...
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
### Host certificate HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub |
...
Add the following lines to the file /etc/ssh/sshd_config to tell the SSH daemon about the public key to verifiy client certificates. In addition copy the public key to the specified location. The host trusts all certifactes the are signed by our CA.
| Code Block | linenumbers | true
|---|
### User CA certificate TrustedUserCAKeys /etc/ssh/yubikeyX.pub |
...
Now, we'll configure one of our hosts to accept only certain principals. To do so, add this line to /etc/ssh/sshd_config
| Code Block | linenumbers | true
|---|
### Auth Principals AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u |
Then we need to populate the principals file:
| Code Block | linenumbers | true
|---|
mkdir /etc/ssh/auth_principals echo -e 'host.netdef.org\nroot-everywhere' > /etc/ssh/auth_principals/root |
...