From 8eb8240822d30fa7db019e84069a9b608148ebc7 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Thu, 13 Mar 2025 16:40:43 +0100 Subject: [PATCH] add ssh alias configuration --- .../configuration/access/sshd_configuration.md | 14 ++++++++++++++ user-guide/ssh_host_key_certificates.md | 2 ++ 2 files changed, 16 insertions(+) diff --git a/admin-guide/configuration/access/sshd_configuration.md b/admin-guide/configuration/access/sshd_configuration.md index 2d20eee6..32405c1b 100644 --- a/admin-guide/configuration/access/sshd_configuration.md +++ b/admin-guide/configuration/access/sshd_configuration.md @@ -41,5 +41,19 @@ files::files: ``` +## Aliases in SSH Certificate + +Puppet installs automatically a ssh certificate for the host key. +See the [user guide](../../../user-guide/ssh_host_key_certificates) on how to configure the corresponding CA on the client side. + +If the server is reached using different names/addresses than the hostname, then this aliases can be added to the SSH host key certificate with below Hiera configuration: +``` +ssh_server::aliases: + - 'virtual_host.psi.ch' + - 'virtual_host' + - '129.129.187.75' +``` + + ## SFTP Server How to enable/disable and configure a sftp server please refer to the [SFTP Server](../files/sftp_server) guide. diff --git a/user-guide/ssh_host_key_certificates.md b/user-guide/ssh_host_key_certificates.md index 30af7ac2..e20ef63b 100644 --- a/user-guide/ssh_host_key_certificates.md +++ b/user-guide/ssh_host_key_certificates.md @@ -17,3 +17,5 @@ To accept SSH host keys with a certificate, please update either `~/.ssh/known_h @cert-authority * ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF2xLCCHNmXSeY+qNPmdo/jO2AXrcHyQDqZLBzWVwk2/GqMRDl4mavZLBPyQPNeLGAPc+BHg7iRC65wQQEeYOVU= @cert-authority * ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhIx/obIiiO9AtrUgj7pF8kAgv4g9Dp+DRXilkmlkxK ``` + +This is already configured on Puppet managed RHEL nodes.