Add public key pinning in authorized-keys command #132
Conversation
| @@ -1,6 +1,6 @@ | |||
| #!/bin/sh | |||
|
|
|||
| user="$(id -u "$1")" | |||
| curl -s "{{ userdb_apidomain }}/v1/ssh_public_key?uid=eq.$user&select=type,key" \ | |||
| curl --pinnedpubkey "QUfPGxRcqlRoehidvMEsF/R1Ee1MXkb3Sxw+MNTARdY=" -s "{{ userdb_apidomain }}/v1/ssh_public_key?uid=eq.$user&select=type,key" \ | |||
There was a problem hiding this comment.
what is this pinned to? our private key or letsencrypt?
the former seems dangerous: we don't really have backups and consider it ephemeral
the latter seems dangerous: if shit happens we might want to use something else
There was a problem hiding this comment.
It is the public key from the certificate which corresponds to your private key. It was retrieved with this command: openssl s_client -servername userdb.hashbang.sh -connect userdb.hashbang.sh:443 | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
There was a problem hiding this comment.
we don't have backups and consider it ephemeral
There was a problem hiding this comment.
Maybe that should be reconsidered.
This adds pubkey pinning so we don't need to trust the whole slew of CAs that come by default.
You probably want to: