crypt/step-ca-cli
1
0
Fork 0
mirror of https://github.com/smallstep/cli.git synced 2026-10-24 11:19:19 +03:00
Code Activity
1,118 Commits 27 Branches 361 Tags
v0.14.0
Commit Graph

101 Commits

Author SHA1 Message Date
David Cowden
e77ad2440e ssh/hosts: Use tags intead of groups 
Tags are a more general, flexible, strategy.
 2020-04-06 05:37:52 -07:00
David Cowden
fee5dc3d58 ssh/certificate: Carry over host-id if it exists 
If the user re-runs the `ssh certificate` command, try to pull the
host-id out of a previous identity cert. This will make it less annoying
for someone who runs the command not knowing that it will clobber their
old host-id and result in a new host (requireing them to also
re-register).
 2020-03-31 19:59:02 -07:00
David Cowden
8d3073d3dc ssh/certificate: Generate a random UUID by default 
Apparently some images don't properly handle the machine-id and it ends
up not being unique. By default play it safe and generate our own UUID.
Deriving a UUID from `/etc/machine-id` is still supported. To trigger
that behavior, pass 'machine' as the `--host-id` flag.
 2020-03-26 17:38:18 -07:00
Mariano Cano
b0df3f0c31 Fix --provisioner-password-file flag in step ssh login. 2020-03-19 13:57:19 -07:00
David Cowden
a48822af05 Merge branch 'master' into dcow/host-id 2020-03-16 17:17:01 -07:00
David Cowden
82e457df4a ssh/certificate: Fix typo in usage 
And use a consistent error message when the user tries to use the
--host-id flag without also specifying the --host flag.
 2020-03-16 17:15:49 -07:00
David Cowden
c15a339687 ssh/certificate: Use blake2b instead of sha256 
The short of it is that blake2b is designed to be a MAC. So let's use it
instead of worrying about whether we've used hmac|sha256 with a big
enough key, etc.
 2020-03-16 17:14:27 -07:00
Mariano Cano
ad19c036f4 Add hack to be able to sign a CSR with URIs. 2020-03-13 19:38:19 -07:00
David Cowden
4b5b57fe50 ssh/certificate: Brush up error reporting 
Add error details and inform the user if the try to pass `--host-id` but
have not specified `--host`. Also add a hint about what the potental
problem could be and a resolution option when we can't derive a host-id
from '/etc/machine-id'.
 2020-03-13 18:00:34 -07:00
David Cowden
3197f48c32 ssh/certificate: Regenerate the CSR on update 
After we set the URI, we need to regenerate the CSR in order for the new
data to be reflected.
 2020-03-13 17:32:42 -07:00
Sebastian Tiedtke
46ff96b58d This is tags now (cc @maraino @dcow) 2020-03-12 20:46:55 -07:00
David Cowden
9059e02238 ssh: Add machine-id hash to host certificate 
Alternatively, allow the user to specify their own UUID. Adding an ID
derived from the machine ID allows us to authorize hosts to access their
own resources by ID. The machine-id is not supposed to be sent around as
a raw UUID. So we HMAC it with an application "secret" and use the first
sixteen bytes of the resulting sha256 sum to as the entropy source when
generating a new "random" UUIDv4.
 2020-03-12 20:36:49 -07:00
Mariano Cano
ab36b827de Do not ask twice for password on open ssh keys. 2020-01-28 13:34:01 -08:00
David Cowden
2028998a61 teams: Add --team-url option 
Allow users to specify the endpoint that `step ssh config --team` uses
to pull initial configuration. If no endpoint is specified, default to

