Assigned
Status Update
No update yet.
Comments
kh...@google.com
Can you provide me with the error message that you receive when trying to ssh to your VM instance using CA signed keys?
in...@gmail.com
This is when I try to add the CA key to my project metadata.
The error is: Invalid key. Required format: <protocol> <key-blob> <username@example.com>
All you need to do on your end is change the regex to start with something like ^(?:@cert-authority\s+\S+\s+)? but a better solution would be to recognise this as a CA and append it to a TrustedUserCAKeys file with the relevant line in /etc/ssh/sshd_config
This is important for people who want to scale without having to manage this little aspect themselves in a startup script. You support sshKeys in the metadata anyway so it makes sense to complete this feature with CA support.
The error is: Invalid key. Required format: <protocol> <key-blob> <username@example.com>
All you need to do on your end is change the regex to start with something like ^(?:@cert-authority\s+\S+\s+)? but a better solution would be to recognise this as a CA and append it to a TrustedUserCAKeys file with the relevant line in /etc/ssh/sshd_config
This is important for people who want to scale without having to manage this little aspect themselves in a startup script. You support sshKeys in the metadata anyway so it makes sense to complete this feature with CA support.
kh...@google.com
I have forwarded this request to the engineering team. We will update this issue with any progress updates and a resolution.
sh...@gmail.com
any update on this.
is...@google.com
sa...@google.com Restricted+
Restricted+
Comment has been deleted.
ze...@gmail.com
Why can't this be fixed? Isn't it just a matter of relaxing a regular expression?
sa...@google.com
Hi Zenczykowski, Please ignore
It is now possible to set an SSH certificate authority CA via the Cloud Console in the “sshKeys” Metadata section [1] or via the gcloud command [2].
Have a nice day,
Murali
[1]
[2]
Description
@cert-authority * ssh-rsa <...>
Appended to /etc/ssh/ssh_known_hosts
The reasons why should be self-explanatory.