Following tutorial but in the end getting the 'regular' error message that the authenticity of host can't be established. #2373

VinvarLaLece · 2025-08-24T11:20:39Z

VinvarLaLece
Aug 24, 2025

Dear all,

I am trying to achieve having a Proxmox container running as my CA which acts as an ACME for my internal domains and as a SSH certificate handler. The use case will be that I will SSH to this container and to other containers from my laptop.

I am trying to set up SSH with STEP CA following tutorial and forum-post. The steps below results in the 'regular' error message that the authenticity of host can't be established. Could someone help me where I make the mistake?

I have set up two containers on Proxmox with the helper script from Proxmox Helper Scripts.
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/debian.sh)"
As long as I am testing, I allow SSH login by the root user.

One container will be running the desired CA and the other will act as my laptop. From what I understand, the Vagrant VM from the tutorial equals as my laptop.
For readability I call the container with CA step-host and the one acting as my laptop step-client for the rest of this post.
For testing I do not like to 'clog' my laptop or change configuration while I am not completely sure. Therefore, I make use of the second container instead.

I run the commands as follows (splitted by which device I run it on).

step-host
1 nano install_step.sh (see bottom of this post for the script.)
2 chmod +x install_step.sh
3 ./install_step.sh
4 cat /etc/step/certs/root_ca.crt (Use the output in command 5)
CONTINUE ON STEP-CLIENT
7 cat /etc/ssh/ssh_host_ecdsa_key.pub (Use the output in command 8)
CONTINUE ON STEP-CLIENT
11 cat /etc/step/password-provisioner (Use the output during command 12)

step-client
5 nano /usr/local/share/ca-certificates/root_ca.crt (Paste the output of command 4)
6 update-ca-certificates
CONTINUE ON STEP-HOST
8 echo "@cert-authority * _(PASTE the output of command 7)_" >> ~/.ssh/known_hosts
9 eval $(ssh-agent)
10 apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates && curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc && echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' | tee /etc/apt/sources.list.d/smallstep.list && apt-get update && apt-get -y install step-cli
CONTINUE ON STEP-HOST
12 step ssh certificate root testuser_ecdsa --ca-url https://certificates.[redacted] --root /usr/local/share/ca-certificates/root_ca.crt
13 ssh-add -l
14 ssh root@certificates
15 ssh root@certificates.[redacted]

This has set up the step-host to listen for incoming SSH certificate validations. Also, it pointed step-client to validate SSH certificates at the step-host and with this I should be able to connect to step-host via SSH. However, running either command 14 or 15 results in

root@step-client:~# ssh root@certificates.[redacted]
The authenticity of host 'certificates.[redacted] (1[redacted])' can't be established.
ECDSA key fingerprint is SHA256:N[redacted].
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

I have no idea why the certificate does not get used (or even if this is what is going wrong). Would anyone have an idea how to solve it and make use of the SSH certificates?

install_step.sh

#!/usr/bin/bash

function generate_password () {
    set +o pipefail
    < /dev/urandom tr -dc A-Za-z0-9 | head -c16
    echo
    set -o pipefail
}

# Install dependencies & Step CA.
apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates
curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc && \
    echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' \
    | tee /etc/apt/sources.list.d/smallstep.list
apt-get update && apt-get -y install step-cli step-ca

# Create group & user.
useradd --user-group --system --home /etc/step --shell /bin/false step

# Set up directories & files needed.
mkdir /etc/step
generate_password > /etc/step/password
generate_password > /etc/step/password-provisioner

# Instantiate Step CA
step ca init --acme --ssh --address=:443 --deployment-type=standalone --dns=1[redacted] --dns=certificates.[redacted] --name=example.com --password-file=/etc/step/password --provisioner-password-file=/etc/step/password-provisioner --provisioner=main

# Give Step CA permissions to bind to ports under 1024.
setcap CAP_NET_BIND_SERVICE=+eip $(which step-ca)

# Move Step CA from root user('s folder) to folder which can be ran be the user step.
mv $(step path)/* /etc/step
sed -i 's/root\/.step/etc\/step/g' /etc/step/config/ca.json
chown -R step:step /etc/step
rm -r /root/.step/

# Create a Systemd service to run Step CA (with user step)
cat <<EOF > /etc/systemd/system/step-ca.service
[Unit]
Description=step-ca service
Documentation=https://smallstep.com/docs/step-ca
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=30
StartLimitBurst=3
ConditionFileNotEmpty=/etc/step/config/ca.json
ConditionFileNotEmpty=/etc/step/password
ConditionFileNotEmpty=/etc/step/password-provisioner

[Service]
Type=simple
User=step
Group=step
Environment=STEPPATH=/etc/step
WorkingDirectory=/etc/step
ExecStart=/usr/bin/step-ca config/ca.json --password-file password
ExecReload=/bin/kill --signal HUP $MAINPID
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitInterval=30
StartLimitBurst=3

; Process capabilities & privileges
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SecureBits=keep-caps
NoNewPrivileges=yes

