Dustin C. Hatch
47ba62f208
The *ssh-host-cert-sign@.service* unit does what it says on the tin: requests a signed host certificate from an SSHCA server. It is a template unit, whose instances correspond to SSH key types (RSA, ECDSA, and Ed25519). The *ssh-host-certs.target* unit depends on the three instances of the template unit, so they can all be activated together. This target is only activated on the first boot of the system, to initially request the certificates. The *ssh-host-certs-renew.timer* unit periodically renews the SSH hosts certificates. Its corresponding target unit depends on the three instances of *ssh-host-cert-sign@.service*, so each certificate will be renewed independently.
35 lines
824 B
Desktop File
35 lines
824 B
Desktop File
[Unit]
|
|
Description=Request %I SSH Host Certificate
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
EnvironmentFile=-/etc/sysconfig/ssh-host-cert-sign
|
|
ExecStart=/usr/bin/sshca-cli host sign --output /etc/ssh/ssh_host_%I_key-cert.pub /etc/ssh/ssh_host_%I_key.pub
|
|
|
|
CapabilityBoundingSet=CAP_CHOWN
|
|
DeviceAllow=
|
|
DevicePolicy=closed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
PrivateTmp=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/etc/ssh
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|