You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
49 lines
1.3 KiB
49 lines
1.3 KiB
#/bin/sh
|
|
|
|
set -xe
|
|
|
|
rm -f ca_key ca_key.pub
|
|
rm -f user_key user_key.pub
|
|
rm -f *.cert
|
|
|
|
ssh-keygen -q -f ca_key -t ed25519 -C CA -N ''
|
|
ssh-keygen -q -f user_key -t ed25519 -C "user key" -N ''
|
|
|
|
sign() {
|
|
output=$1
|
|
shift
|
|
set -xe
|
|
ssh-keygen -q -s ca_key -I user -n user \
|
|
-V 19990101:19991231 -z 1 "$@" user_key.pub
|
|
mv user_key-cert.pub "$output"
|
|
}
|
|
|
|
sign all_permit.cert -Opermit-agent-forwarding -Opermit-port-forwarding \
|
|
-Opermit-pty -Opermit-user-rc -Opermit-X11-forwarding
|
|
sign no_permit.cert -Oclear
|
|
|
|
sign no_agentfwd.cert -Ono-agent-forwarding
|
|
sign no_portfwd.cert -Ono-port-forwarding
|
|
sign no_pty.cert -Ono-pty
|
|
sign no_user_rc.cert -Ono-user-rc
|
|
sign no_x11fwd.cert -Ono-X11-forwarding
|
|
|
|
sign only_agentfwd.cert -Oclear -Opermit-agent-forwarding
|
|
sign only_portfwd.cert -Oclear -Opermit-port-forwarding
|
|
sign only_pty.cert -Oclear -Opermit-pty
|
|
sign only_user_rc.cert -Oclear -Opermit-user-rc
|
|
sign only_x11fwd.cert -Oclear -Opermit-X11-forwarding
|
|
|
|
sign force_command.cert -Oforce-command="foo"
|
|
sign sourceaddr.cert -Osource-address="127.0.0.1/32,::1/128"
|
|
|
|
# ssh-keygen won't permit generation of certs with invalid source-address
|
|
# values, so we do it as a custom extension.
|
|
sign bad_sourceaddr.cert -Ocritical:source-address=xxxxx
|
|
|
|
sign unknown_critical.cert -Ocritical:blah=foo
|
|
|
|
sign host.cert -h
|
|
|
|
rm -f user_key ca_key user_key.pub ca_key.pub
|