wget --no-check-certificate -O step.tar.gz https://dl.step.sm/gh-release/cli/docs-ca-install/v0.18.1/step_linux_0.18.1_amd64.tar.gz
wget --no-check-certificate -O step-ca.tar.gz https://dl.step.sm/gh-release/certificates/docs-ca-install/v0.18.1/step-ca_linux_0.18.1_amd64.tar.gz
tar -xf step.tar.gz
tar -xf step-ca.tar.gz cp step_0.18.1/bin/step /usr/bin cp step-ca_0.18.1/bin/step-ca /usr/bin
テストユーザーの追加
[root@shu ~]# adduser alice
[root@shu ~]# step ca init --ssh ✔ Deployment Type: Standalone What would you like to name your new PKI? ✔ (e.g. Smallstep): stepcashu What DNS names or IP addresses would you like to add to your new CA? ✔ (e.g. ca.smallstep.com[,1.1.1.1,etc.]): shu.dev.secioss.work ✔ (e.g. ca.smallstep.com[,1.1.1.1,etc.]): shu.dev.secioss.work ✔ (e.g. :443 or 127.0.0.1:443): :8443 What would you like to name the CA's first provisioner? ✔ (e.g. you@smallstep.com): shuu.shisen@secioss.co.jp Choose a password for your CA keys and first provisioner. ✔ [leave empty and we'll generate one]: Passwd01
Generating root certificate... done!Generating intermediate certificate... done!
Generating user and host SSH certificate signing keys... done!
✔ Root certificate: /root/.step/certs/root_ca.crt✔ Root private key: /root/.step/secrets/root_ca_key✔ Root fingerprint: f9d4355c7fee1ecc30da460b39877eb73a0b75191241b25622b11f6b7775674b✔ Intermediate certificate: /root/.step/certs/intermediate_ca.crt✔ Intermediate private key: /root/.step/secrets/intermediate_ca_key✔ SSH user public key: /root/.step/certs/ssh_user_ca_key.pub✔ SSH user private key: /root/.step/secrets/ssh_user_ca_key✔ SSH host public key: /root/.step/certs/ssh_host_ca_key.pub✔ SSH host private key: /root/.step/secrets/ssh_host_ca_key✔ Database folder: /root/.step/db✔ Templates folder: /root/.step/templates✔ Default configuration: /root/.step/config/defaults.json✔ Certificate Authority configuration: /root/.step/config/ca.json
Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.
※ 初期化に 8443 を指定したので、8443 ポート開ける必要です
ファイル構成
[root@shu ~]# tree .step
.step
├── certs
│ ├── intermediate_ca.crt
│ ├── root_ca.crt
│ ├── ssh_host_ca_key.pub
│ └── ssh_user_ca_key.pub
├── config
│ ├── ca.json
│ └── defaults.json
├── db
├── secrets
│ ├── intermediate_ca_key
│ ├── root_ca_key
│ ├── ssh_host_ca_key
│ └── ssh_user_ca_key
└── templates
└── ssh
├── ca.tpl
├── config.tpl
├── known_hosts.tpl
├── sshd_config.tpl
├── step_config.tpl
└── step_includes.tpl
6 directories, 16 files
※設定を行う前に、step-ca を起動しておく必要があります。
ユーザーCA証明書を信頼する Get your host to trust your SSH user CA
[root@shu ~]# step ssh config --roots > /root/.step/certs/ssh_user_ca_key.pub
サーバー証明書とキーを作成 Issue a certificate for your host
[root@shu ~]# step ssh certificate --host shu.dev.secioss.work ssh_host_ecdsa_key ✔ Provisioner: shuu.shisen@secioss.co.jp (JWK) [kid: EdbT3PawAZFq5iPkpS1czMB_-T1F-mMY1m46FwQMuNI] Please enter the password to decrypt the provisioner key: ✔ CA: https://shu.dev.secioss.work:8443 Please enter the password to encrypt the private key: ✔ Private Key: ssh_host_ecdsa_key ✔ Public Key: ssh_host_ecdsa_key.pub ✔ Certificate: ssh_host_ecdsa_key-cert.pub [root@shu ~]# mv ssh_host_ecdsa_key /etc/ssh/step_ssh_host_ecdsa_key [root@shu ~]# mv ssh_host_ecdsa_key-cert.pub /etc/ssh/step_ssh_host_ecdsa_key-cert.pub [root@shu ~]# mv ssh_host_ecdsa_key.pub /etc/ssh/step_ssh_host_ecdsa_key.pub
[root@shu ~]# vi /etc/ssh/sshd_config
信頼するユーザーCA証明書のキーを追記 Add following to SSHD configuration
# This is the CA's public key for authenticating user certificates: TrustedUserCAKeys /root/.step/certs/ssh_user_ca_key.pub
サーバー証明書とキーを追記 Add following to SSHD configuration
HostCertificate /etc/ssh/step_ssh_host_ecdsa_key-cert.pub HostKey /etc/ssh/step_ssh_host_ecdsa_key
ssh 設定ファイル変更後サービスを再起動
[root@shu ~]# systemctl restart sshd
[root@shu ~]# cat <<EOF > /etc/cron.weekly/rotate-ssh-certificate #!/bin/sh export STEPPATH=/root/.step cd /etc/ssh && step ssh renew step_ssh_host_ecdsa_key-cert.pub step_ssh_host_ecdsa_key --force 2> /dev/null exit 0 EOF chmod 755 /etc/cron.weekly/rotate-ssh-certificate [root@shu ~]# ll /etc/cron.weekly/rotate-ssh-certificate -rwxr-xr-x 1 root root 153 2月 28 18:11 /etc/cron.weekly/rotate-ssh-certificate
slinktest 側 シングルサインオン | OpenID Connect を登録
サービスID stepcashu-tests2.com クライアントID NdLuYwC725NcUBrEj42x6o58q4Z7mn6W クライアントシークレット※ secret リダイレクトURI※ http://localhost:10000
※ サービス登録後、管理者または利用するユーザーに許可するサービスの追加とアクセスの権限が必要です
step-ca に Provisioner を手動で追加
設定値のマッピングは下記の通りです。
clientID サービスID
clientSecret クライアントシークレット
listenAddress リダイレクトURIのスキーム抜く部分
※１ listenAddress のポートを開ける必要です
※２ enableSSHCA が必要です
{
"type": "OIDC",
"name": "slinktest/winodws",
"clientID": "NdLuYwC725NcUBrEj42x6o58q4Z7mn6W",
"clientSecret": "secret",
"configurationEndpoint": "https://slinktest.secioss.net/oidc/.well-known/openid-configuration",
"listenAddress": "localhost:10000",
"claims": {
"enableSSHCA": true
}
}
step-ca サービスを再起動
[root@shu ~]# step-ca /root/.step/config/ca.json
C:\>curl.exe -LO https://dl.step.sm/gh-release/cli/docs-cli-install/v0.18.2/step_windows_0.18.2_amd64.zip C:\>Expand-Archive -LiteralPath .\step_windows_0.18.2_amd64.zip -DestinationPath . C:\>step_0.18.2\bin\step.exe version
サービスマネージャーを起動し、
C:\>services.msc
「OpenSSH Authentication Agent」を起動する、そして ssh-agent を起動
C:\>ssh-agent
step-caサーバーのfingerprint指定する必要があります。
fingerprintの取得方法は step-ca サーバー上下記のコマンドを打ってください。
[root@shu ~]# step certificate fingerprint $(step path)/certs/root_ca.crt
f9d4355c7fee1ecc30da460b39877eb73a0b75191241b25622b11f6b7775674b
Windowsは下記のコマンドでstep-ca を指定することができます。 C:\step_0.18.2\bin>step ca bootstrap --ca-url shu.dev.secioss.work:8443 --fingerprint f9d4355c7fee1ecc30da460b39877eb73a0b75191241b25622b11f6b7775674b The root certificate has been saved in C:\Users\shu\.step\certs\root_ca.crt. The authority configuration has been saved in C:\Users\shu\.step\config\defaults.json.
参考 https://smallstep.com/blog/diy-single-sign-on-for-ssh/
step の ssh ログインコマンドを叩くと、Windows のデフォルトブラウザが自動的に立ち上がり、
slinktest のログイン画面が表示されます、ログイン後 OIDC の許可画面が表示され、許可すると Success 表示されるとログイン完成です。
C:\step_0.18.2\bin>step ssh login alice
✔ Provisioner: slinktest/windows (OIDC) [client: LfgqFL24j528oM5N77fGK5U2fsFxFys9]
Your default web browser has been opened to visit:
https://slinktest.secioss.net/oidc/authorize.php?client_id=LfgqFL24j528oM5N77fGK5U2fsFxFys9&code_challenge=4ANFtYzGrF_ujWhmUVhJYHjp83wo6uP_ebE6xs7saMs&code_challenge_method=S256&nonce=49e7fbb8f976e24d33db26c5e66ceb3971cec90c5c8634eb57c03f529bc8ede6&redirect_uri=http%3A%2F%2Flocalhost%3A10000&response_type=code&scope=openid+email&state=WyJYeZ077CKFY0rFpWmv56HU0pmgtvSO
✔ CA: https://shu.dev.secioss.work:8443✔ SSH Agent: yes
ログイン後は、普通の ssh でログインコマンドでターゲットサーバーへログインできるようになります
C:\step_0.18.2\bin>ssh alice@shu.dev.secioss.work
Last login: Wed Mar 9 14:41:10 2022 from 192.168.163.8
[alice@shu ~]$
下記の設定を追加することで、上記と同等なことが実現できます
C:\user\shu.ssh\config
Match exec "step ssh check-host %h"
ForwardAgent yes
User alice
UserKnownHostsFile "C:\user\shu\.ssh\known_hosts"
ProxyCommand step ssh proxycommand %r %h %p --provisioner "slinktest/winodws"
C:\step_0.18.2\bin> ssh shu.dev.secioss.work ✔ Provisioner: slinktest/windows (OIDC) [client: LfgqFL24j528oM5N77fGK5U2fsFxFys9] Your default web browser has been opened to visit:
https://slinktest.secioss.net/oidc/authorize.php?client_id=LfgqFL24j528oM5N77fGK5U2fsFxFys9&code_challenge=eEiEh97M9Vgzq25TeMp71_3YYuTF9b_XVh9lLaytJP8&code_challenge_method=S256&nonce=6562d2350f61911ccf2ac6ae49756ac5ba856cd9c7f9ef2619f1693867f477f8&redirect_uri=http%3A%2F%2Flocalhost%3A10000&response_type=code&scope=openid+email&state=IAosgtabAVsGAfYeaeTrYlLGE4XGAfnQ
✔ CA: https://shu.dev.secioss.work:8443Last login: Wed Mar 9 17:33:28 2022 from 192.168.163.8[alice@shu ~]$[alice@shu ~]$ exitログアウトConnection to shu.dev.secioss.work closed.C:\step_0.18.2\bin>