Fediversity

Log in with a certificate

A person in fediversity-admins can get an SSH certificate from OpenBao. The certificate expires after 8 hours. When you remove a person from the group, they cannot get a new certificate, so they lose access on the same day.

Each node has one shared wheel account, admin, for the certificate login. The certificate holds the principal fediversity-admins, and only admin accepts it. The key ID of the certificate holds the LLDAP name of the person. root and the emergency account accept no certificate, so log in as admin and use sudo. The node configuration holds no list of persons: the members of fediversity-admins are that list. root accepts only the deploy key of CD.

The openbao-ssh client of Authelia asks for a second factor. Register it before your first login.

  1. Log in:

    bao login -method=oidc -path=oidc-ssh

  2. Sign your public key:

    bao write -field=signed_key ssh-admin/sign/admin \
      public_key=@$HOME/.ssh/id_ed25519.pub > ~/.ssh/id_ed25519-cert.pub

    OpenBao puts the principal fediversity-admins into the certificate, and it refuses a different principal. It puts the name of the login into the key ID, and it refuses a different key ID.

  3. Connect to the node. ssh finds id_ed25519-cert.pub next to the key:

    ssh admin@<node>

The log of sshd shows the key ID, thus the name of the person, at each login to admin.

Log in when no certificate is available

When OpenBao, Authelia or LLDAP is down, you cannot get a certificate. For this case, each node has the wheel account emergency. It accepts only the static keys in the ADMIN_EMERGENCY variable, and on the console the password whose hash that variable holds. {} gives no such account.

  1. Keep the private key offline, for example on a hardware token in a safe. Do not keep it on a workstation.

  2. Log in:

    ssh -i <emergency key> emergency@<node>

  3. Use sudo for commands that need root.

The log of sshd shows each use as Accepted publickey for emergency. Tell the other administrators when you use the account.

Trust a CA

OpenBao makes the CA once, and the private key stays in OpenBao. A node trusts the keys in the ADMIN_SSH_CA_KEYS variable.

  1. Read the public key. This needs no token:

    curl -s "$OPENBAO_ADDR/v1/ssh-admin/public_key"

  2. Put the key into the JSON list in ADMIN_SSH_CA_KEYS.

  3. Deploy. The value is a node identity, so this redeploys each node.

Rotate the CA

The ssh-admin engine holds more than one CA, and it signs with the default one. These steps need a token that can write to ssh-admin.

  1. Make the new CA. This does not change the CA that signs:

    bao write ssh-admin/issuers/import/next generate_signing_key=true key_type=ed25519

  2. Add the new public key to ADMIN_SSH_CA_KEYS, and keep the old one. Deploy. To read the key:

    bao read -field=public_key ssh-admin/issuer/next

  3. Sign with the new CA:

    bao write ssh-admin/config/issuers default=next

  4. Wait for the certificates of the old CA to expire, which takes 8 hours.

  5. Remove the old public key from ADMIN_SSH_CA_KEYS. Deploy.

  6. Delete the old CA. bao list ssh-admin/issuers shows the references:

    bao delete ssh-admin/issuer/<old>

    Do not delete ssh-admin/config/ca: that removes all the CAs, and nothing can restore them.