Introduce SSH cert support #867

adamlazik1 · 2025-06-26T08:32:52Z

No description provided.

adamlazik1 · 2025-06-26T08:33:20Z

Depends on: theforeman/smart_proxy_remote_execution_ssh#126

adamlazik1 · 2025-07-11T07:14:52Z

This is now ready for review.

adamlazik1 · 2025-07-11T07:11:06Z

manifests/plugin/ansible.pp

+  }
+  $known_hosts_file_option = $foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key ? {
+    undef   => '',
+    default => "-o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_identity_dir}/known_hosts -o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file}",


Same issue as in remote execution. If we have host CA cert available, should we enforce StrictHostKeyChecking?

evgeni · 2025-07-14T12:42:18Z

/packit build

evgeni · 2025-07-14T12:57:22Z

@adamlazik1 could you rebase this please on latest master, so that Packit starts working?

packit-as-a-service · 2025-07-14T12:58:56Z

No config file for packit (e.g. .packit.yaml) found in theforeman/puppet-foreman_proxy on commit 18db7e9

For more info, please check out the documentation or contact the Packit team. You can also use our CLI command config validate or our pre-commit hooks for validation of the configuration.

evgeni · 2025-07-14T13:20:11Z

/packit build

adamlazik1 · 2025-07-14T15:07:14Z

Updated ansible ssh args to enforce strict host key checking if host CA is provided.

lhellebr · 2025-07-15T09:21:55Z

/packit build

packit-as-a-service · 2025-07-15T09:22:02Z

Account lhellebr has no write access nor is author of PR!

evgeni · 2025-07-15T09:24:45Z

/packit build

adamlazik1 · 2025-07-21T09:06:16Z

Switching back to draft since the feature got postponed to 3.16

adamlazik1 · 2025-07-21T09:06:03Z

manifests/plugin/remote_execution/script.pp

+# $ssh_identity_file::            Provide an alternative name for the SSH keys
 #
-# $ssh_keygen::         Location of the ssh-keygen binary
+# $ssh_user_ca_public_key_file::  Public key file for the SSH CA certificate


Should we unify with the host CA key behavior and pass the public key contents instead of a path? I would solve issues with permissions.

From security POV, it should be fine since the CA key is public. But how long is it? How long will it eventually be? Maybe the shell won't like a line that long. I think this kind of data shouldn't be passed in the command line. OTOH, if it's consistent with something we already have, it may be the least confusing.
The permission issues themselves can be solved by documentation + help text.

I see, thanks for your input. You have a good point with possible future length, so I will probably leave it as it is.

lhellebr · 2025-10-30T15:12:59Z

/packit build

packit-as-a-service · 2025-10-30T15:13:07Z

Account lhellebr has no write access nor is author of PR!

adamruzicka · 2025-10-30T15:56:07Z

/packit build

ekohl · 2025-10-30T15:56:07Z

/packit build

packit-as-a-service · 2025-10-30T15:58:04Z

Account adamruzicka has no write access nor is author of PR!

adamlazik1 · 2025-10-30T21:44:43Z

/packit build

adamlazik1 · 2025-11-10T14:45:41Z

/packit build

adamlazik1 · 2025-11-11T09:21:46Z

/packit build

lhellebr · 2025-11-19T15:40:41Z

/packit build

packit-as-a-service · 2025-11-19T15:40:51Z

Account lhellebr has no write access nor is author of PR!

adamlazik1 · 2025-11-19T19:03:53Z

/packit build

lhellebr · 2025-11-21T13:36:18Z

templates/plugin/remote_execution_ssh.yml.erb

+<% if ssh_user_ca_public_key_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file') -%>
+:ssh_user_ca_public_key_file: <%= ssh_user_ca_public_key_file %>
+<% end -%>
+<% if ssh_host_ca_public_key = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key') -%>


ssh_host_ca_public_key is never used here?

True, that is a remnant from the previous iteration. However; since it doesn't change the functionality I will not update the PR since with the switch to foremanctl the installer will not be used for SSH certs anyway. The purpose of this PR became to just enable us to verify the rest of the SSH cert feature on current stream deployments.

I think the PR will still be merged before migration to the new installer? I'm planning to verify the feature as o complex of current 4 PRs.

lhellebr · 2025-11-21T13:41:16Z

manifests/plugin/remote_execution/script.pp

+# $ssh_user_ca_public_key_file::  Public key file for the SSH CA certificate
 #
-# $ssh_kerberos_auth::  Enable kerberos authentication for SSH
+# $ssh_host_ca_public_key::       Trusted host CA public key


Why the inconsistency? We take the foreman CA public key as file path but the host CA public key as its content from command line. I think it's suboptimal, how long is the key, how long may it be in the future?

