infra/kickstart
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fedora-common: Do not configure SSH host cert

Browse Source 
When the SSH daemon is already configured to use an SSH host
certificate but the specified certificate file does not exist, then the
server will not try to use it later once it is created.  This
essentially means that the certificate obtained during first boot will
not be used untile the SSH daemon is restarted.

Rather than try to set all of this up in the kickstart, it's probably
better to just let Ansible do it.  Then, the SSH daemon can be restarted
as needed automatically (by the host provisioner).
This commit is contained in:
Dustin
2025-05-09 20:49:02 -05:00
parent 713a61db28
commit 8933e517fb
1 changed files with 1 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fedora-common.ks
View File

@@ -38,7 +38,7 @@ sshca-cli-systemd
systemd-networkd
%end
services --enabled systemd-networkd,systemd-resolved,ssh-host-certs-renew.timer,ssh-host-certs.target --disabled systemd-homed,systemd-nsresourced,systemd-nsresourced.socket,systemd-userdbd,systemd-userdbd.socket
services --enabled systemd-networkd,systemd-resolved --disabled systemd-homed,systemd-nsresourced,systemd-nsresourced.socket,systemd-userdbd,systemd-userdbd.socket
%addon com_redhat_kdump --disable
%end
@@ -62,14 +62,6 @@ cat >> /etc/ssh/sshd_config.d/70-trustedusercakeys.conf <<'EOF'
TrustedUserCAKeys /etc/ssh/ca.pub
EOF
# Configure SSH daemon to use host certificates obtained from SSHCA
cat > /etc/sysconfig/ssh-host-cert-sign <<EOF
SSHCA_SERVER=https://sshca.pyrocufflink.blue
EOF
for a in ecdsa ed25519 rsa; do
printf 'HostCertificate /etc/ssh/ssh_host_%s_key-cert.pub\n' "${a}"
done > /etc/ssh/sshd_config.d/10-hostcertificate.conf
# Configure networking with systemd-networkd
# Use MAC address as client ID to keep the same lease from Anaconda
rm -rf /etc/sysconfig/network-scripts /etc/sysconfig/network