dustin/sshca-cli/pipeline/head This commit looks goodDetails
Since the *openidconnect* dependency was added before the
`native-tls`/`rustls` features, it was hard coded to use native TLS.
This needs to be conditional based on the application's selected TLS
feature.
dustin/sshca-cli/pipeline/pr-master There was a failure building this commitDetails
dustin/sshca-cli/pipeline/head This commit looks goodDetails
An SSH certificate is useless on its own, as without the private key,
clients cannot sign servers' authentication requests. Since `sshca-cli
user login` creates a new key pair each time it is run, the private key
needs to be kept at least as long as the certificate is valid. To that
end, the command will now add both to the user's SSH agent. It
communicates with the agent via the UNIX stream socket specified by the
`SSH_AUTH_SOCK` environment variable.
Although there is a Rust crate, [ssh-agent-client-rs][0] that implements
the client side of the SSH agent protocol, it does not support adding
certificates to the agent. In fact, that functionality is not even
documented in the IETF draft specification for the protocol. Thus, I
had to figure it out by reading the code of the OpenSSH `ssh-add` tool,
and observing the messages passed between it and `ssh-agent`.
[0]: https://crates.io/crates/ssh-agent-client-rs
The `sshca-cli user login` command now requests a signed certificate
from the SSHCA server. Given a valid OpenID Connect identity token and
an SSH public key, the server will return a signed certificate, valid
for a predetermined (usually short) period of time. The principals
listed in the certificate are derived from the ID token.
The `rustls` feature will enable building with [rustls] instead of
OpenSSL. This will make it so the `sshca-cli` binary can be statically
linked, and thus distributable as a single file.
[rustls]: https://github.com/rustls/rustls
The `sshca user login` command will eventually provide the command-line
interface for obtaining user SSH certificates. It initiates the OAuth2
login process, retreiving an OpenID Connect Identity Token from the
OpenID Server. This token will be submitted to the SSHCA server to
authorize a request to sign a certificate. For now, though, the token
is printed to standard output, e.g. to be used in a `curl` request.
The CLI tool will be the primary method for interacting with the SSH CA
service. For now, it supports a single operation: `sshca-cli host
sign`, which requests a certificate to be signed by the CA service.`
Dustin