pim/tf-debian-vm
Archived
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity

improve ssh host cert validation

Browse source
This commit is contained in:
pizzaniels 2023-04-21 21:23:01 +02:00
parent 8608af6e3a
commit 50a11ff81c
2 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
files/get_cert.sh
View file

@ -5,13 +5,6 @@ IFS=$'\n\t'
eval "$(jq -r '@sh "PUBKEY=\(.pubkey) HOST=\(.host) CAHOST=\(.cahost)"')" eval "$(jq -r '@sh "PUBKEY=\(.pubkey) HOST=\(.host) CAHOST=\(.cahost)"')"
# TODO: Can this be done more eye-pleasingly? # TODO: Can this be done more eye-pleasingly?
set +e
CERT=$(ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@$CAHOST '/root/ca.sh host "'"$PUBKEY"'" "'"$HOST"'".dmz') CERT=$(ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@$CAHOST '/root/ca.sh host "'"$PUBKEY"'" "'"$HOST"'".dmz')
retval=$?
set -e
if [ retval -neq 0 ]; then
CERT="error"
fi
jq -n --arg cert "$CERT" '{"cert":$cert}' jq -n --arg cert "$CERT" '{"cert":$cert}'

5
main.tf
View file

@ -50,6 +50,11 @@ resource "null_resource" "cert" {
ignore_changes = [ ignore_changes = [
triggers triggers
] ]
postcondition {
condition = self.triggers["cert"] != "" || !var.use_host_cert
error_message = "Error retrieving host certificate."
}
} }
} }