certificates/pki/templates.go

129 lines
4.1 KiB
Go
Raw Permalink Normal View History

2019-10-11 19:49:09 +00:00
package pki
import (
"os"
"path/filepath"
"github.com/pkg/errors"
"github.com/smallstep/certificates/templates"
2019-10-12 01:59:50 +00:00
"github.com/smallstep/cli/config"
2019-10-11 19:49:09 +00:00
"github.com/smallstep/cli/errs"
2019-10-12 01:59:50 +00:00
"github.com/smallstep/cli/utils"
2019-10-11 19:49:09 +00:00
)
2019-11-05 02:30:03 +00:00
// SSHTemplates contains the configuration of default templates used on ssh.
2019-10-12 01:59:50 +00:00
// Relative paths are relative to the StepPath.
2019-11-05 02:30:03 +00:00
var SSHTemplates = &templates.SSHTemplates{
2019-10-11 19:49:09 +00:00
User: []templates.Template{
2019-10-12 01:59:50 +00:00
{Name: "include.tpl", Type: templates.Snippet, TemplatePath: "templates/ssh/include.tpl", Path: "~/.ssh/config", Comment: "#"},
{Name: "config.tpl", Type: templates.File, TemplatePath: "templates/ssh/config.tpl", Path: "ssh/config", Comment: "#"},
{Name: "known_hosts.tpl", Type: templates.File, TemplatePath: "templates/ssh/known_hosts.tpl", Path: "ssh/known_hosts", Comment: "#"},
2019-10-11 19:49:09 +00:00
},
Host: []templates.Template{
2019-10-12 01:59:50 +00:00
{Name: "sshd_config.tpl", Type: templates.Snippet, TemplatePath: "templates/ssh/sshd_config.tpl", Path: "/etc/ssh/sshd_config", Comment: "#"},
{Name: "ca.tpl", Type: templates.Snippet, TemplatePath: "templates/ssh/ca.tpl", Path: "/etc/ssh/ca.pub", Comment: "#"},
2019-10-11 19:49:09 +00:00
},
}
2019-11-05 02:30:03 +00:00
// SSHTemplateData contains the data of the default templates used on ssh.
var SSHTemplateData = map[string]string{
2019-11-26 03:59:53 +00:00
// include.tpl adds the step ssh config file.
//
// Note: on windows `Include C:\...` is treated as a relative path.
2019-10-11 19:49:09 +00:00
"include.tpl": `Host *
2019-11-27 02:47:10 +00:00
{{- if or .User.GOOS "none" | eq "windows" }}
2019-11-26 03:59:53 +00:00
Include {{ .User.StepPath | replace "\\" "/" | trimPrefix "C:" }}/ssh/config
{{- else }}
Include {{.User.StepPath}}/ssh/config
{{- end }}`,
2019-10-11 19:49:09 +00:00
2019-11-26 03:59:53 +00:00
// config.tpl is the step ssh config file, it includes the Match rule and
// references the step known_hosts file.
//
// Note: on windows ProxyCommand requires the full path
2019-10-11 19:49:09 +00:00
"config.tpl": `Match exec "step ssh check-host %h"
ForwardAgent yes
2019-11-26 03:59:53 +00:00
{{- if .User.User }}
User {{.User.User}}
2019-11-26 03:59:53 +00:00
{{- end }}
2019-11-27 02:47:10 +00:00
{{- if or .User.GOOS "none" | eq "windows" }}
2019-11-26 03:59:53 +00:00
UserKnownHostsFile {{.User.StepPath}}\ssh\known_hosts
ProxyCommand C:\Windows\System32\cmd.exe /c step ssh proxycommand %r %h %p
{{- else }}
UserKnownHostsFile {{.User.StepPath}}/ssh/known_hosts
2019-11-26 03:59:53 +00:00
ProxyCommand step ssh proxycommand %r %h %p
{{- end }}
`,
2019-10-11 19:49:09 +00:00
2019-10-12 01:59:50 +00:00
// known_hosts.tpl authorizes the ssh hosts key
2019-10-12 02:26:59 +00:00
"known_hosts.tpl": `@cert-authority * {{.Step.SSH.HostKey.Type}} {{.Step.SSH.HostKey.Marshal | toString | b64enc}}
{{- range .Step.SSH.HostFederatedKeys}}
@cert-authority * {{.Type}} {{.Marshal | toString | b64enc}}
2019-11-26 03:59:53 +00:00
{{- end }}
`,
2019-10-11 19:49:09 +00:00
// sshd_config.tpl adds the configuration to support certificates
"sshd_config.tpl": `TrustedUserCAKeys /etc/ssh/ca.pub
HostCertificate /etc/ssh/{{.User.Certificate}}
HostKey /etc/ssh/{{.User.Key}}`,
// ca.tpl contains the public key used to authorized clients
2019-10-12 02:26:59 +00:00
"ca.tpl": `{{.Step.SSH.UserKey.Type}} {{.Step.SSH.UserKey.Marshal | toString | b64enc}}
{{- range .Step.SSH.UserFederatedKeys}}
{{.Type}} {{.Marshal | toString | b64enc}}
2019-11-26 03:59:53 +00:00
{{- end }}
`,
2019-10-11 19:49:09 +00:00
}
// getTemplates returns all the templates enabled
func (p *PKI) getTemplates() *templates.Templates {
if !p.enableSSH {
return nil
}
return &templates.Templates{
2019-11-05 02:30:03 +00:00
SSH: SSHTemplates,
2019-10-11 19:49:09 +00:00
Data: map[string]interface{}{},
}
}
// generateTemplates generates given templates.
func generateTemplates(t *templates.Templates) error {
if t == nil {
return nil
}
base := GetTemplatesPath()
// Generate SSH templates
if t.SSH != nil {
// all ssh templates are under ssh:
sshDir := filepath.Join(base, "ssh")
if _, err := os.Stat(sshDir); os.IsNotExist(err) {
if err = os.MkdirAll(sshDir, 0700); err != nil {
return errs.FileError(err, sshDir)
}
}
// Create all templates
for _, t := range t.SSH.User {
2019-11-05 02:30:03 +00:00
data, ok := SSHTemplateData[t.Name]
2019-10-11 19:49:09 +00:00
if !ok {
return errors.Errorf("template %s does not exists", t.Name)
}
2019-10-12 01:59:50 +00:00
if err := utils.WriteFile(config.StepAbs(t.TemplatePath), []byte(data), 0644); err != nil {
2019-10-11 19:49:09 +00:00
return err
}
}
for _, t := range t.SSH.Host {
2019-11-05 02:30:03 +00:00
data, ok := SSHTemplateData[t.Name]
2019-10-11 19:49:09 +00:00
if !ok {
return errors.Errorf("template %s does not exists", t.Name)
}
2019-10-12 01:59:50 +00:00
if err := utils.WriteFile(config.StepAbs(t.TemplatePath), []byte(data), 0644); err != nil {
2019-10-11 19:49:09 +00:00
return err
}
}
}
return nil
}