Dustin C. Hatch
37e6622351
The _sshca-cli_ package no longer provides a _-systemd_ sub-package containing the systemd unit files for automatically requesting and renewing SSH host certificates. Its original intent was to support automatically signing certificates on first boot by having the unit files installed by Anaconda, but this never really worked for various reasons. Since I'd rather not have to rebuild the RPMs every time I need to make a change to the systemd units, and Ansible is required to actually get the certificates issued anyway, it makes more sense to have the unit files in the configuration policy instead.
35 lines
824 B
Desktop File
35 lines
824 B
Desktop File
[Unit]
|
|
Description=Request %I SSH Host Certificate
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
EnvironmentFile=-/etc/sysconfig/ssh-host-cert-sign
|
|
ExecStart=/usr/bin/sshca-cli host sign --output /etc/ssh/ssh_host_%I_key-cert.pub /etc/ssh/ssh_host_%I_key.pub
|
|
|
|
CapabilityBoundingSet=CAP_CHOWN
|
|
DeviceAllow=
|
|
DevicePolicy=closed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
PrivateTmp=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/etc/ssh
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|