diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-05-20 19:57:24 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2025-05-29 14:01:32 +0200 |
| commit | 4b4bbd73b84c2c478c7752f58e7f66ec6d90459e (patch) | |
| tree | 872749218a0efba4375cad579d617db02b6dac97 /interface-definitions | |
| parent | d2745a7b60a7fef88958bd52b3876c105da87e77 (diff) | |
| download | vyos-1x-4b4bbd73b84c2c478c7752f58e7f66ec6d90459e.tar.gz vyos-1x-4b4bbd73b84c2c478c7752f58e7f66ec6d90459e.zip | |
ssh: T6013: rename trusted-user-ca-key -> truster-user-ca
The current implementation for SSH CA based authentication uses "set service
ssh trusted-user-ca-key ca-certificate <foo>" to define an X.509 certificate
from "set pki ca <foo> ..." - fun fact, native OpenSSH does not support X.509
certificates and only runs with OpenSSH ssh-keygen generated RSA or EC keys.
This commit changes the bahavior to support antive certificates generated using
ssh-keygen and loaded to our PKI tree. As the previous implementation
did not work at all, no migrations cript is used.
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/service_ssh.xml.in | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in index 14d358c78..c659a7db7 100644 --- a/interface-definitions/service_ssh.xml.in +++ b/interface-definitions/service_ssh.xml.in @@ -275,14 +275,18 @@ </constraint> </properties> </leafNode> - <node name="trusted-user-ca-key"> + <leafNode name="trusted-user-ca"> <properties> - <help>Trusted user CA key</help> + <help>OpenSSH trusted user CA</help> + <completionHelp> + <path>pki openssh</path> + </completionHelp> + <valueHelp> + <format>txt</format> + <description>OpenSSH certificate name from PKI subsystem</description> + </valueHelp> </properties> - <children> - #include <include/pki/ca-certificate.xml.i> - </children> - </node> + </leafNode> #include <include/vrf-multi.xml.i> </children> </node> |