diff options
| author | unitexe <unitexe70@gmail.com> | 2026-08-30 00:30:56 -0500 |
|---|---|---|
| committer | unitexe <unitexe70@gmail.com> | 2026-10-01 11:23:52 -0500 |
| commit | ce243e5e3e7d07f75665ce18f854a2c38cc7f43c (patch) | |
| tree | 745e259d02f8bdd3eee600df886a74c4fb9a8c91 /meta-unit-core/recipes-connectivity/openssh | |
| parent | b021340758843014cdf2343aa5654eaf8614b36d (diff) | |
Use SSH certificate based authentication
Diffstat (limited to 'meta-unit-core/recipes-connectivity/openssh')
| -rw-r--r-- | meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend index d520f4a..ce77f4d 100644 --- a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend +++ b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend @@ -9,6 +9,9 @@ do_install:append () { # Add global authorized_keys file to AuthorizedKeysFile sed -i -e 's:^AuthorizedKeysFile.*:AuthorizedKeysFile\t.ssh/authorized_keys /etc/ssh/authorized_keys:' ${D}${sysconfdir}/ssh/sshd_config + + # Disable authorized keys file + sed -i -E 's/^AuthorizedKeysFile[[:blank:]]+\.ssh\/authorized_keys$/#&/' ${D}${sysconfdir}/ssh/sshd_config # Disable password authentication sed -i -e 's:#PasswordAuthentication yes:PasswordAuthentication no:' ${D}${sysconfdir}/ssh/sshd_config @@ -20,4 +23,9 @@ do_install:append () { echo "" >> ${D}${sysconfdir}/ssh/sshd_config echo "# Allow only the unitexe user" >> ${D}${sysconfdir}/ssh/sshd_config echo "AllowUsers unitexe" >> ${D}${sysconfdir}/ssh/sshd_config + + # Restrict SSH access to keys that have been signed by CA only + echo "" >> ${D}${sysconfdir}/ssh/sshd_config + echo "# Allow only keys signed by CA" >> ${D}${sysconfdir}/ssh/sshd_config + echo "TrustedUserCAKeys /etc/ssh/ssh-client-ca.pub" >> ${D}${sysconfdir}/ssh/sshd_config } |