diff --git a/backend/src/db/migrations/20250404022310_ssh-ca-key-source.ts b/backend/src/db/migrations/20250404022310_ssh-ca-key-source.ts index 45955fc12..dc05eb9e5 100644 --- a/backend/src/db/migrations/20250404022310_ssh-ca-key-source.ts +++ b/backend/src/db/migrations/20250404022310_ssh-ca-key-source.ts @@ -15,6 +15,12 @@ export async function up(knex: Knex): Promise { t.string("keySource").notNullable().alter(); }); } + + if (await knex.schema.hasColumn(TableName.SshCertificate, "sshCaId")) { + await knex.schema.alterTable(TableName.SshCertificate, (t) => { + t.uuid("sshCaId").nullable().alter(); + }); + } } export async function down(knex: Knex): Promise { diff --git a/backend/src/db/schemas/ssh-certificates.ts b/backend/src/db/schemas/ssh-certificates.ts index 6fe5bc261..351875bbb 100644 --- a/backend/src/db/schemas/ssh-certificates.ts +++ b/backend/src/db/schemas/ssh-certificates.ts @@ -11,7 +11,7 @@ export const SshCertificatesSchema = z.object({ id: z.string().uuid(), createdAt: z.date(), updatedAt: z.date(), - sshCaId: z.string().uuid(), + sshCaId: z.string().uuid().nullable().optional(), sshCertificateTemplateId: z.string().uuid().nullable().optional(), serialNumber: z.string(), certType: z.string(), diff --git a/docs/documentation/platform/ssh.mdx b/docs/documentation/platform/ssh.mdx index 179fa9590..00f7cf269 100644 --- a/docs/documentation/platform/ssh.mdx +++ b/docs/documentation/platform/ssh.mdx @@ -98,6 +98,7 @@ as part of the SSH operation. Here's some guidance on each field: - Friendly Name: A friendly name for the CA; this is only for display. + - Key Source: Whether the CA's key pair should be generated internally or supplied from an external source. Select **Internal**. - Key Algorithm: The type of public key algorithm and size, in bits, of the key pair for the CA. Supported key algorithms are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, and `ECDSA P-384` with the default being `RSA 2048`. @@ -217,6 +218,16 @@ infisical login In the following steps, we show how to configure host key signing for clients to verify the identity of a remote host before attempting the SSH operation; this is recommended to reduce the probability of a client accessing a malicious machine. + +This guide expects that the remote host already has an existing SSH key pair (typically found in the `/etc/ssh/` folder at `/etc/ssh/ssh_host__key` and `.pub`). + +In the event that the remote host does not have an existing SSH key pair, you can generate a new key pair using the `ssh-keygen` command: `ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''`. This will generate: + +- A private key: `/etc/ssh/ssh_host_rsa_key`. +- A public key: `/etc/ssh/ssh_host_rsa_key.pub`. + + + 1.1. In the same SSH project, create another SSH CA in the **Certificate Authorities** tab; this CA will be used for host key signing. @@ -228,7 +239,9 @@ In the following steps, we show how to configure host key signing for clients to Here's some guidance on each field: - Friendly Name: A friendly name for the CA; this is only for display. - - Key Algorithm: The type of public key algorithm and size, in bits, of the key pair for the CA. Supported key algorithms are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, and `ECDSA P-384` with the default being `RSA 2048`. + - Key Source: Whether the CA's key pair should be generated internally or supplied from an external source. Select **External**. + - Public Key: The public key for the CA (i.e. the host's SSH public key). + - Private Key: The private key for the CA (i.e. the host's SSH private key). @@ -262,12 +275,12 @@ In the following steps, we show how to configure host key signing for clients to You should select **Sign SSH Key** under the **Operation** field. - Then input your host's public key under the **SSH Public Key** field and hostname under the **Principal(s)** field; the host's public key is likely in the `/etc/ssh` folder of the host. + Then input your host's SSH public key under the **SSH Public Key** field and hostname under the **Principal(s)** field; the host's public key should be in the `/etc/ssh` folder of the host as used in step 1. ![ssh host issue certificate 3](/images/platform/ssh/ssh-host-issue-cert-3.png) - 2.2. Create a file containing the certificate in the SSH folder of the remote host; we'll call it `key-cert.pub`. + 2.2. Create a file containing the certificate in the SSH folder of the remote host; we'll call it `ssh_host_key-cert.pub`. 