    https://api.smallstep.com/v1/teams/<name>/cas/default

If the user-specified endpoint contains any "<>" sequences, replace them
with the team name.
 2020-01-28 13:34:00 -08:00
Mariano Cano
93a358c301 Remove unused step ssh proxy command. 2020-01-28 13:34:00 -08:00
Mariano Cano
3c4aa2228d Fix lint errors. 2020-01-28 13:34:00 -08:00
Mariano Cano
01304131b4 Renew identity on ssh renew and rekey. 2020-01-28 13:34:00 -08:00
max furman
538f49f862 Remove final doubleprint of STEPDEBUG 2020-01-28 13:34:00 -08:00
max furman
34742e5b3e Double printing STEPDEBUG message 2020-01-28 13:34:00 -08:00
max furman
a8754c1c4b Add a few graceful errors to checkHost 2020-01-28 13:34:00 -08:00
Mariano Cano
513e8c8fdd Fix typo. 2020-01-28 13:34:00 -08:00
Mariano Cano
abe8443629 Update certificates and addapt api. 2020-01-28 13:34:00 -08:00
max furman
a4670fc632 Use x5cInsecure token in step ssh check-host 
* token allows the use of expired identity certificates to authenticate
the /ssh/check-host endpoint.
 2020-01-28 13:34:00 -08:00
Mariano Cano
4c8c5638bf Remove authentication to step ssh renew and improve usage. 2020-01-28 13:34:00 -08:00
Mariano Cano
c9f4b2868f Remove authentication to step ssh renew. 
Improve usage.
 2020-01-28 13:34:00 -08:00
Mariano Cano
0cf9f99339 Rename argument to identity. 2020-01-28 13:34:00 -08:00
Mariano Cano
3e9ef0052a Fail if no ssh-agent, force the user to login before. 2020-01-28 13:34:00 -08:00
Mariano Cano
88d192a4ab Improve step ssh docs. 2020-01-28 13:34:00 -08:00
Mariano Cano
62f1090c96 Remove expired keys. 2020-01-28 13:34:00 -08:00
Mariano Cano
4de6963683 Disable step ssh proxy. 2020-01-28 13:34:00 -08:00
Mariano Cano
a4495ba223 Fix waitgroup in step ssh proxy 2020-01-28 13:34:00 -08:00
Mariano Cano
20b9b0c993 Add GOOS to config variables. 2020-01-28 13:34:00 -08:00
Mariano Cano
1deea46db2 Add message if the agent has no identities. 2020-01-28 13:34:00 -08:00
Mariano Cano
417de89528 Show a proper message if an key is not found. 2020-01-28 13:34:00 -08:00
Mariano Cano
8f444b1a35 Remove experimental flags in step ssh login. 2020-01-28 13:34:00 -08:00
Mariano Cano
60b876707b Add some docs on step ssh login. 2020-01-28 13:34:00 -08:00
Mariano Cano
e5cf3de1f5 Remove principals on OIDC and write identity in proxycommand. 2020-01-28 13:34:00 -08:00
Mariano Cano
72c9890c82 Simplify look for user key. 2020-01-28 13:34:00 -08:00
Mariano Cano
835c7ca1b2 Only check for signed keys in proxycommand. 2020-01-28 13:34:00 -08:00
Mariano Cano
b90ffd5323 Fix agent requirement in login. Fix user requirement for hosts. 2020-01-28 13:34:00 -08:00
Mariano Cano
a2edb75fc7 Add login if required to ssh hosts. 2020-01-28 13:34:00 -08:00
Mariano Cano
10cdf07962 Enforce login on ssh commands if required. 2020-01-28 13:34:00 -08:00
Mariano Cano
4d7f26a754 Add identity certificate support to ssh login and certificate. 2020-01-28 13:34:00 -08:00
Mariano Cano
c30ed0f2ff Set default username from a certificate. 2020-01-28 13:34:00 -08:00
max furman
2fa5ecfbf6 forgot to add hosts command back 2020-01-28 13:34:00 -08:00
max furman
d923e0e13e one host per line in ssh hosts and update certificates 2020-01-28 13:34:00 -08:00
max furman
8988d4fc20 get-hosts -> hosts 
* pass nil arg to offline as a fill-in for now
 2020-01-28 13:33:59 -08:00
Mariano Cano
8a88605be6 Add bootstrap team support to step ssh config. 2020-01-28 13:33:59 -08:00
Mariano Cano
7e1224ebdd Add support for retry function in step ssh config. 2020-01-28 13:33:59 -08:00
max furman
05158c51e9 ssh certificate nil principals for OIDC 
* only when there are no explicit principals requested.
 2020-01-28 13:33:59 -08:00