Error deploying Step-CA with SSH support - Any Ideas ?
reddit / selfhosted

----------------------------------------------------------------------
pewpewdev · 2023-10-27 00:30

I followed these instructions: [https://smallstep.com/blog/build-a-
tiny-ca-with-raspberry-pi-yubikey/](https://smallstep.com/blog/build-
a-tiny-ca-with-raspberry-pi-yubikey/)

The only change I made to these instructions is I added --ssh to the
ca init config to add ssh support

When I attempt to run step-ca I get this error

sudo -u step step-ca /etc/step-ca/config/ca.json

`error reading templates/ssh/config.tpl: stat
/home/step/.step/templates/ssh/config.tpl: no such file or directory`

I'm sure this error is related to the ssh config. I'm not sure what
part of the setup I'm missing here. Does anyone have any idea. I've
never deployed step-ca before?

/etc/step-ca/config/ca.json

`{`

        `"root": "/etc/step-ca/certs/root_ca.crt",`

        `"federatedRoots": null,`

        `"crt": "/etc/step-ca/certs/intermediate_ca.crt",`

        `"key": "yubikey:slot-id=9c",`

`"kms": {`

`"type": "yubikey",`

`"pin": "000000"`

`},`

        `"address": ":443",`

        `"insecureAddress": "",`

        `"dnsNames": [`

`"`[`tinyca`](https://tinyca.authoritah.com)`.internal",`

                `"192.168.4.44"`

        `],`

        `"ssh": {`

                `"hostKey": "/etc/step-ca/secrets/ssh_host_ca_key",`

                `"userKey": "/etc/step-ca/secrets/ssh_user_ca_key"`

        `},`

        `"logger": {`

                `"format": "text"`

        `},`

        `"db": {`

                `"type": "badgerv2",`

                `"dataSource": "/etc/step-ca/db",`

                `"badgerFileLoadingMode": ""`

        `},`

        `"authority": {`

                `"enableAdmin": true`

        `},`

        `"tls": {`

                `"cipherSuites": [`

`"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",`

                        `"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"`

                `],`

                `"minVersion": 1.2,`

                `"maxVersion": 1.3,`

                `"renegotiation": false`

        `},`

        `"templates": {`

                `"ssh": {`

                        `"user": [`

`{`

`"name": "config.tpl",`

`"type": "snippet",`

`"template": "templates/ssh/config.tpl",`

`"path": "~/.ssh/config",`

`"comment": "#"`

`},`

`{`

`"name": "step_includes.tpl",`

`"type": "prepend-line",`

`"template": "templates/ssh/step_includes.tpl",`

`"path": "${STEPPATH}/ssh/includes",`

`"comment": "#"`

`},`

`{`

`"name": "step_config.tpl",`

`"type": "file",`

`"template": "templates/ssh/step_config.tpl",`

`"path": "ssh/config",`

`"comment": "#"`

`},`

`{`

`"name": "known_hosts.tpl",`

`"type": "file",`

`"template": "templates/ssh/known_hosts.tpl",`

`"path": "ssh/known_hosts",`

`"comment": "#"`

`}`

                        `],`

                        `"host": [`

`{`

`"name": "sshd_config.tpl",`

`"type": "snippet",`

`"template": "templates/ssh/sshd_config.tpl",`

`"path": "/etc/ssh/sshd_config",`

`"comment": "#",`

`"requires": [`

`"Certificate",`

`"Key"`

`]`

`},`

`{`

`"name": "ca.tpl",`

`"type": "snippet",`

`"template": "templates/ssh/ca.tpl",`

`"path": "/etc/ssh/ca.pub",`

`"comment": "#"`

`}`

                        `]`

                `}`

        `}`

`}`

----------------------------------------------------------------------
OhMyForm · 2023-10-27 03:02

Why did you jump straight into yubikeys? Do the simplest first

----------------------------------------------------------------------
pewpewdev · 2023-10-27 03:19

I'm realizing that I forgot to mention all of the previous versions of
this setup that I went through. At first I only had the step-ca and
step. I later added the random hardware stuff and the yubikey. Up to
that point everything was working and I could issue commands from
clients and get certificates. When I added the ssh flag I starting
getting this command so I figured I had missed something during the
setup. I really just added the flag. I didn't find a lot of helpful
info around setting up ssh support with step-ca. I really should have
proofed everything before posting.

----------------------------------------------------------------------
Butthurtz23 · 2023-10-27 14:18

It looks like the config file for ssh is missing, so you may need to
manually generate or create one.