infra
/
kickstart
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fedora-common: Do not configure SSH host cert 

When the SSH daemon is already configured to use an SSH host
certificate but the specified certificate file does not exist, then the
server will not try to use it later once it is created.  This
essentially means that the certificate obtained during first boot will
not be used untile the SSH daemon is restarted.

Rather than try to set all of this up in the kickstart, it's probably
better to just let Ansible do it.  Then, the SSH daemon can be restarted
as needed automatically (by the host provisioner).
master
Dustin 2025-05-09 20:49:02 -05:00
parent 713a61db28
commit 8933e517fb
1 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fedora-common.ks
View File

@ -38,7 +38,7 @@ sshca-cli-systemd
systemd-networkd systemd-networkd
%end %end
services --enabled systemd-networkd,systemd-resolved,ssh-host-certs-renew.timer,ssh-host-certs.target --disabled systemd-homed,systemd-nsresourced,systemd-nsresourced.socket,systemd-userdbd,systemd-userdbd.socket services --enabled systemd-networkd,systemd-resolved --disabled systemd-homed,systemd-nsresourced,systemd-nsresourced.socket,systemd-userdbd,systemd-userdbd.socket
%addon com_redhat_kdump --disable %addon com_redhat_kdump --disable
%end %end
@ -62,14 +62,6 @@ cat >> /etc/ssh/sshd_config.d/70-trustedusercakeys.conf <<'EOF'
TrustedUserCAKeys /etc/ssh/ca.pub TrustedUserCAKeys /etc/ssh/ca.pub
EOF EOF
# Configure SSH daemon to use host certificates obtained from SSHCA
cat > /etc/sysconfig/ssh-host-cert-sign <<EOF
SSHCA_SERVER=https://sshca.pyrocufflink.blue
EOF
for a in ecdsa ed25519 rsa; do
printf 'HostCertificate /etc/ssh/ssh_host_%s_key-cert.pub\n' "${a}"
done > /etc/ssh/sshd_config.d/10-hostcertificate.conf
# Configure networking with systemd-networkd # Configure networking with systemd-networkd
# Use MAC address as client ID to keep the same lease from Anaconda # Use MAC address as client ID to keep the same lease from Anaconda
rm -rf /etc/sysconfig/network-scripts /etc/sysconfig/network rm -rf /etc/sysconfig/network-scripts /etc/sysconfig/network