e415da97f3
Without allowed_extensions, OpenBao refuses warden's explicit
extensions={permit-pty} request for the supervised agent profile.
Applied later through scripts/openbao-apply-ssh-engine.sh (attended).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
32 lines
No EOL
775 B
YAML
32 lines
No EOL
775 B
YAML
# Declarative SSH CA roles for ops-warden ActorType policy.
|
|
# TTL max: adm 48h, agt 24h, atm 8h — wiki/OpsWardenConfig.md (ops-warden)
|
|
|
|
mount: ssh
|
|
|
|
roles:
|
|
adm-role:
|
|
key_type: ca
|
|
allowed_users: "*"
|
|
allow_user_certificates: true
|
|
allow_user_key_ids: true
|
|
default_user: adm
|
|
ttl: 48h
|
|
max_ttl: 48h
|
|
agt-role:
|
|
key_type: ca
|
|
allowed_users: "*"
|
|
allow_user_certificates: true
|
|
allow_user_key_ids: true
|
|
default_user: agt
|
|
# CUST-WP-0073 / WARDEN-WP-0045: agt-custodian requests permit-pty explicitly.
|
|
allowed_extensions: "permit-pty"
|
|
ttl: 24h
|
|
max_ttl: 24h
|
|
atm-role:
|
|
key_type: ca
|
|
allowed_users: "*"
|
|
allow_user_certificates: true
|
|
allow_user_key_ids: true
|
|
default_user: atm
|
|
ttl: 8h
|
|
max_ttl: 8h |