Robert Abraham roa

SSH CA use-case with Vault

In this scenario we are going to set up Vault to sign SSH keys using an internal CA. We will configure the SSH secrets engine and create a CA within Vault. We will then configure an SSH server to trust the CA key we just created. Finally we will attempt to SSH using a private key, and a public key signed by Vault SSH CA.

Prerequisites

This guide assumes you have already provisioned a Vault server, SSH host using OpenSSH server, and a SSH client machine.
The client system must be able to reach the Vault server and the OpenSSH server.
We will refer to these systems respectively as:
VAULT_SERVER

You might want to read this to get an introduction to armel vs armhf.

If the below is too much, you can try Ubuntu-ARMv7-Qemu but note it contains non-free blobs.

Running ARM programs under linux (without starting QEMU VM!)

First, cross-compile user programs with GCC-ARM toolchain. Then install qemu-arm-static so that you can run ARM executables directly on linux

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Button Stress Test</title>
	<style>
	body {
	display: flex;
	flex-wrap: wrap;

	use POSIX ":sys_wait_h";
	use Rex -feature => ['exit_status'];


	group "servers", "localhost", "127.0.1.2";


	task test => group => servers => sub {
	my $output = run "hostname";
	say $output;

	#######################
	# Rexfile
	#######################

	task "test", sub {

	my @arr = ("one", "two", "three");

	my %hash = (
	name => "foo",

	[15282] 11 Mar 10:58:23.464 # +sdown master mymaster1 192.168.122.130 6379
	[15282] 11 Mar 10:58:23.464 # +odown master mymaster1 192.168.122.130 6379 #quorum 1/1
	[15282] 11 Mar 10:58:23.464 # +new-epoch 1
	[15282] 11 Mar 10:58:23.464 # +try-failover master mymaster1 192.168.122.130 6379
	[15282] 11 Mar 10:58:23.464 # +vote-for-leader a7490db13657362f3cb223596a25e40252972279 1
	[15282] 11 Mar 10:58:23.464 # +elected-leader master mymaster1 192.168.122.130 6379
	[15282] 11 Mar 10:58:23.464 # +failover-state-select-slave master mymaster1 192.168.122.130 6379
	[15282] 11 Mar 10:58:23.517 # -failover-abort-no-good-slave master mymaster1 192.168.122.130 6379

	# /etc/bash/bashrc
	#
	# This file is sourced by all interactive bash shells on startup,
	# including some apparently interactive shells such as scp and rcp
	# that can't tolerate any output. So make sure this doesn't display
	# anything or bad things will happen !


	# Test for an interactive shell. There is no need to set anything
	# past this point for scp and rcp, and it's important to refrain from

	XVFB=/usr/bin/Xvfb
	XVFBARGS=":100 -screen 0 1600x1200x24 -auth /etc/conf.d/Xvfb.cfg -nolisten tcp"
	PIDFILE=/var/run/Xvfb.pid

	package main

	import (
	"database/sql"
	"fmt"
	_ "github.com/lib/pq"
	)

	const (
	query1 = `

	#!/usr/bin/perl

	use strict;
	use warnings;

	use Getopt::Long;
	use File::Basename;
	use Template;

	our $PROGNAME = basename($0);