Tls_self_signed_cert - how to output in the correct format for /etc/ssh/ssh_known_hosts

queglay · October 31, 2020, 1:09pm

I’m wondering how to take the output of this resource and add it to /etc/ssh/ssh_known_hosts, and also ensure the format is compatible for TrustedUserCAKeys in /etc/ssh/sshd_config

Using an output var like tls_locally_signed_cert.my_cert.cert_pem this produces a multiline format certificate unsuitable to add to /etc/ssh/ssh_known_hosts with @cert-authority

If you have any pointers I’d much appreciate it!

agowa338 · November 1, 2020, 12:07am

I generate it this way:

github.com

agowa338/openstack-k8s/blob/master/95-create-ssh-known_hosts.tf

resource "null_resource" "ssh-known_hosts" {

  depends_on = [
    openstack_compute_instance_v2.k8s-master,
    openstack_compute_instance_v2.k8s-worker,
    openstack_networking_port_v2.k8s-master-port,
    openstack_networking_port_v2.k8s-worker-port,
    openstack_networking_subnet_v2.subnet_k8s
  ]

  # Clear known_hosts file
  provisioner "local-exec" {
    command = "echo \"\" > known_hosts"
  }

  # Master nodes
  provisioner "local-exec" {
    command = "echo -ne \"${join("\n",formatlist("%s,%s", openstack_compute_instance_v2.k8s-master.*.network.0.fixed_ip_v6, openstack_compute_instance_v2.k8s-master.*.name))}\" | tr \"\\n\" \"\\0\" | xargs -0 -n1 -I % sh -c \"echo % | sed -nEe 's_[][]__gm;s_(.*),(.*)_echo \\1 \\$\\(openstack console log show \\2 \\| grep ecdsa-sha2-nistp256)_ep' \" >> known_hosts"
  }

This file has been truncated. show original

A better way and what I may do (once the metadata agent support ipv6 only nodes) is to push the public key to a metadata value and fetch it using terraform when writing the known_hosts file.

queglay · November 1, 2020, 12:25am

I’ve just realised that this whole process is for TLS/HTTPS and not SSH Certificates, which explains why the format is wrong, So I was getting mixed up with two different incompatible processes.

apparentlymart · November 5, 2020, 10:31pm

Hi @queglay,

It’s true that the tls provider is primarily for dealing with TLS-related concerns, although it does already have one small adaptation to allow using it with OpenSSH’s cryptography: the tls_private_key resource type has a public_key_openssh. That represents the same data as public_key_pem, but it’s formatted in the shape OpenSSH expects to see in .ssh/authorized_keys.

I’m not super familiar with OpenSSH’s certificate-based authentication, but if it has a similar characteristic of just being a non-standard serialization of the same underlying data structures that TLS uses then in principle resources like tls_self_signed_cert could also produce the OpenSSH syntax alongside the PEM syntax.

I’m not certain of how much work that would take or what exactly it would look like, but if it sounds promising and you have the time/motivation to help with some design and/or implementation work for it then we could get that discussion started in a feature request issue in the hashicorp/tls provider repository.

queglay · November 6, 2020, 10:40am

Oh that is pretty cool! Thanks for revealing that ability for the public key at least… Upon thinking about it further, if I can’t do something like encrypt it with a kms key in the state file, I probably should do it outside of terraform… or is that also possible?