14.3.4. Distributing and Trusting SSH CA Public Keys

Procedure 14.2. Trusting the User Signing Key

• For user certificates which have one or more principles listed, and where the setting is to have global effect, edit the /etc/ssh/sshd_config file as follows:

  TrustedUserCAKeys /etc/ssh/ca_user_key.pub

  Copy to Clipboard Toggle word wrap

  Restart sshd to make the changes take effect:

  ~]# service sshd restart

  Copy to Clipboard Toggle word wrap

Procedure 14.3. Trusting the Host Signing Key

1. Extract the contents of the public key used to sign the host certificate. For example, on the CA:

   cat ~/.ssh/ca_host_key.pub
   ssh-rsa  AAAAB5Wm.== root@ca-server.example.com

   Copy to Clipboard Toggle word wrap
2. To configure client systems to trust servers' signed host certificates, add the contents of the ca_host_key.pub into the global known_hosts file. This will automatically check a server's host advertised certificate against the CA public key for all users every time a new machine is connected to in the domain *.example.com. Login as root and configure the /etc/ssh/ssh_known_hosts file, as follows:

   ~]# vi /etc/ssh/ssh_known_hosts
   # A CA key, accepted for any host in *.example.com
   @cert-authority *.example.com ssh-rsa AAAAB5Wm.

   Copy to Clipboard Toggle word wrap

   Where ssh-rsa AAAAB5Wm. is the contents of ca_host_key.pub. The above configures the system to trust the CA servers host public key. This enables global authentication of the certificates presented by hosts to remote users.