Additional editing is needed when registering host CA pubkey (@host-certificate ...). While the actual user CA pubkey file is expected to be present on the capsule as it is distributed to new hosts, this is not the case for host CA pubkey file. We only require the contents.

Of course, arguments could be made that similarly we could pass contents of the user CA pubkey as installer is able to create its own file, ensuring the correct permissions. I can take this point into consideration when implementing this in foremanctl.

I think the best solution is to take path in both cases and in cases of host CA, just get the key from the file and put it in the config file.

lhellebr

I have been able to verify the SSH CA cert feature as a complex of the following 4 PRs:
theforeman/smart_proxy_remote_execution_ssh#126
theforeman/foreman#10571
theforeman/foreman_remote_execution#977
#867

Including the following use cases:
SSH REX
Ansible REX
Pull mode REX
Cockpit

Including hosts created by:
Global registration
Provisioning

Including scenarios:
SSH CA on Satellite side
SSH CA on host side
SSH CA on both sides

Both positive scenarios and negative scenarios, that is incorrect CA, incorrect cert, incorrect principal.

=> ACK to this PR

pr-processor bot added the Not yet reviewed label Jun 26, 2025

adamlazik1 force-pushed the ssh-cert-support branch 5 times, most recently from 702e256 to 18db7e9 Compare July 11, 2025 07:12

adamlazik1 marked this pull request as ready for review July 11, 2025 07:14

adamlazik1 commented Jul 11, 2025

View reviewed changes

pr-processor bot removed the Not yet reviewed label Jul 11, 2025

adamlazik1 force-pushed the ssh-cert-support branch from 18db7e9 to 3759635 Compare July 14, 2025 13:18

adamlazik1 force-pushed the ssh-cert-support branch 2 times, most recently from f6c78c1 to 5e673ed Compare July 14, 2025 15:05

adamlazik1 force-pushed the ssh-cert-support branch from 5e673ed to 3bdd6b6 Compare July 17, 2025 09:39

adamlazik1 marked this pull request as draft July 21, 2025 09:06

adamlazik1 commented Jul 21, 2025

View reviewed changes

adamlazik1 force-pushed the ssh-cert-support branch from 3bdd6b6 to a9906b3 Compare October 22, 2025 11:52

adamlazik1 force-pushed the ssh-cert-support branch from a9906b3 to 97c756e Compare November 10, 2025 14:41

Introduce SSH cert support

60cd6a8

adamlazik1 force-pushed the ssh-cert-support branch from 97c756e to 60cd6a8 Compare November 11, 2025 09:09

lhellebr reviewed Nov 21, 2025

View reviewed changes

lhellebr approved these changes Dec 3, 2025

View reviewed changes

Introduce SSH cert support #867

Are you sure you want to change the base?

Introduce SSH cert support #867

Uh oh!

Conversation

adamlazik1 commented Jun 26, 2025

Uh oh!

adamlazik1 commented Jun 26, 2025

Uh oh!

adamlazik1 commented Jul 11, 2025

Uh oh!

adamlazik1 Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Jul 14, 2025

Uh oh!

evgeni commented Jul 14, 2025

Uh oh!

packit-as-a-service bot commented Jul 14, 2025

Uh oh!

evgeni commented Jul 14, 2025

Uh oh!

adamlazik1 commented Jul 14, 2025

Uh oh!

lhellebr commented Jul 15, 2025

Uh oh!

packit-as-a-service bot commented Jul 15, 2025

Uh oh!

evgeni commented Jul 15, 2025

Uh oh!

adamlazik1 commented Jul 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lhellebr commented Oct 30, 2025

Uh oh!

packit-as-a-service bot commented Oct 30, 2025

Uh oh!

adamruzicka commented Oct 30, 2025

Uh oh!

ekohl commented Oct 30, 2025

Uh oh!

packit-as-a-service bot commented Oct 30, 2025

Uh oh!

adamlazik1 commented Oct 30, 2025

Uh oh!

adamlazik1 commented Nov 10, 2025

Uh oh!

adamlazik1 commented Nov 11, 2025

Uh oh!

lhellebr commented Nov 19, 2025

Uh oh!

packit-as-a-service bot commented Nov 19, 2025

Uh oh!

adamlazik1 commented Nov 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lhellebr left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

adamlazik1 Jul 11, 2025 •

edited

Loading