Autoloading of unencrypted signerd private keys

We now support automatic loading of unencrypted private keys for
signerd. The next planned commit is to support loading keys that were
encrypted using Amazon's KMS.

Author: bobveznat

README.rst

@@ -272,6 +272,7 @@ Effectively the format is::
             NumberSignersRequired
             MaxCertLifetime
             SigningKeyFingerprint
+            PrivateKeyFile
             AuthorizedSigners {
                 <key fingerprint>: <key identity>
             }
@@ -290,7 +291,13 @@ Effectively the format is::
   value of 86400 would mean that the server will reject requests for
   certificates that are valid for more than 1 day.
 - ``SigningKeyFingerprint``: The fingerprint of the key that will be used to
-  sign complete requests. This should be the fingerprint of your CA.
+  sign complete requests. This should be the fingerprint of your CA. When using
+  this option you must, somehow, load the private key into the agent such that
+  the daemon can use it.
+- ``PrivateKeyFile``: A path to a private key file. As of this writing the key
+  must be unencrypted. Do take explicit care if you're using unencrypted
+  private keys. The next release / commit will include support for private key
+  files that are encrypted using Amazon's KMS.
 - ``AuthorizedSigners``: A hash keyed by key fingerprints and values of key
   ids. I recommend this be set to a username. It will appear in the
   resultant SSH certificate in the KeyId field as well in

sign_certd.go

@@ -13,7 +13,9 @@ import (
 	"github.com/codegangsta/cli"
 	"github.com/gorilla/mux"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/agent"
 	"io"
+	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
@@ -98,6 +100,41 @@ type signingRequest struct {
 	cert        *ssh.Certificate
 }
 
+func (h *certRequestHandler) setupPrivateKeys(config map[string]ssh_ca_util.SignerdConfig) error {
+	for env, cfg := range config {
+		if cfg.PrivateKeyFile != "" {
+			keyContents, err := ioutil.ReadFile(cfg.PrivateKeyFile)
+			if err != nil {
+				return fmt.Errorf("Failed reading private key file %s: %v", cfg.PrivateKeyFile, err)
+			}
+			key, err := ssh.ParseRawPrivateKey(keyContents)
+			if err != nil {
+				return fmt.Errorf("Failed parsing private key %s: %v", cfg.PrivateKeyFile, err)
+			}
+			keyToAdd := agent.AddedKey{
+				PrivateKey:   key,
+				Comment:      fmt.Sprintf("ssh-cert-authority-%s-%s", env, cfg.PrivateKeyFile),
+				LifetimeSecs: 0,
+			}
+			agentClient := agent.NewClient(h.sshAgentConn)
+			err = agentClient.Add(keyToAdd)
+			if err != nil {
+				return fmt.Errorf("Unable to add private key %s: %v", cfg.PrivateKeyFile, err)
+			}
+			signer, err := ssh.NewSignerFromKey(key)
+			if err != nil {
+				return fmt.Errorf("Unable to create signer from pk %s: %v", cfg.PrivateKeyFile, err)
+			}
+			keyFp := ssh_ca_util.MakeFingerprint(signer.PublicKey().Marshal())
+			log.Printf("Added private key for env %s: %s", env, keyFp)
+			cfg = config[env]
+			cfg.SigningKeyFingerprint = keyFp
+			config[env] = cfg
+		}
+	}
+	return nil
+}
+
 func (h *certRequestHandler) createSigningRequest(rw http.ResponseWriter, req *http.Request) {
 	err := req.ParseForm()
 	if err != nil {
@@ -539,7 +576,6 @@ func makeCertRequestHandler(config map[string]ssh_ca_util.SignerdConfig) certReq
 
 func runSignCertd(config map[string]ssh_ca_util.SignerdConfig) {
 	log.Println("Server running version", ssh_ca_util.BuildVersion)
-	log.Println("Server started with config", config)
 	log.Println("Using SSH agent at", os.Getenv("SSH_AUTH_SOCK"))
 
 	sshAgentConn, err := net.Dial("unix", os.Getenv("SSH_AUTH_SOCK"))
@@ -549,6 +585,9 @@ func runSignCertd(config map[string]ssh_ca_util.SignerdConfig) {
 	}
 	requestHandler := makeCertRequestHandler(config)
 	requestHandler.sshAgentConn = sshAgentConn
+	requestHandler.setupPrivateKeys(config)
+
+	log.Println("Server started with config", config)
 
 	r := mux.NewRouter()
 	requests := r.Path("/cert/requests").Subrouter()

util/config.go

@@ -20,6 +20,7 @@ type SignerdConfig struct {
 	SlackUrl              string
 	SlackChannel          string
 	MaxCertLifetime       int
+	PrivateKeyFile        string
 }
 
 type SignerConfig struct {