1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
# Installing opkssh
This document provides a detailed description of how our [install-linux.sh](install-linux.sh) script works and the security protections used.
Description of the install-linux.sh script and what variables that can be overridden by system environment variables can be found [here](install-linux-script.md)
If you just want to install opkssh you should run:
```bash
wget -qO- "https://raw.githubusercontent.com/openpubkey/opkssh/main/scripts/install-linux.sh" | sudo bash
```
## Script commands
Running `./install-linux.sh --help` will show you all available flags.
`--no-home-policy` disables configuration steps which allows opkssh see policy files in user's home directory (/home/{username}/auth_id). Try this if you are having install failures.
`--nosshd-restart` turns off the sshd restart. This is useful in some docker setups where restarting sshd can break docker.
`--install-from=FILEPATH` allows you to install the opkssh binary from a local file.
This is useful if you want to install a locally built opkssh binary.
`--install-version=VER` downloads and installs a particular release of opkssh. By default we download and install the latest release of opkssh.
## What the script is doing
**1: Build opkssh.** Run the following from the root directory, replace GOARCH and GOOS to match with server you wish to install OPKSSH. This will generate the opkssh binary.
```bash
go build
```
**2: Copy opkssh to server.** Copy the opkssh binary you just built in the previous step to the SSH server you want to configure
```bash
scp opkssh ${USER}@${HOSTNAME}:~
```
**3: Install opkssh on server.** SSH to the server
Create the following file directory structure on the server and move the executable there:
```bash
sudo mkdir /etc/opk
sudo sudo mv ~/opkssh /usr/local/bin/opkssh
sudo chown root /usr/local/bin/opkssh
sudo chmod 755 /usr/local/bin/opkssh
```
**3: Setup policy.**
The file `/etc/opk/providers` configures what the allowed OpenID Connect providers are.
The default values for `/etc/opk/providers` are:
```bash
# Issuer Client-ID expiration-policy
https://accounts.google.com 206584157355-7cbe4s640tvm7naoludob4ut1emii7sf.apps.googleusercontent.com 24h
https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0 096ce0a3-5e72-4da8-9c86-12924b294a01 24h
https://gitlab.com 8d8b7024572c7fd501f64374dec6bba37096783dfcd792b3988104be08cb6923 24h
```
`/etc/opk/providers` requires the following permissions (by default we create all configuration files with the correct permissions):
```bash
sudo chown root:opksshuser /etc/opk/providers
sudo chmod 640 /etc/opk/providers
```
The file `/etc/opk/auth_id` controls which users and user identities can access the server using opkssh.
If you do not have root access, you can create a new auth_id file in at ~/auth_id and use that instead.
```bash
sudo touch /etc/opk/auth_id
sudo chown root:opksshuser /etc/opk/auth_id
sudo chmod 640 /etc/opk/auth_id
sudo opkssh add {USER} {EMAIL} {ISSUER}
```
**4: Configure sshd to use opkssh.** Check which configuration file is active.
In most cases the active configuration file will be `/etc/ssh/sshd_config`.
Add the following lines to the configuration file
```bash
AuthorizedKeysCommand /usr/local/bin/opkssh verify %u %k %t
AuthorizedKeysCommandUser opksshuser
```
If `/etc/ssh/sshd_config` contains the entry `Include /etc/ssh/sshd_config.d/*.conf`,
add a new configuration file with a lower starting number than other configuration files in ` /etc/ssh/sshd_config.d/`.
For example, if the file `/etc/ssh/sshd_config.d/20-systemd-userdb.conf` exists,
create `/etc/ssh/sshd_config.d/19-opk-ssh.conf` with the lines above.
Verify the setting is active with
```bash
sudo sshd -T | grep authorizedkeyscommand
```
You should see
```bash
authorizedkeyscommand /usr/local/bin/opkssh verify %u %k %t
authorizedkeyscommanduser opksshuser
```
Then create the required AuthorizedKeysCommandUser and group
```bash
sudo groupadd --system opksshuser
sudo useradd -r -M -s /sbin/nologin -g opksshuser opksshuser
```
**6: Configure sudoer and SELINUX.** Configures a sudoer command so that the opkssh AuthorizedKeysCommand process can call out to the shell to run `opkssh readhome {USER}` and thereby read the policy file for the user in `/home/{USER}/.opk/auth_id`.
```bash
"opksshuser ALL=(ALL) NOPASSWD: /usr/local/bin/opkssh readhome *"
```
This config lives in `/etc/sudoers.d/opkssh` and must have the permissions `440` with root being the owner.
If SELinux is configured we need to install an SELinux module to allow opkssh to read the policy in the user's home directory. See our install script [install-linux.sh](install-linux.sh) for details.
**7: Restart sshd.**
On Ubuntu and Debian Linux:
```bash
systemctl restart ssh
```
On Redhat, centos Linux and Arch Linux:
```bash
sudo systemctl restart sshd
```
|
