Returning to the idea of authenticating our hosts and our known_hosts file,
if we've got many systems that we need to connect to,
then of course we are storing many keys.
However, we can use the idea of a certificate authority.
We trust the certificate authority,
and anything that has been signed by the certificate
authority then can be accepted to our clients.
So working on our Ubuntu system, we can make sure we're in our home directory.
Again, using that utility ssh‑keygen,
we can specify the file that we want to write to,
so we can write to a separate file.
Here we're calling it the server_ca.
Ok?
It's just going to be a public key and private key pair.
We can go and grab the public key from our remote AlmaLinux system,
and we're just copying it across to our local directory,
and we're calling it, for convenience, alma.pub.
Once that's completed, again using ssh‑keygen, we can sign using our server_ca.
We can go through and specify the identity of the certificate.
We're going to call this certificate alma,
‑h says it's a host certificate rather than a client certificate,
‑n is the name of the host.
We're not using hostnames so we're just using IP addresses,
so I'm putting in my IP address,
the IP address that we used to connect to my AlmaLinux system.
We're allowing the validity period for 52 weeks,
but obviously we could adjust this based on our own requirements.
And we're reading in, then, the public key alma.pub.
This is going to generate for us the alma‑cert.pub.
We copy that back through to our remote system,
and we're just storing it on the remote system in the temp directory,
and we're just calling it ssh_host_rsa_key‑cert.pub.
In order to be able to trust the certificate authority,
we can list or concatenate our server_ca.pub,
the public key of our certificate authority,
and add it through to our known_hosts.
However, we need to add a little bit of information to that.
So we next go in and edit the known_hosts and we append
@cert‑authority and then the names that this authority support.
So in my case it's 192.168.33.*,
and we add that so it's immediately before the ssh‑rsa.
You'll see it in a demonstration in any case.
With that done,
the client on the Ubuntu system now trusts anything that is
signed with that certificate authority.
Working on our AlmaLinux system,
we can move the signed public key into our SSH directory.
We can add a HostCertificate line into our sshd_config
and make sure that we restart the sshd.
We now should be up and running.
We're going to be able to test this,
but make sure you have nothing else in your known_hosts file,
or ssh_known_hosts file, that is pointing through to your system.
We want to be making sure that we are using the certificate authority.
But remember,
these things are always going to be made easy if you put the effort in
and follow through my demonstration on your own system.
So come on, we're breaking this into two demonstrations to make it easy for you. We'll begin by setting up the certificate authority.