Use SSH certificate based authentication

7 files changed, 23 insertions, 17 deletions

diff --git a/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/files/ssh-client-ca.pub b/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/files/ssh-client-ca.pub
new file mode 100644
index 0000000..2f41ca3
--- /dev/null
+++ b/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/files/ssh-client-ca.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF4vwnl8xt6Q2pL2UI0ly2s4tEZ4Vrt5VlTgVSiLp9DBVId8ePwMKuo0zYe8/3UzqMqHexMhLMf35dPr2hKifzg= ssh-client-ca-key
diff --git a/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/openssh-client-ca-pubkey.bb b/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/openssh-client-ca-pubkey.bb
new file mode 100644
index 0000000..3112e80
--- /dev/null
+++ b/meta-unit-core/recipes-connectivity/openssh-client-ca-pubkey/openssh-client-ca-pubkey.bb
@@ -0,0 +1,13 @@
+SUMMARY = "Add SSH client CA public key"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${UNIT_CORE_LAYERDIR}/LICENSE;md5=38bf13be5d6979b28bd8adddb2f2f9b3"
+
+SRC_URI = "file://ssh-client-ca.pub"
+
+S = "${UNPACKDIR}"
+
+do_install() {
+    install -D -m 0644 ${UNPACKDIR}/ssh-client-ca.pub ${D}${sysconfdir}/ssh/ssh-client-ca.pub
+}
+
+FILES:${PN} = "${sysconfdir}/ssh/ssh-client-ca.pub"
diff --git a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend
index d520f4a..ce77f4d 100644
--- a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend
+++ b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend
@@ -9,6 +9,9 @@ do_install:append () {
 	
 	# Add global authorized_keys file to AuthorizedKeysFile
 	sed -i -e 's:^AuthorizedKeysFile.*:AuthorizedKeysFile\t.ssh/authorized_keys /etc/ssh/authorized_keys:' ${D}${sysconfdir}/ssh/sshd_config
+
+	# Disable authorized keys file
+	sed -i -E 's/^AuthorizedKeysFile[[:blank:]]+\.ssh\/authorized_keys$/#&/' ${D}${sysconfdir}/ssh/sshd_config
 	
 	# Disable password authentication
 	sed -i -e 's:#PasswordAuthentication yes:PasswordAuthentication no:' ${D}${sysconfdir}/ssh/sshd_config
@@ -20,4 +23,9 @@ do_install:append () {
 	echo "" >> ${D}${sysconfdir}/ssh/sshd_config
 	echo "# Allow only the unitexe user" >> ${D}${sysconfdir}/ssh/sshd_config
 	echo "AllowUsers unitexe" >> ${D}${sysconfdir}/ssh/sshd_config
+
+	# Restrict SSH access to keys that have been signed by CA only
+	echo "" >> ${D}${sysconfdir}/ssh/sshd_config
+	echo "# Allow only keys signed by CA" >> ${D}${sysconfdir}/ssh/sshd_config
+	echo "TrustedUserCAKeys /etc/ssh/ssh-client-ca.pub" >> ${D}${sysconfdir}/ssh/sshd_config
 }
diff --git a/meta-unit-core/recipes-core/packagegroups/packagegroup-unit-networking.bb b/meta-unit-core/recipes-core/packagegroups/packagegroup-unit-networking.bb
index 977d521..91e5dda 100644
--- a/meta-unit-core/recipes-core/packagegroups/packagegroup-unit-networking.bb
+++ b/meta-unit-core/recipes-core/packagegroups/packagegroup-unit-networking.bb
@@ -4,4 +4,5 @@ inherit packagegroup
 
 RDEPENDS:${PN}:append = " curl"
 RDEPENDS:${PN}:append = " openssh"
+RDEPENDS:${PN}:append = " openssh-client-ca-pubkey"
 RDEPENDS:${PN}:append = " socat"
diff --git a/meta-unit-core/recipes-users/ssh-authorized-keys/files/authorized_keys b/meta-unit-core/recipes-users/ssh-authorized-keys/files/authorized_keys
deleted file mode 100644
index e567ca6..0000000
--- a/meta-unit-core/recipes-users/ssh-authorized-keys/files/authorized_keys
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMovGBPRZAcuJiEO/3xfSqHki2b8/tZL+UfqoSoC8D27 unitexe70@gmail.com
diff --git a/meta-unit-core/recipes-users/ssh-authorized-keys/ssh-authorized-keys.bb b/meta-unit-core/recipes-users/ssh-authorized-keys/ssh-authorized-keys.bb
deleted file mode 100644
index 8989486..0000000
--- a/meta-unit-core/recipes-users/ssh-authorized-keys/ssh-authorized-keys.bb
+++ /dev/null
@@ -1,15 +0,0 @@
-SUMMARY = "Add authorized SSH keys for unitexe user"
-LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://${UNIT_CORE_LAYERDIR}/LICENSE;md5=38bf13be5d6979b28bd8adddb2f2f9b3"
-
-SRC_URI = "file://authorized_keys"
-
-S = "${UNPACKDIR}"
-
-USER_NAME = "unitexe"
-
-do_install() {
-    install -D -m 0600 ${UNPACKDIR}/authorized_keys ${D}/home/${USER_NAME}/.ssh/authorized_keys
-}
-
-FILES:${PN} = "/home/${USER_NAME}/.ssh/authorized_keys"
diff --git a/meta-unit-core/recipes-users/useradd/add-user-unitexe.bb b/meta-unit-core/recipes-users/useradd/add-user-unitexe.bb
index 5af066d..db47bf0 100644
--- a/meta-unit-core/recipes-users/useradd/add-user-unitexe.bb
+++ b/meta-unit-core/recipes-users/useradd/add-user-unitexe.bb
@@ -10,7 +10,6 @@ RDEPENDS:${PN}:append = " base-passwd"
 RDEPENDS:${PN}:append = " busybox"
 RDEPENDS:${PN}:append = " sudo"
 RDEPENDS:${PN}:append = " shadow"
-RDEPENDS:${PN}:append = " ssh-authorized-keys"
 RDEPENDS:${PN}:append = " systemd"
 
 USERADD_PACKAGES = "${PN}"