14.3.5. Creating SSH Certificates

Procedure 14.4. Generating a Host Certificate

1. Host keys are generated automatically on the system. To list them enter the following command:

   ~]# ls -l /etc/ssh/ssh_host*
   -rw-------. 1 root root  668 May  6 14:38 /etc/ssh/ssh_host_dsa_key
   -rw-r--r--. 1 root root  590 May  6 14:38 /etc/ssh/ssh_host_dsa_key.pub
   -rw-------. 1 root root  963 May  6 14:38 /etc/ssh/ssh_host_key
   -rw-r--r--. 1 root root  627 May  6 14:38 /etc/ssh/ssh_host_key.pub
   -rw-------. 1 root root 1679 May  6 14:38 /etc/ssh/ssh_host_rsa_key
   -rw-r--r--. 1 root root  382 May  6 14:38 /etc/ssh/ssh_host_rsa_key.pub

2. Copy the chosen public key to the server designated as the CA. For example, from the host:

   ~]# scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
   The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.
   RSA key fingerprint is b0:e5:ea:b8:75:e2:f0:b1:fe:5b:07:39:7f:58:64:d9.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added 'ca-server.example.com,10.34.74.58' (RSA) to the list of known hosts.
   admin@ca-server.example.com's password:
   ssh_host_rsa_key.pub                           100%  382     0.4KB/s   00:00

   Alternately, from the CA:

   ~]$ scp root@host_name.example.com:/etc/ssh/ssh_host_rsa_key.pub ~/keys/ssh_host_rsa_key.pub

3. On the CA server, sign the host's public key. For example, as root:

   ~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -Z host_name.example.com -V -1d:+54w /home/admin/keys/ssh_host_rsa_key.pub
   Enter passphrase:
   Signed host key /home/admin/keys/ssh_host_rsa_key-cert.pub: id "host_name" serial 0 for host_name.example.com valid from 2015-05-26T12:21:54 to 2016-06-08T12:21:54

   Where host_name is the host name of the system requiring the certificate.
4. Copy the certificate to the host. For example, from the CA:

   ~]# scp /home/admin/keys/ssh_host_rsa_key-cert.pub root@host_name.example.com:/etc/ssh/
   root@host_name.example.com's password:
   ssh_host_rsa_key-cert.pub                      100% 1384     1.5KB/s   00:00

5. Configure the host to present the certificate to a user's system when a user initiates the login process. As root, edit the /etc/ssh/sshd_config file as follows:

   HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub

6. Restart sshd to make the changes take effect:

   ~]# service sshd restart

7. On user's systems. remove keys belonging to hosts from the ~/.ssh/known_hosts file if the user has previously logged into the host configured above. When a user logs into the host they should no longer be presented with the warning about the hosts authenticity.

Procedure 14.5. Generating a User Certificate

1. On client systems, login as the user who requires the certificate. Check for available keys as follows:

   ~]$ ls -l ~/.ssh/

   If no suitable public key exists, generate one and set the directory permissions if the directory is not the default directory. For example, enter the following command:

   ~]$ ssh-keygen -t rsa
   Generating public/private rsa key pair.
   Enter file in which to save the key (/home/user1/.ssh/id_rsa):
   Created directory '/home/user1/.ssh'.
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /home/user1/.ssh/id_rsa.
   Your public key has been saved in /home/user1/.ssh/id_rsa.pub.
   The key fingerprint is:
   b1:f8:26:a7:46:87:c3:60:54:a3:6d:85:0d:60:fe:ce user1@host1.example.com
   The key's randomart image is:
   +--[ RSA 2048]----+
   |    oo++.        |
   |   o.o.o.        |
   |   .o o .        |
   |    oo . o       |
   |   . oo.S        |
   |     o=..        |
   |     .Eo+        |
   |      .=         |
   |     ..          |
   +-----------------+

   By default the directory permissions for a user's keys are drwx------., or octal 0700. If required, confirm the permissions are correct:

   ~]$ ls -la ~/.ssh
   total 16
   drwx------. 2 user1 user1 4096 May  7 12:37 .
   drwx------. 3 user1 user1 4096 May  7 12:37 ..
   -rw-------. 1 user1 user1 1679 May  7 12:37 id_rsa
   -rw-r--r--. 1 user1 user1  421 May  7 12:37 id_rsa.pub

   See Section 14.2.4, “Using Key-Based Authentication” for more examples of key generation and for instructions on setting the correct directory permissions.
2. The chosen public key must be copied to the server designated as the CA, in order to be signed. The secure copy command can be used to do this, the command has the following format:

   scp ~/.ssh/id_protocol.pub admin@ca_server.example.com:~/keys/

   Where protocol is the part of the file name indicating the protocol used to generate the key, for example rsa, admin is an account on the CA server, and /keys/ is a directory setup to receive the keys to be signed.
   Copy the chosen public key to the server designated as the CA. For example:

   ~]$ scp ~/.ssh/id_rsa.pub admin@ca-server.example.com:~/keys/
   admin@ca-server.example.com's password:
   id_rsa.pub                                  100%  421     0.4KB/s   00:00

   If you have configured the client system to trust the host signing key as described in Procedure 14.3, “Trusting the Host Signing Key” then you should not see a warning about the authenticity of the remote host.
3. On the CA server, sign the user's public key. For example, as root:

   ~]# ssh-keygen -s ~/.ssh/ca_user_key -I user1 -Z user1 -V -1d:+54w /home/admin/keys/id_rsa.pub
   Enter passphrase:
   Signed user key /home/admin/keys/id_rsa-cert.pub: id "user1" serial 0 for host_name.example.com valid from 2015-05-21T16:43:17 to 2016-06-03T16:43:17

4. Copy the resulting certificate to the user's ~/.ssh/ directory on their system. For example:

   ~]# scp /home/admin/keys/id_rsa-cert.pub user1@host_name.example.com:~/.ssh/
   user1@host_name.example.com's password:
   id_rsa-cert.pub                             100%  1498    1.5KB/s   00:00

5. If using the standard file names and location then no further configuration is required as the SSH daemon will search for user certificates ending in -cert.pub and use them automatically if it finds them. Note that the default location and file names for for SSH version 2 keys are: ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa as explained in the ssh_config(5) manual page. If you use these locations and naming conventions then there is no need for editing the configuration files to enable sshd to present the certificate. They will be used automatically when logging in to a remote system. In this is the case then skip to step 6.
   If required to use a non-default directory or file naming convention, then as root, add the following line to the /etc/ssh/ssh_config or ~/.ssh/config files:

   IdentityFile ~/path/key_file

   Note that this must be the private key name, do not had .pub or -cert.pub. Ensure the file permission are correct. For example:

   ~]$ ls -la ~/.ssh/config
   -rw-rw-r--. 1 user1 user1 36 May 27 21:49 /home/user1/.ssh/config
   chmod 700 ~/.ssh/config
   ~]$ ls -la ~/.ssh/config
   -rwx------. 1 user1 user1 36 May 27 21:49 /home/user1/.ssh/config

   This will enable the user of this system to be authenticated by a user certificate when logging into a remote system configured to trust the CA user certificate signing key.
6. To test the user certificate, attempt to log into a server over SSH from the user's account. You should do this as the user listed as a principle in the certificate, if any are specified. You should not be prompted for a password. If required, add the -v option to the SSH command to see logging information.