https://github.com/spiffe/spiffe-step-ssh
Issue SSH host certificates using SPIFFE
https://github.com/spiffe/spiffe-step-ssh
Last synced: about 2 months ago
JSON representation
Issue SSH host certificates using SPIFFE
- Host: GitHub
- URL: https://github.com/spiffe/spiffe-step-ssh
- Owner: spiffe
- License: apache-2.0
- Created: 2024-11-11T12:44:23.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2026-04-27T13:54:19.000Z (about 2 months ago)
- Last Synced: 2026-04-27T15:32:40.592Z (about 2 months ago)
- Language: Shell
- Size: 187 KB
- Stars: 5
- Watchers: 3
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# spiffe-step-ssh
[](https://opensource.org/licenses/Apache-2.0)
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
Issue SSH host certificates using SPIFFE
## Client Dependencies
A working spire-agent bound to a spire-server. See [helm-chart install instructions](https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/installation/#quick-start) or [general quickstart](https://spiffe.io/docs/latest/try/)
Also, the step binary needs to be installed. [Install Instructions](https://smallstep.com/docs/step-cli/installation/)
## Server
There is a helm chart available [here](https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spiffe-step-ssh)
## Server Config
Each node needs its own entry, under the /sshd/ space.
Example:
```
spire-server entry create \
-parentID spiffe://example.com/spire/agent/http_challenge/test.example.com \
-spiffeID spiffe://example.com/sshd/test.example.com \
-selector systemd:id:spiffe-step-ssh@main.service
```
## Install
```
make install
```
## Diagram
## High Availability
There are configurations that can get you to various levels of High Availability, upto and including running two complete spiffe trust domains, two spiffe-step-ssh servers, and two spiffe-step-ssh clients.
Add into /etc/spiffe/step-ssh/a.conf
```
SPIFFE_STEP_SSH_URL=https://spiffe-step-ssh-a.example.org
SPIFFE_STEP_SSH_FETCHCA_URL=https://spiffe-step-ssh-fetchca-a.example.org
```
Add into /etc/spiffe/step-ssh/b.conf
```
SPIFFE_STEP_SSH_URL=https://spiffe-step-ssh-b.example.org
SPIFFE_STEP_SSH_FETCHCA_URL=https://spiffe-step-ssh-fetchca-b.example.org
```
Enable and Start the clients
```
systemctl enable spiffe-step-ssh@a spiffe-step-ssh@b
systemctl start spiffe-step-ssh@a spiffe-step-ssh@b
```
Add both Step CA ssh signatures into `known_hosts` on your ssh clients.