dustin
/
sshca
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

server: host: Remove alias request parameter 

I realized that allowing hosts to request certificates for arbitrary
aliases sort of defeats the purpose of the authentication process.  If a
host successfully authenticates, there would be nothing stopping it from
requesting a certificate for another host.  I will have to come up with
a different way of specifying aliases.  Probably something like a JSON
map containing pre-assigned aliases for hosts that will need them.
Dustin 2023-11-04 16:32:22 -05:00
parent 5404e143dc
commit 5dc5b2cc21
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
server/src/server/host.rs
View File

@ -84,7 +84,6 @@ impl IntoResponse for SignKeyError {
struct SignKeyRequest {
hostname: String,
pubkey: Vec<u8>,
aliases: Vec<String>,
}
pub(super) async fn sign_host_cert(
@ -100,7 +99,6 @@ pub(super) async fn sign_host_cert(
Some("pubkey") => {
body.pubkey = field.bytes().await?.into();
}
Some("alias") => body.aliases.push(field.text().await?),
Some("hostname") => body.hostname = field.text().await?,
Some(n) => {
warn!("Client request included unsupported field {:?}", n);
@ -111,7 +109,6 @@ pub(super) async fn sign_host_cert(
if body.pubkey.is_empty() {
return Err(SignKeyError::NoKey);
}
let aliases: Vec<_> = body.aliases.iter().map(String::as_ref).collect();
let config = &ctx.config;
let duration = Duration::from_secs(config.ca.host.cert_duration);
@ -140,7 +137,7 @@ pub(super) async fn sign_host_cert(
hostname
);
let cert =
ca::sign_cert(&hostname, &pubkey, duration, &privkey, &aliases)?;
ca::sign_cert(&hostname, &pubkey, duration, &privkey, &[])?;
info!(
"Signed {} key for {}",
pubkey.algorithm().as_str(),