00
|
|
|
# Disable password authentication, use SSH Certificates and configure authorized principals
|
|
|
|
|
PasswordAuthentication: false
|
|
|
|
|
TrustedUserCAKeys: /etc/ssh/trusted-user-ca-keys.pub
|
|
|
|
|
AuthorizedPrincipalsFile: "/etc/ssh/auth_principals/%u"
|
|
|
|
|
# List of trusted user CA keys
|
|
|
|
|
sshd_trusted_user_ca_keys_list:
|
|
|
|
|
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwqRjI9gAwkQF9iIylhRVAOFy2Joodh3fXJ7CbGWqUd
|
|
|
|
|
# Key is the user in the os, values are *Principals* defined in the certificate
|
|
|
|
|
sshd_principals:
|
|
|
|
|
admin:
|
|
|
|
|
- frontend-admin
|
|
|
|
|
- backend-admin
|
|
|
|
|
somelinuxuser:
|
|
|
|
|
- some-principal-defined-in-certificate
|
