c62b187559
Map SSH certificate principal agt-custodian to a dedicated custodian-agt account on Railiance01 only, converged by ssh_ca_host (tag restricted_agent_account): locked password, home 0700, no supplementary groups, no sudoers entry, no authorized_keys, and an sshd Match drop-in (05-restricted-agents.conf) with publickey only and all forwarding, tunnel and user RC off. A separate goss spec asserts the posture, including that the account cannot read the k3s kubeconfig and the sshd -T effective config. Offline tests (optional real-sshd container check). Existing tegwick mappings unchanged; their retirement is RAIL-HO-WP-0014-T03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
24 lines
828 B
YAML
24 lines
828 B
YAML
---
|
|
# Deploy OpenBao SSH user CA trust and per-user auth_principals.
|
|
#
|
|
# Prerequisite: railiance-platform openbao-configure-ssh (exports CA pubkey).
|
|
#
|
|
# cd ~/railiance-platform
|
|
# OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token \
|
|
# OPENBAO_SSH_CA_PUBKEY_OUT=/tmp/openbao-ssh-ca.pub \
|
|
# make openbao-configure-ssh
|
|
#
|
|
# cd ~/railiance-infra
|
|
# make bootstrap-ssh-ca SSH_CA_PUBKEY=/tmp/openbao-ssh-ca.pub
|
|
#
|
|
# Restricted agent accounts only (RAIL-HO-WP-0014; no CA key needed):
|
|
# cd ansible && ansible-playbook playbooks/bootstrap-ssh-ca.yaml \
|
|
# --limit Railiance01 --tags restricted_agent_account --check --diff
|
|
|
|
- name: Deploy SSH CA trust, auth_principals and restricted agent accounts
|
|
hosts: all
|
|
become: true
|
|
vars_files:
|
|
- ../inventory/ssh_principals.yaml
|
|
roles:
|
|
- role: ssh_ca_host
|