1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
#!/usr/bin/env python3
# RPC server for automatically signing SSH host (and user) certificates.
# Companion to rpc_pkisignd which handles X.509 certificates.
import argparse
import n.dns
import os
from n.xdr.server import run as run_server
from lib import SSHCA_PORT, SSHCA_SERVICE
from lib.service import SshCaService, SshCaInterface
parser = argparse.ArgumentParser()
# Service options
parser.add_argument("-d", "--directory",
metavar="PATH",
help="path to sshsignd data directory")
# Host options
parser.add_argument("-p", "--listen-port",
metavar="PORT",
type=int,
default=SSHCA_PORT,
help="HTTPS listening port")
parser.add_argument("-g", "--gss-service",
metavar="NAME",
default=SSHCA_SERVICE,
help="GSSAPI service name")
parser.add_argument("-t", "--gss-keytab",
metavar="PATH",
help="path to GSSAPI keytab")
args = parser.parse_args()
data_dir = args.directory or "/etc/private/sshsignd"
svc = SshCaService(host_ca_path=os.path.join(data_dir, "host_ca"),
user_ca_path=os.path.join(data_dir, "user_ca"),
host_domains=n.dns.DOMAINS)
n.xdr.server.run(SshCaInterface, (svc,),
port=args.listen_port,
gss_service=args.gss_service,
gss_keytab=args.gss_keytab)
|
