mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Add alias field to ssh hosts for improved ux
This commit is contained in:
Tuan Dang
@@ -22,15 +22,15 @@ This command enables you to obtain SSH credentials used to access a remote host.
|
||||
<Accordion title="--hostname">
|
||||
The hostname of the SSH host to connect to. If not provided, you will be prompted to select from available hosts.
|
||||
</Accordion>
|
||||
<Accordion title="--loginUser">
|
||||
<Accordion title="--login-user">
|
||||
The login user for the SSH connection. If not provided, you will be prompted to select from available login users.
|
||||
</Accordion>
|
||||
<Accordion title="--writeHostCaToFile">
|
||||
<Accordion title="--write-host-ca-to-file">
|
||||
Whether to write the Host CA public key to `~/.ssh/known_hosts` if it doesn't already exist.
|
||||
|
||||
Default value: `true`
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
<Accordion title="--out-file-path">
|
||||
The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be added to the SSH agent and used to establish an interactive SSH connection.
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
@@ -39,108 +39,52 @@ This command enables you to obtain SSH credentials used to access a remote host.
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical ssh issue-credentials">
|
||||
This command is used to issue SSH credentials (SSH certificate, public key, and private key) against a certificate template.
|
||||
|
||||
We recommend using the `--addToAgent` flag to automatically load issued SSH credentials to the SSH agent.
|
||||
<Accordion title="infisical ssh add-host">
|
||||
This command is used to register a new SSH host with Infisical.
|
||||
|
||||
This command can be used with the `--write-user-ca-to-file`, `--write-host-cert-to-file`, and `--configure-sshd` flags
|
||||
to also configure the host's SSH daemon with the necessary certificate authority and host certificate settings.
|
||||
|
||||
```bash
|
||||
$ infisical ssh issue-credentials --certificateTemplateId=<certificate-template-id> --principals=<principals> --addToAgent
|
||||
$ infisical ssh add-host --projectId=<project-id> --hostname=<hostname>
|
||||
```
|
||||
|
||||
### Flags
|
||||
<Accordion title="--certificateTemplateId">
|
||||
The ID of the SSH certificate template to issue SSH credentials for.
|
||||
<Accordion title="--projectId">
|
||||
Project ID the host belongs to (required)
|
||||
</Accordion>
|
||||
<Accordion title="--principals">
|
||||
A comma-separated list of principals (i.e. usernames like `ec2-user` or hostnames) to issue SSH credentials for.
|
||||
<Accordion title="--hostname">
|
||||
Hostname of the SSH host (required)
|
||||
</Accordion>
|
||||
<Accordion title="--addToAgent">
|
||||
Whether to add issued SSH credentials to the SSH agent.
|
||||
<Accordion title="--write-user-ca-to-file">
|
||||
Write User CA public key to `/etc/ssh/infisical_user_ca.pub`
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--user-ca-out-file-path">
|
||||
Custom file path to write the User CA public key
|
||||
|
||||
Default value: `/etc/ssh/infisical_user_ca.pub`
|
||||
</Accordion>
|
||||
<Accordion title="--write-host-cert-to-file">
|
||||
Write SSH host certificate to `/etc/ssh/ssh_host_<type>_key-cert.pub`
|
||||
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--configure-sshd">
|
||||
Update `TrustedUserCAKeys`, `HostKey`, and `HostCertificate` in the `/etc/ssh/sshd_config` file
|
||||
|
||||
Default value: `false`
|
||||
|
||||
Note that either the `--outFilePath` or `--addToAgent` flag must be set for the sub-command to execute successfully.
|
||||
Note: This flag requires both --write-user-ca-to-file and --write-host-cert-to-file to be set
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
The path to write the SSH credentials to such as `~/.ssh`, `./some_folder`, `./some_folder/id_rsa-cert.pub`. If not provided, the credentials will be saved to the current working directory where the command is run.
|
||||
<Accordion title="--force">
|
||||
Force overwrite of existing certificate files as part of `--write-user-ca-to-file` and `--write-host-cert-to-file`
|
||||
|
||||
Note that either the `--outFilePath` or `--addToAgent` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--keyAlgorithm">
|
||||
The key algorithm to issue SSH credentials for.
|
||||
|
||||
Default value: `RSA_2048`
|
||||
|
||||
Available options: `RSA_2048`, `RSA_4096`, `EC_prime256v1`, `EC_secp384r1`.
|
||||
</Accordion>
|
||||
<Accordion title="--certType">
|
||||
The certificate type to issue SSH credentials for.
|
||||
|
||||
Default value: `user`
|
||||
|
||||
Available options: `user` or `host`
|
||||
</Accordion>
|
||||
<Accordion title="--ttl">
|
||||
The time-to-live (TTL) for the issued SSH certificate (e.g. `2 days`, `1d`, `2h`, `1y`).
|
||||
|
||||
Defaults to the Default TTL value set in the certificate template.
|
||||
</Accordion>
|
||||
<Accordion title="--keyId">
|
||||
A custom Key ID to issue SSH credentials for.
|
||||
|
||||
Defaults to the autogenerated Key ID by Infisical.
|
||||
Default value: `false`
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
An authenticated token to use to issue SSH credentials.
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical ssh sign-key">
|
||||
This command is used to sign an existing SSH public key against a certificate template; the command outputs the corresponding signed SSH certificate.
|
||||
|
||||
```bash
|
||||
$ infisical ssh sign-key --certificateTemplateId=<certificate-template-id> --publicKey=<public-key> --principals=<principals> --outFilePath=<out-file-path>
|
||||
```
|
||||
<Accordion title="--certificateTemplateId">
|
||||
The ID of the SSH certificate template to issue the SSH certificate for.
|
||||
</Accordion>
|
||||
<Accordion title="--publicKey">
|
||||
The public key to sign.
|
||||
|
||||
Note that either the `--publicKey` or `--publicKeyFilePath` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--publicKeyFilePath">
|
||||
The path to the public key file to sign.
|
||||
|
||||
Note that either the `--publicKey` or `--publicKeyFilePath` flag must be set for the sub-command to execute successfully.
|
||||
</Accordion>
|
||||
<Accordion title="--principals">
|
||||
A comma-separated list of principals (i.e. usernames like `ec2-user` or hostnames) to issue SSH credentials for.
|
||||
</Accordion>
|
||||
<Accordion title="--outFilePath">
|
||||
The path to write the SSH certificate to such as `~/.ssh/id_rsa-cert.pub`; the specified file must have the `.pub` extension. If not provided, the credentials will be saved to the directory of the specified `--publicKeyFilePath` or the current working directory where the command is run.
|
||||
</Accordion>
|
||||
<Accordion title="--certType">
|
||||
The certificate type to issue SSH credentials for.
|
||||
|
||||
Default value: `user`
|
||||
|
||||
Available options: `user` or `host`
|
||||
</Accordion>
|
||||
<Accordion title="--ttl">
|
||||
The time-to-live (TTL) for the issued SSH certificate (e.g. `2 days`, `1d`, `2h`, `1y`).
|
||||
|
||||
Defaults to the Default TTL value set in the certificate template.
|
||||
</Accordion>
|
||||
<Accordion title="--keyId">
|
||||
A custom Key ID to issue SSH credentials for.
|
||||
|
||||
Defaults to the autogenerated Key ID by Infisical.
|
||||
</Accordion>
|
||||
<Accordion title="--token">
|
||||
An authenticated token to use to issue SSH credentials.
|
||||
Use a machine identity access token
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
Reference in New Issue
Block a user