Introducing the generate-config subcommand

Bootstrapping new users/requesters is harder than it should be due to
having to generating the configuration file on each host. This commit
introduces the generate-config subcommand that users can run to at least
bootstrap a configuration file.

Accompanying this is the /config/environments resource in sign_certd
that can return a list of configured environments on the server. This
enables generate-config to produce a pretty decent starting point (and
in some cases fully configured) configuration file for new users.

Author: bobveznat

README.rst

@@ -224,6 +224,7 @@ building and distributing software). The subcommands are:
     - sign
     - get
     - encrypt-key
+    - generate-config
 
 As you might have guessed by now this means that a server needs to be
 running and serving the ssh-cert-authority service. Users that require
@@ -428,7 +429,8 @@ SSH to.
 ``--generate-rsa`` will generate a 4096 bit RSA key. ``--generate-ecdsa`` will
 generate a key from nist's p384 curve. ECDSA support is nonexistent on
 OS X hosts unless your users build openssh from scratch (or homebrew).
-This is considered painful.
+This is considered painful. This may not be a problem on more modern
+versions of OS X (i.e. high sierra) but I haven't tried it.
 
 Requesting Certificates
 =======================

USAGE.rst

@@ -36,6 +36,25 @@ blob containing a stage and prod environment. The user has chosen to use
 different SSH keys for production and staging, however, this is not
 required. The ``SignerUrl`` is the location of the ssh-cert-authority daemon.
 
+Generating this configuration file can be a little cumbersome. The
+``ssh-cert-authority`` program has a ``generate-config`` subcommand that
+tries to aid in generating this file. New users can run something like ::
+
+    ssh-cert-authority generate-config --url https://ssh-ca.example.com
+
+And that will do two things. First, it goes to ssh-ca.example.com and
+requests a listing of the server's configured environments (e.g. "stage"
+and "prod"). Second it creates the configuration file inserting
+https://ssh-ca.example.com as the SignerUrl and $HOME/.ssh/id_rsa.pub as
+the PublicKeyPath.
+
+The generated config file is printed to stdout. You can redirect or
+manually copy it into the default location of
+``~/.ssh_ca/requester_config.json``.
+
+Users using multiple SSH keys or keys other than id_rsa.pub will need to
+manually edit the configuration after it is generated.
+
 Making a request
 ----------------
 

generate_config.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"github.com/cloudtools/ssh-cert-authority/util"
+	"github.com/codegangsta/cli"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"strings"
+)
+
+func generateConfigFlags() []cli.Flag {
+	home := os.Getenv("HOME")
+	if home == "" {
+		home = "/"
+	}
+	return []cli.Flag{
+		cli.StringFlag{
+			Name:  "url, u",
+			Value: "",
+			Usage: "An ssh-cert-authority url (e.g. https://ssh-cert-authority.example.com).",
+		},
+		cli.StringFlag{
+			Name:  "key-file, k",
+			Value: fmt.Sprintf("%s/.ssh/id_rsa.pub", home),
+			Usage: "Path to your SSH public key. The filename will be inserted into the generated config file.",
+		},
+	}
+}
+
+func cmdGenerateConfig(c *cli.Context) error {
+
+	url := c.String("url")
+	if url == "" {
+		return cli.NewExitError("url is a required option.", 1)
+	}
+	if !strings.HasSuffix(url, "/") {
+		url = url + "/"
+	}
+
+	getResp, err := http.Get(url + "config/environments")
+	if err != nil {
+		return cli.NewExitError(fmt.Sprintf("Didn't get a valid response: %s", err), 1)
+	}
+
+	getRespBuf, err := ioutil.ReadAll(getResp.Body)
+	if err != nil {
+		return cli.NewExitError(fmt.Sprintf("Error reading response body: %s", err), 1)
+	}
+	getResp.Body.Close()
+	if getResp.StatusCode != 200 {
+		return cli.NewExitError(fmt.Sprintf("Error getting listing of environments: %s", string(getRespBuf)), 1)
+	}
+
+	environments := make([]string, 0)
+	json.Unmarshal(getRespBuf, &environments)
+
+	wholeConfig := make(map[string]ssh_ca_util.RequesterConfig, len(environments))
+	for _, envName := range environments {
+		wholeConfig[envName] = ssh_ca_util.RequesterConfig{
+			PublicKeyPath: c.String("key-file"),
+			SignerUrl:     url,
+		}
+	}
+	result, err := json.MarshalIndent(wholeConfig, "", "    ")
+	if err != nil {
+		return cli.NewExitError(fmt.Sprintf("Failed to serialize config file: %v", err), 1)
+	}
+	fmt.Print(string(result))
+	return nil
+}

main.go

@@ -53,6 +53,12 @@ func main() {
 			Usage:  "Optionally generate and then encrypt an ssh private key",
 			Action: cmdEncryptKey,
 		},
+		{
+			Name:   "generate-config",
+			Flags:  generateConfigFlags(),
+			Usage:  "Try to generate a configuration file for a requester",
+			Action: cmdGenerateConfig,
+		},
 	}
 	app.Run(os.Args)
 }

sign_certd.go

@@ -397,6 +397,20 @@ func newResponseElement(certBlob string, signed bool, numSignatures, signaturesR
 	return element
 }
 
+func (h *certRequestHandler) listEnvironments(rw http.ResponseWriter, req *http.Request) {
+	environments := make([]string, 0)
+	for k, _ := range h.Config {
+		environments = append(environments, k)
+	}
+	result, err := json.Marshal(environments)
+	if err != nil {
+		http.Error(rw, fmt.Sprintf("Unable to marshal environment names: %v", err), http.StatusInternalServerError)
+		return
+	}
+	log.Printf("List environments received from '%s'\n", req.RemoteAddr)
+	rw.Write(result)
+}
+
 func (h *certRequestHandler) listPendingRequests(rw http.ResponseWriter, req *http.Request) {
 	var certRequestID string
 
@@ -676,6 +690,8 @@ func runSignCertd(config map[string]ssh_ca_util.SignerdConfig, addr string) erro
 	request := r.Path("/cert/requests/{requestID}").Subrouter()
 	request.Methods("GET").HandlerFunc(requestHandler.getRequestStatus)
 	request.Methods("POST", "DELETE").HandlerFunc(requestHandler.signOrRejectRequest)
+	environments := r.Path("/config/environments").Subrouter()
+	environments.Methods("GET").HandlerFunc(requestHandler.listEnvironments)
 	http.ListenAndServe(addr, r)
 	return nil
 }

util/config.go

@@ -7,8 +7,8 @@ import (
 )
 
 type RequesterConfig struct {
-	PublicKeyPath        string
-	PublicKeyFingerprint string
+	PublicKeyPath        string `json:",omitempty"`
+	PublicKeyFingerprint string `json:",omitempty"`
 	SignerUrl            string
 }