Add public key pinning in authorized-keys command #132
Conversation
|
|
||
| user="$(id -u "$1")" | ||
| curl -s "{{ userdb_apidomain }}/v1/ssh_public_key?uid=eq.$user&select=type,key" \ | ||
| curl --pinnedpubkey "QUfPGxRcqlRoehidvMEsF/R1Ee1MXkb3Sxw+MNTARdY=" -s "{{ userdb_apidomain }}/v1/ssh_public_key?uid=eq.$user&select=type,key" \ |
There was a problem hiding this comment.
what is this pinned to? our private key or letsencrypt?
the former seems dangerous: we don't really have backups and consider it ephemeral
the latter seems dangerous: if shit happens we might want to use something else
There was a problem hiding this comment.
It is the public key from the certificate which corresponds to your private key. It was retrieved with this command: openssl s_client -servername userdb.hashbang.sh -connect userdb.hashbang.sh:443 | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
There was a problem hiding this comment.
we don't have backups and consider it ephemeral
There was a problem hiding this comment.
Maybe that should be reconsidered.
2 participants
This adds pubkey pinning so we don't need to trust the whole slew of CAs that come by default.
You probably want to: