Jeff Mitchell
14c0000169
Update SSH CA documentation
...
Fixes #2551
Fixes #2569
2017-04-07 11:59:25 -04:00
Vishal Nayak
16d41a8b28
sshca: ensure atleast cert type is allowed ( #2508 )
2017-03-19 18:58:48 -04:00
Jeff Mitchell
a5d1808efe
Always include a hash of the public key and "vault" (to know where it ( #2498 )
...
came from) when generating a cert for SSH.
Follow on from #2494
2017-03-16 11:14:17 -04:00
Mike Okner
6f84f7ffd0
Adding allow_user_key_ids field to SSH role config ( #2494 )
...
Adding a boolean field that determines whether users will be allowed to
set the ID of the signed SSH key or whether it will always be the token
display name. Preventing users from changing the ID and always using
the token name is useful for auditing who actually used a key to access
a remote host since sshd logs key IDs.
2017-03-16 08:45:11 -04:00
Vishal Nayak
9af1ca3d2c
doc: ssh allowed_users update ( #2462 )
...
* doc: ssh allowed_users update
* added some more context in default_user field
2017-03-09 10:34:55 -05:00
Jeff Mitchell
df575f0b3a
Rename helper 'duration' to 'parseutil'. ( #2449 )
...
Add a ParseBool function that accepts various kinds of ways of
specifying booleans.
Have config use ParseBool for UI and disabling mlock/cache.
2017-03-07 11:21:22 -05:00
Jeff Mitchell
db29bde264
Fix a bunch of errors from returning 5xx, and parse more duration types
2017-03-02 15:38:34 -05:00
Vishal Nayak
d30a833db7
Rework ssh ca ( #2419 )
...
* docs: input format for default_critical_options and default_extensions
* s/sshca/ssh
* Added default_critical_options and default_extensions to the read endpoint of role
* Change default time return value to 0
2017-03-01 15:50:23 -05:00
Will May
7d9cb5bffe
Changes from code review
...
Major changes are:
* Remove duplicate code
* Check the public key used to configure the backend is a valid one
2017-03-01 15:19:18 -05:00
Will May
59397250da
Changes from code review
...
Major changes are:
* Change `allow_{user,host}_certificates` to default to false
* Add separate `allowed_domains` role property
2017-03-01 15:19:18 -05:00
Will May
1d59b965cb
Add ability to create SSH certificates
2017-03-01 15:19:18 -05:00
vishalnayak
b408c95e0d
ssh: Use temporary file to store the identity file
2016-10-18 12:50:12 -04:00
vishalnayak
fb2f7f27ba
Fix ssh tests
2016-09-22 11:37:55 -04:00
vishalnayak
c93bded97b
Added cidrutil helper
2016-09-21 13:58:32 -04:00
vishalnayak
9280dda5f4
rename verify_cert as disable_binding and invert the logic
2016-02-24 21:01:21 -05:00
Jeff Mitchell
886f641e5d
Add listing of roles to ssh backend
2016-01-28 12:48:00 -05:00
Jeff Mitchell
45e32756ea
WriteOperation -> UpdateOperation
2016-01-08 13:03:03 -05:00
vishalnayak
79be357030
Vault SSH: Zeroaddress roles and CIDR overlap check
2015-08-29 15:24:15 -04:00
vishalnayak
1226251d14
Vault SSH: Added exclude_cidr_list option to role
2015-08-27 23:19:55 -04:00
vishalnayak
06ac073684
Vault SSH: Docs for default CIDR value
2015-08-27 13:10:15 -04:00
vishalnayak
140013aebd
Vault SSH: Default CIDR for roles
2015-08-27 13:04:15 -04:00
vishalnayak
630f348dbf
Vault SSH: Provide key option specifications for dynamic keys
2015-08-27 11:41:29 -04:00
vishalnayak
41678f18ae
Vault: Fix wild card paths for all backends
2015-08-21 00:56:13 -07:00
vishalnayak
36bf873a47
Vault SSH: 1024 is default key size and removed 4096
2015-08-19 12:51:33 -07:00
vishalnayak
d6c5031169
Vault SSH: TLS client creation test
2015-08-18 19:00:27 -07:00
vishalnayak
d63726b41b
Vault SSH: Documentation update and minor refactoring changes.
2015-08-17 18:22:03 -07:00
vishalnayak
a98b3befd9
Vault SSH: Website page for SSH backend
2015-08-14 12:41:26 -07:00
vishalnayak
52d4c0be9c
Vault SSH: Install script is optional now. Default script will be for Linux host.
2015-08-13 17:07:43 -07:00
vishalnayak
ffaf80167d
Vault SSH: CLI embellishments
2015-08-13 16:55:47 -07:00
vishalnayak
3958136a78
Vault SSH: Introduced allowed_users option. Added helpers getKey and getOTP
2015-08-13 14:18:30 -07:00
vishalnayak
9b1ea2f20c
Vault SSH: Helper for OTP creation and role read
2015-08-13 11:12:30 -07:00
vishalnayak
3d77058773
Vault SSH: Mandate default_user. Other refactoring
2015-08-13 10:36:31 -07:00
vishalnayak
2dd82aeb9a
Vault SSH: cidr to cidr_list
2015-08-13 08:46:55 -07:00
vishalnayak
1a1ce742dd
Vault SSH: Default lease duration, policy/ to role/
2015-08-12 17:36:27 -07:00
vishalnayak
044a2257e7
Vault SSH: Automate OTP typing if sshpass is installed
2015-08-06 17:00:50 -04:00
vishalnayak
c26782acad
Vault SSH: Script to install dynamic keys in target
2015-08-06 14:48:19 -04:00
vishalnayak
e9826c635c
Vault SSH: CRUD test for dynamic role
2015-07-31 15:17:40 -04:00
vishalnayak
8dbbb8b8e6
Vault SSH: CRUD test case for OTP Role
2015-07-31 13:24:23 -04:00
vishalnayak
9aa02ad560
Vault SSH: Review Rework
2015-07-29 14:21:36 -04:00
Vishal Nayak
6a91529f4e
Vault SSH: admin_user/default_user fix
2015-07-27 15:03:10 -04:00
Vishal Nayak
6c5548ca7b
Vault SSH: Refactoring
2015-07-27 13:02:31 -04:00
Vishal Nayak
ef05fe4051
Vault SSH: Vault agent support
2015-07-22 14:15:19 -04:00
Vishal Nayak
6f86d32089
Vault SSH: Made port number configurable
2015-07-06 16:56:45 -04:00
Vishal Nayak
fbaea45101
Vault SSH: PR review rework
2015-07-02 17:23:09 -04:00
Vishal Nayak
2ebd10cdf4
Vault SSH: review rework: formatted and moved code
2015-07-01 21:26:42 -04:00
Vishal Nayak
e6e243b4ca
Vault SSH: Regex supports hypen in key name and role names
2015-07-01 21:05:52 -04:00
Vishal Nayak
57174693ce
Vault SSH: replaced concatenated strings by fmt.Sprintf
2015-07-01 20:35:11 -04:00
Vishal Nayak
13ab7fc40b
Vault SSH: PR review rework - 1
2015-07-01 11:58:49 -04:00
Vishal Nayak
2163818bd6
Input validations, help strings, default_user support
2015-06-30 18:33:17 -04:00
Vishal Nayak
4b07eba487
POC: Rework. Doing away with policy file.
2015-06-24 18:13:12 -04:00