2.2. Set permissions on the certificate to be `0640`: @@ -278,10 +291,14 @@ In the following steps, we show how to configure host key signing for clients to 2.3. Next, add the following lines to the `/etc/ssh/sshd_config` file on the remote host. ```bash - HostKey /etc/ssh/ssh_host_key + HostKey /etc/ssh/ssh_host_rsa_key HostCertificate /etc/ssh/ssh_host_key-cert.pub ``` + + You should adjust the `HostKey` directive to match the path to the host's SSH private key as used in step 1. + + 2.4. Finally, reload the SSH daemon on the remote host to apply the changes. ```bash @@ -314,3 +331,33 @@ In the following steps, we show how to configure host key signing for clients to + +## FAQ + + + + After configuring Infisical SSH, you can add the `-vvv` flag as part of the + SSH operation to see verbose output from the SSH client. + + ```bash + ssh -vvv username@hostname + ``` + + You should see output from the SSH client that includes the following if both client key signing and host key signing are working: + + Host certificate was verified and trusted: + + ```bash + debug1: Host 'example.com' is known and matches the ECDSA-CERT host certificate. + debug1: Found CA key in /Users/user/.ssh/known_hosts:1 + ``` + + You authenticated with your user certificate: + + ```bash + debug1: Offering public key: Added via Infisical CLI RSA-CERT SHA256:... + debug1: Server accepts key: Added via Infisical CLI RSA-CERT SHA256:... + ``` + + + diff --git a/docs/images/platform/ssh/ssh-client-ca-public-key.png b/docs/images/platform/ssh/ssh-client-ca-public-key.png index 2f09756c4..058b844fb 100644 Binary files a/docs/images/platform/ssh/ssh-client-ca-public-key.png and b/docs/images/platform/ssh/ssh-client-ca-public-key.png differ diff --git a/docs/images/platform/ssh/ssh-client-create-ca-1.png b/docs/images/platform/ssh/ssh-client-create-ca-1.png index c5a5f70e2..30658944f 100644 Binary files a/docs/images/platform/ssh/ssh-client-create-ca-1.png and b/docs/images/platform/ssh/ssh-client-create-ca-1.png differ diff --git a/docs/images/platform/ssh/ssh-client-create-ca-2.png b/docs/images/platform/ssh/ssh-client-create-ca-2.png index c6f997221..3a0bf155c 100644 Binary files a/docs/images/platform/ssh/ssh-client-create-ca-2.png and b/docs/images/platform/ssh/ssh-client-create-ca-2.png differ diff --git a/docs/images/platform/ssh/ssh-client-create-template-1.png b/docs/images/platform/ssh/ssh-client-create-template-1.png index 821d2b42c..0c0ba97c8 100644 Binary files a/docs/images/platform/ssh/ssh-client-create-template-1.png and b/docs/images/platform/ssh/ssh-client-create-template-1.png differ diff --git a/docs/images/platform/ssh/ssh-client-create-template-2.png b/docs/images/platform/ssh/ssh-client-create-template-2.png index ef78dba8b..8c64ec62b 100644 Binary files a/docs/images/platform/ssh/ssh-client-create-template-2.png and b/docs/images/platform/ssh/ssh-client-create-template-2.png differ diff --git a/docs/images/platform/ssh/ssh-host-ca-public-key.png b/docs/images/platform/ssh/ssh-host-ca-public-key.png index e470aba4e..f77034896 100644 Binary files a/docs/images/platform/ssh/ssh-host-ca-public-key.png and b/docs/images/platform/ssh/ssh-host-ca-public-key.png differ diff --git a/docs/images/platform/ssh/ssh-host-create-ca-1.png b/docs/images/platform/ssh/ssh-host-create-ca-1.png index 3cdeaca0b..f064dec35 100644 Binary files a/docs/images/platform/ssh/ssh-host-create-ca-1.png and b/docs/images/platform/ssh/ssh-host-create-ca-1.png differ diff --git a/docs/images/platform/ssh/ssh-host-create-ca-2.png b/docs/images/platform/ssh/ssh-host-create-ca-2.png index bad174c90..75b0fe76c 100644 Binary files a/docs/images/platform/ssh/ssh-host-create-ca-2.png and b/docs/images/platform/ssh/ssh-host-create-ca-2.png differ diff --git a/docs/images/platform/ssh/ssh-host-create-template-1.png b/docs/images/platform/ssh/ssh-host-create-template-1.png index b79f0f47e..e8ec9ec20 100644 Binary files a/docs/images/platform/ssh/ssh-host-create-template-1.png and b/docs/images/platform/ssh/ssh-host-create-template-1.png differ diff --git a/docs/images/platform/ssh/ssh-host-create-template-2.png b/docs/images/platform/ssh/ssh-host-create-template-2.png index ad3f17e58..95b41be9b 100644 Binary files a/docs/images/platform/ssh/ssh-host-create-template-2.png and b/docs/images/platform/ssh/ssh-host-create-template-2.png differ diff --git a/docs/images/platform/ssh/ssh-host-issue-cert-1.png b/docs/images/platform/ssh/ssh-host-issue-cert-1.png index 3dab450f4..c4483eb83 100644 Binary files a/docs/images/platform/ssh/ssh-host-issue-cert-1.png and b/docs/images/platform/ssh/ssh-host-issue-cert-1.png differ diff --git a/docs/images/platform/ssh/ssh-host-issue-cert-2.png b/docs/images/platform/ssh/ssh-host-issue-cert-2.png index eb0ecbcc2..ec5f677bc 100644 Binary files a/docs/images/platform/ssh/ssh-host-issue-cert-2.png and b/docs/images/platform/ssh/ssh-host-issue-cert-2.png differ diff --git a/docs/images/platform/ssh/ssh-host-issue-cert-3.png b/docs/images/platform/ssh/ssh-host-issue-cert-3.png index a5af747fb..41af0c9f3 100644 Binary files a/docs/images/platform/ssh/ssh-host-issue-cert-3.png and b/docs/images/platform/ssh/ssh-host-issue-cert-3.png differ diff --git a/docs/images/platform/ssh/ssh-project.png b/docs/images/platform/ssh/ssh-project.png index 0b57f9245..9b28f04ab 100644 Binary files a/docs/images/platform/ssh/ssh-project.png and b/docs/images/platform/ssh/ssh-project.png differ