Converting SSH Host Keys to Certificates: Using SSH-Keyscan and Ansible
Secure Shell (SSH) is a widely-used protocol for secure remote login from one computer to another. It is a replacement for insecure protocols such as Telnet and uses cryptographic techniques to ensure that the remote sessions are secure.
SSH keys are used to authenticate a user or host. SSH keys are typically generated in pairs - a private key that is kept secret and a public key that is shared with the world. Public keys can be used to encrypt data that can only be decrypted with the corresponding private key.
SSH-Keyscan
ssh-keyscan is a utility that can be used to gather the public key fingerprints of hosts. It works by connecting to the specified host and retrieving its public key fingerprint. The fingerprint can then be used to verify the identity of the host.
ssh-keyscan can be used in a variety of ways. For example, it can be used to gather the public key fingerprints of all the hosts on a network:
ssh-keyscan -t rsa,dsa,ecdsa 192.168.1.* > known_hostsThis command will connect to all the hosts on the 192.168.1.0/24 network and retrieve their public key fingerprints. The fingerprints will be saved in the known_hosts file.
SSH Certificates
SSH certificates are a way to sign and verify the identity of hosts. They are similar to SSL/TLS certificates and can be used to authenticate hosts in a scalable and automated way. SSH certificates are created using a certificate authority (CA) and can be used to sign other host keys.
SSH certificates can be used to simplify the management of SSH keys. For example, instead of manually adding each host's public key to the known_hosts file, a CA can be used to sign the host's public key and distribute the certificate to all the hosts that need to connect to it. This can greatly simplify the management of SSH keys in large environments.
Using SSH-Keyscan and Ansible to Convert SSH Host Keys to Certificates
The following is an example of how to use ssh-keyscan and Ansible to convert SSH host keys to certificates. In this example, we will use Ansible to connect to each host, retrieve its public key fingerprint using ssh-keyscan, and then use OpenSSL to sign the public key and create a certificate.
First, we need to create a playbook that will connect to each host and retrieve its public key fingerprint:
---
- hosts: all
gather_facts: no
tasks:
- name: Retrieve public key fingerprint
command: ssh-keyscan {{ inventory_hostname }}
register: keyscan_output
- name: Save public key fingerprint to file
copy:
content: "{{ keyscan_output.stdout }}"
dest: /tmp/{{ inventory_hostname }}.pub"
This playbook will connect to each host specified in the inventory file and retrieve its public key fingerprint using ssh-keyscan. The public key fingerprint will then be saved to a file in the /tmp directory.
Next, we need to create a playbook that will use OpenSSL to sign the public keys and create certificates:
---
- hosts: all
gather_facts: no
tasks:
- name: Sign public key with CA
command: openssl req -x509 -new -nodes -days 365 -key ca.key -out ca.crt -in /tmp/{{ inventory\_hostname }}.pub
args:
creates: /tmp/{{ inventory\_hostname }}.cert
This playbook will use OpenSSL to sign the public key with a CA and create a certificate. The certificate will be saved to a file in the /tmp directory.
SSH keys are an important part of securing remote connections. SSH certificates provide a way to sign and verify the identity of hosts in a scalable and automated way. By using ssh-keyscan and Ansible, it is possible to convert SSH host keys to certificates and simplify the management of SSH keys in large environments.