awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-11 19:28:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add permissioning to SSH, add publicKey return for SSH CA, polish

Browse Source
This commit is contained in:
Tuan Dang
2024-12-03 17:38:23 -08:00
parent 4fc8c509ac
commit 07d9398aad
25 changed files with 397 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts
+30 -2
View File
@@ -67,6 +67,32 @@ export const createSshKeyPair = (keyAlgorithm: CertKeyAlgorithm, comment: string
return { publicKey, privateKey };
};
/**
* Return the SSH public key for the given SSH private key.
* @param privateKey - The SSH private key to get the public key for
*/
export const getSshPublicKey = (privateKey: string) => {
const uniqueId = crypto.randomBytes(8).toString("hex");
const privateKeyFile = `ssh_key_${uniqueId}`;
const publicKeyFile = `${privateKeyFile}.pub`;
if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
fs.writeFileSync(privateKeyFile, privateKey);
fs.chmodSync(privateKeyFile, 0o600);
const command = `ssh-keygen -y -f ${privateKeyFile} > ${publicKeyFile}`;
execSync(command);
const publicKey = fs.readFileSync(publicKeyFile, "utf8");
fs.unlinkSync(privateKeyFile);
fs.unlinkSync(publicKeyFile);
return publicKey;
};
/**
* Validate the requested SSH certificate type based on the SSH certificate template configuration.
* @param template - The SSH certificate template configuration
@@ -160,9 +186,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
const uniqueId = crypto.randomBytes(8).toString("hex");
const publicKeyFile = `user_key_${uniqueId}.pub`;
const privateKeyFile = `ssh_ca_key_${uniqueId}`;
const signedPublicKeyFile = `user_key_${uniqueId}-cert.pub`;
if (fs.existsSync(publicKeyFile)) fs.unlinkSync(publicKeyFile);
if (fs.existsSync(privateKeyFile)) fs.unlinkSync(privateKeyFile);
if (fs.existsSync(signedPublicKeyFile)) fs.unlinkSync(signedPublicKeyFile);
// write public and private keys to temp files
fs.writeFileSync(publicKeyFile, userPublicKey);
@@ -170,7 +198,6 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
fs.chmodSync(privateKeyFile, 0o600);
const serialNumber = createSshCertSerialNumber();
console.log("signSshKey serialNumber: ", serialNumber);
const certOptions = [
`-s ${privateKeyFile}`, // path to SSH CA private key
@@ -189,10 +216,11 @@ export const createSshCert = ({ caPrivateKey, userPublicKey, keyId, principals,
// Execute the signing process
execSync(command);
const signedPublicKey = fs.readFileSync(publicKeyFile, "utf8");
const signedPublicKey = fs.readFileSync(signedPublicKeyFile, "utf8");
fs.unlinkSync(publicKeyFile);
fs.unlinkSync(privateKeyFile);
fs.unlinkSync(signedPublicKeyFile);
return { serialNumber, signedPublicKey };
};