diff options
Diffstat (limited to 'config/ssh')
| -rw-r--r-- | config/ssh/entry | 12 | ||||
| -rw-r--r-- | config/ssh/yubikey-git/config | 25 | ||||
| -rw-r--r-- | config/ssh/yubikey-git/id_ed25519_sk_git | 9 | ||||
| -rw-r--r-- | config/ssh/yubikey-git/id_ed25519_sk_git.pub | 1 | ||||
| -rw-r--r-- | config/ssh/yubikey-git/known_hosts | 1 |
5 files changed, 44 insertions, 4 deletions
diff --git a/config/ssh/entry b/config/ssh/entry index e1b6994..a8cdf2b 100644 --- a/config/ssh/entry +++ b/config/ssh/entry @@ -7,15 +7,19 @@ # a set of machines. First, so host-key pinning # there cannot be undone by anything read after # it. -# 2. ~/.config/ssh/config-local This host only; not in any repo, never +# 2. ~/.config/ssh/enabled.d/ Configs from this repo that a host opted in +# to, as links: bin/yubikey-git enable puts +# one here. +# 3. ~/.config/ssh/config-local This host only; not in any repo, never # synced. See config/ssh/config-local-example. -# 3. Shared defaults, below Last, so either of the above can override them. +# 4. Shared defaults, below Last, so any of the above can override them. # -# Both includes are optional: ssh skips an Include that matches no file, so on a -# machine with neither this file configures nothing at all. No key is named +# Every include is optional: ssh skips an Include that matches no file, so on a +# machine with none of them this file configures nothing at all. No key is named # anywhere; ssh's default ~/.ssh/id_ed25519 is whatever that machine installs. Include ~/.config/ssh/config-fleet +Include ~/.config/ssh/enabled.d/*.conf Include ~/.config/ssh/config-local # Shared defaults for every host go here, under `Host *`. There are none yet. diff --git a/config/ssh/yubikey-git/config b/config/ssh/yubikey-git/config new file mode 100644 index 0000000..a878c92 --- /dev/null +++ b/config/ssh/yubikey-git/config @@ -0,0 +1,25 @@ +# git over ssh to git.soarez.net with the YubiKey git key: git clone +# git@git.soarez.net:sz/<name>.git, one touch of the key per fetch or push. +# +# Read only on a host that opted in: `yubikey-git enable` links this file into +# ~/.config/ssh/enabled.d/, which config/ssh/entry includes. See bin/yubikey-git. +# +# The key is id_ed25519_sk_git beside this file, a FIDO2 key whose private half +# never leaves the YubiKey. The file is only its handle: useless without the +# YubiKey, and the YubiKey signs nothing without a touch. git.soarez.net accepts +# it for git on the repositories and nothing else. + +Host git.soarez.net + User git + IdentityFile ~/.ssh/id_ed25519_sk_git + IdentitiesOnly yes + # Pinned, not learned: on a machine we do not trust, the first connection is + # exactly the one an attacker would intercept. + HostKeyAlias git.soarez.net + StrictHostKeyChecking yes + UserKnownHostsFile ~/.config/ssh/yubikey-git/known_hosts + # Never share a connection: a master left open would let anything on this + # machine fetch or push without a touch. + ControlMaster no + ControlPath none + ForwardAgent no diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git b/config/ssh/yubikey-git/id_ed25519_sk_git new file mode 100644 index 0000000..1dfc9cb --- /dev/null +++ b/config/ssh/yubikey-git/id_ed25519_sk_git @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 +gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACCwffHChtXGxpXW4ot5J5QgCuVzZQish4mCeejc +CV7CmgAAAARzc2g6AAAA8NofV7LaH1eyAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 +9tAAAAILB98cKG1cbGldbii3knlCAK5XNlCKyHiYJ56NwJXsKaAAAABHNzaDoBAAAAgLrY +C5HJdImLKhBgt4VkfTVjThXtUYWSCSrSJlO0o+ljm07iqPzc60Z8A8lKVrmw4lUd0wMjv0 +R25REIhhh+A+whxQK4mVl2mLDZk1qt0OoO0tEVR7TKydUaBR/Mk1nZHAb++a7WB/oFZGd6 +N+WSsiUNg0xtorBq/Od79olI/0RyAAAAAAAAABB5dWJpa2V5LTEyNTk1NTk5AQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git.pub b/config/ssh/yubikey-git/id_ed25519_sk_git.pub new file mode 100644 index 0000000..be46ed8 --- /dev/null +++ b/config/ssh/yubikey-git/id_ed25519_sk_git.pub @@ -0,0 +1 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILB98cKG1cbGldbii3knlCAK5XNlCKyHiYJ56NwJXsKaAAAABHNzaDo= yubikey-12595599 diff --git a/config/ssh/yubikey-git/known_hosts b/config/ssh/yubikey-git/known_hosts new file mode 100644 index 0000000..0f62b4b --- /dev/null +++ b/config/ssh/yubikey-git/known_hosts @@ -0,0 +1 @@ +git.soarez.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJCkJM1OCp6YZeNJ4iVBhU66aLAXJTKerkbDzSmVVkvJ |