And we begin by moving out to our Ubuntu system where we're going to
configure the certificate authority and the ssh_known_hosts file.
As our glorious slides were intimating,
we need to go and grab some root privileges and generate ourselves a
certificate authority so that we don't need to maintain the trust
relationship between so many different server keys.
To generate a certificate authority, it is just the plain and simple ssh‑keygen.
We're using the option, ‑f,
now so we can specify the name of the private key to write to.
So we're just going to call the private key server_ca.
As we then go through and generate it, we're being prompted for our passphrase,
and yes, you do need a passphrase.
If we don't have a passphrase,
the whole security of our organization could be at risk
because this is the trust relationship that we could be
setting up between all of your servers.
So let's make sure we've got strong passphrases,
and that's it, we've generated our certificate authority.
How easy was that?
Now with our easy bit done and dusted,
let's go through and list out our directory.
We've put in the root user's home directory,
but we've got then our private key and the public key associated with it.
And it's that public key that all of our agents,
our clients, our SSH clients, need to trust.
If we go through and cat out the contents of that public file,
remember it's the public file that we are looking at,
we understand then what's inside of this file,
and we've got then the algorithm that we're using and then the public
key that makes up the partner to the private key.
It's this that we must add into our known hosts,
and to do it globally across the whole of the server,
we can add it as before to our ssh_known_hosts file.
But we do need to go in and edit that file just to put a
little bit more metadata relating to this.
We can see where it's gone in, the line beginning with ssh‑rsa,
and we can see that it has no metadata relating to it,
it's just the public key, so it doesn't really know where it's come from.
If we go into insert, though,
we can add the required metadata to indicate that this
is part of our certificate authority.
So @cert‑authority,
and our certificate authority then we're signing this for a group of hostnames.
Now those hostnames could be IP addresses as we're using,
so I'm adding in 192.168.33.*, but equally,
if we were using some kind of domain name system,
we could use *.example.com or whatever the global name was
of the hosts that we were accessing.
But that's it, I only need that one record.
I'm leaving the other records in at the moment because we
haven't completed the server‑side work that we must do to
ensure that this is working, we've just got a running certificate authority.
But the importance is that it's created in the same
way with our ssh‑keygen utility, and the trust is similar through our known hosts.