1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
#!/usr/bin/env python3
import argparse
import n.kerberos
import os
from lib import SSHCA_HOST
from lib.client import sshsign_client, RemoteFault
parser = argparse.ArgumentParser()
parser.add_argument("-A", "--update-host",
action="store_true",
help="obtain host certificates for keys in /etc/ssh")
parser.add_argument("-P", "--print-host-ca",
action="store_true",
help="print host certificate issuer")
parser.add_argument("-g", "--algorithms",
metavar="ALGO[,ALGO...]",
default="ed25519",
help="key algorithms to issue certificates for")
parser.add_argument("-s", "--server",
metavar="HOST",
default=SSHCA_HOST,
help="rpc.sshsignd server hostname")
args = parser.parse_args()
n.kerberos.use_default_creds()
client = sshsign_client(args.server)
try:
if args.update_host:
hostname = os.uname().nodename
algorithms = args.algorithms.split(",")
for algo in algorithms:
public_key_path = f"/etc/ssh/ssh_host_{algo}_key.pub"
certificate_path = f"/etc/ssh/ssh_host_{algo}_key-cert.pub"
print(f"Requesting certificate for key {public_key_path!r}")
with open(public_key_path, "r") as fh:
public_key = fh.read()
certificate = client.SignHostKey(public_key, hostname)
with open(certificate_path, "w") as fh:
fh.write(certificate)
print(f"Updated {certificate_path}")
elif args.print_host_ca:
ca_certificate = client.GetHostAuthority()
domains = client.GetHostDomains()
for domain in domains:
print(f"@cert-authority *.{domain}", ca_certificate)
else:
exit("sshrenew: no action specified")
except RemoteFault as e:
exit(f"sshrenew: server error: {e.message} ({e.data})")
|
