diff --git a/infrastructure-guide/home.md b/infrastructure-guide/home.md index 41b7256b..57adbd20 100644 --- a/infrastructure-guide/home.md +++ b/infrastructure-guide/home.md @@ -59,6 +59,11 @@ Access to the redhat.com knowledge base: # SSH Certificates / Signing Public User Keys +Generate a ssh key e.g. as follows: +```bash +ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/linux_id_ed25519 +``` + Use the [user ca certificate](https://git.psi.ch/linux-infra/core-linux-secrets/-/blob/main/ssh-ca/user-ca.gpg), but this is automated by pasting below function into your shell ```bash function sign-user-ssh-key { @@ -70,7 +75,8 @@ function sign-user-ssh-key { # so it never ends up on the file system umask 077 - pipe="$(mktemp --dry-run)" + pipe_base="$(mktemp)" # MacOS does not know about --dry-run + pipe="${pipe_base}.pipe" echo "mkfifo '$pipe'" mkfifo "$pipe" || return 1 [ -p "$pipe" ] || return 1 @@ -78,8 +84,8 @@ function sign-user-ssh-key { pass ssh-ca/user-ca > "$pipe" & echo "ssh-keygen -s '$pipe' -I '$name' -n '$name' -V +55w '$pubkey'" ssh-keygen -s "$pipe" -I "$name" -n "$name" -V +55w "$pubkey" - echo "rm '$pipe'" - rm "$pipe" + echo "rm '$pipe' '$pipe_base'" + rm "$pipe" "$pipe_base" ) } ```