c62b187559
Map SSH certificate principal agt-custodian to a dedicated custodian-agt account on Railiance01 only, converged by ssh_ca_host (tag restricted_agent_account): locked password, home 0700, no supplementary groups, no sudoers entry, no authorized_keys, and an sshd Match drop-in (05-restricted-agents.conf) with publickey only and all forwarding, tunnel and user RC off. A separate goss spec asserts the posture, including that the account cannot read the k3s kubeconfig and the sshd -T effective config. Offline tests (optional real-sshd container check). Existing tegwick mappings unchanged; their retirement is RAIL-HO-WP-0014-T03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
12 lines
653 B
Django/Jinja
12 lines
653 B
Django/Jinja
# Managed by railiance-infra ssh_ca_host (CUST-WP-0073-T02, RAIL-HO-WP-0014).
|
|
# Restricted agent accounts: SSH certificate (AuthorizedPrincipalsFile) only,
|
|
# no authorized_keys, no forwarding, no tunnel, no user RC.
|
|
# This file sorts before 10-hardening.conf so that, under sshd's
|
|
# first-obtained-value rule, these values win for the matched users. A Match
|
|
# block in an Include'd file ends at the end of that file (OpenSSH >= 8.2).
|
|
{% for account in ssh_ca_host_restricted_accounts %}
|
|
Match User {{ account }}
|
|
{% for option in ssh_ca_host_restricted_agent_sshd_options | dict2items %}
|
|
{{ option.key }} {{ option.value }}
|
|
{% endfor %}
|
|
{% endfor %}
|