README
¶
ssh-key-agent
Companion service for https://github.com/utilitywarehouse/ssh-key-manager runs
on the host and populates authorized_keys file based on the groups provided.
Required environment variables:
| env var | example | desc |
|---|---|---|
| SKA_KEY_URI | https://[app/bucket]/authmap | URI location of the authmap file create by ssh-key-manager |
| SKA_GROUPS | group@gsuite-domain.com,group2@gsuite-domain.com | Comma seperated list of groups that are allowed access |
| SKA_AKF_LOC | /home/user/.ssh/authorized_keys | Location of the authorized_keys file which to write to |
| SKA_INTERVAL | 60 | Interval, how often the keys should be synced (seconds) AWS access key |
systemd service file
Example systemd service: ./terraform/resources/ssh-key-agent.service
Terraform module
Repository includes a terraform module, for use instructions have a look at ./terraform/README.md
Releasing
Before creating a tag/release in Github, please update the verion in ./terraform/variables.tf
Docker instructions
If you prefer to run ssh-key-agent with docker, here's an example service:
[Unit]
Description=ssh-key-agent
After=docker.service
Requires=docker.service
[Service]
Restart=on-failure
ExecStartPre=-/usr/bin/mkdir -p /home/core/.ssh
ExecStartPre=-/usr/bin/touch /home/core/.ssh/authorized_keys
ExecStartPre=-/usr/bin/chown -R "core":"core" /home/core/.ssh
ExecStartPre=-/usr/bin/chmod 700 /home/core/.ssh
ExecStartPre=-/usr/bin/chmod 644 /home/core/.ssh/authorized_keys
ExecStart=/bin/sh -c 'docker run --name=%p_$(uuidgen) --rm \
-v /home/core/.ssh/authorized_keys:/authorized_keys \
-e SKA_KEY_URI=${uri} \
-e SKA_GROUPS=${groups} \
-e SKA_AKF_LOC=/authorized_keys \
-e SKA_INTERVAL=60 \
quay.io/utilitywarehouse/ssh-key-agent:${version}'
ExecStop=/bin/sh -c 'docker stop -t 3 "$(docker ps -q --filter=name=%p_)"'
[Install]
WantedBy=multi-user.target
Whatever file you are mounting into container needs to exist prior, otherwise docker will create it as directory:
If you use -v or --volume to bind-mount a file or directory that does not yet exist on the Docker host, -v will create the endpoint for you. It is always created as a directory.
Debugging boxes where SKA is not successful
Either ssh-key-agent could not start or node has no internet access, you will need to load a static key to log on. Example ignition file:
data "ignition_file" "authorized_keys" {
filesystem = "root"
path = "/home/core/.ssh/authorized_keys"
mode = 493
content {
content = <<-EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5OOYqgvQMxnDnSQtMNNLl9JtIx1cdVXoiQ3+GXP0oZ gangel@uw.co.uk
EOF
}
}
Documentation
¶
There is no documentation for this package.
Source Files