; Sandboxing
ProtectSystem=full
ProtectHome=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectKernelModules=true
LockPersonality=true
RestrictSUIDSGID=true
RemoveIPC=true
RestrictRealtime=true
SystemCallFilter=@system-service
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
ReadWriteDirectories=/etc/step/db

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now step-ca
systemctl status step-ca

# Add root_ca to trust store of machine
cp /etc/step/certs/root_ca.crt /usr/local/share/ca-certificates/root_ca.crt
update-ca-certificates

# Update SSH (server) & start it.
echo -e "#The root SSH user public key used to verify SSH user certificates.\nTrustedUserCAKeys /etc/step/certs/ssh_user_key.pub\n# Path to the private key and certificate\nHostKey /etc/ssh/ssh_host_ecdsa_key\nHostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub" >> /etc/ssh/sshd_config
systemctl restart ssh
eval $(ssh-agent)

# Create new SSH host certificate to this device's ssh agent.
step ssh certificate certificates.[redacted] /etc/ssh/ssh_host_ecdsa_key.pub --host --sign --ca-url https://certificates.[redacted] --root /usr/local/share/ca-certificates/root_ca.crt --provisioner="main" --password-file=/etc/step/password-provisioner
ssh-add -l

Answered by VinvarLaLece

Sep 17, 2025

Dear All,

As I have had no reply on this or my previous post, I do not know if this is a dead forum. In case someone stumbles on it and would like to know how to fix my problem, I was able to solve the issue with the following.

I created three bash scripts to install Step based on the role of the device. This scripts needs to be run by the root (as I assume this is one of the first steps when bootstrapping a new device).
Possibile roles:

Device acting as the CA.
Device acting as a SSH client.
Device acting as a SSH host (so a client wants to SSH into this device).

Script to run an the device acting as the CA.

#!/usr/bin/env bash

# Make sure the script exists on failures
set -eo pipefai…

View full answer

VinvarLaLece · 2025-09-17T12:06:17Z

VinvarLaLece
Sep 17, 2025
Author

Dear All,

As I have had no reply on this or my previous post, I do not know if this is a dead forum. In case someone stumbles on it and would like to know how to fix my problem, I was able to solve the issue with the following.

I created three bash scripts to install Step based on the role of the device. This scripts needs to be run by the root (as I assume this is one of the first steps when bootstrapping a new device).
Possibile roles:

Device acting as the CA.
Device acting as a SSH client.
Device acting as a SSH host (so a client wants to SSH into this device).

Script to run an the device acting as the CA.

#!/usr/bin/env bash

# Make sure the script exists on failures
set -eo pipefail
set -e

IP_ADDRESS=$(hostname -I | awk '{print $1}')
ROOTCA_FILE_PATH=/usr/local/share/ca-certificates/[your root_ca.pub].crt
STEPPATH=[redacted]
TMP_ERR_FILE="/tmp/error_install_step_script"

# COLOURS
RD=$(echo "\033[01;31m")
GN=$(echo "\033[1;92m")
CL=$(echo "\033[m")

# Set up array with password files which are needed.
# IF YOU ALTER THE NUMBERS, ALTER IT IN THE WHOLE SCRIPTS!
PASSWDFILE[0]=password
PASSWDFILE[1]=password-provisioner

function generate_password () {
    set +o pipefail
    < /dev/urandom tr -dc A-Za-z0-9_- | head -c16
    echo
    set -o pipefail
}

function spinner () {
    pid="$!"
    i=1
    sp="\|/-"

    printf "$1 "
    while ps -p "${pid}" > /dev/null
    do
        printf "\b%c" "${sp:i++%4:1}"
        sleep 0.1
    done

    printf "\r${GN}✔${CL} $2\n"
}

function print_failure () {
    printf "\n${RD}X ERROR: $1${CL}\n\n";
    exit 1
}

function print_success () {
    printf "\r${GN}✔${CL} $1\n";
}

function prepare_host () {
    # Only the edcsa type will be used, remove everything else.
    if (ls /etc/ssh/ | grep ssh_host_ed255* | wc -l) > 0; then
        rm /etc/ssh/ssh_host_ed255* 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    fi
    if (ls /etc/ssh/ | grep ssh_host_rs* | wc -l) > 0; then
        rm /etc/ssh/ssh_host_r* 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    fi
    print_success "Removed all SSH keys except the type Step CA will use."

    if ! grep -q "^step:" /etc/passwd; then
        useradd --user-group --system --home "${STEPPATH}" --shell /bin/false step 2>"${TMP_ERR_FILE}" && print_success "User 'step' created." || print_failure "$(<${TMP_ERR_FILE})"
    fi
}

function rotate_certificate () {
    cat <<EOF > /etc/cron.weekly/rotate-ssh-certificate
#!/bin/sh
export STEPPATH=${STEPPATH}
step ssh renew /etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key --ca-url https://certificated.myown.home --force --provisioner sshpop --root "${ROOTCA_FILE_PATH}" 2> /dev/null
exit 0
EOF

    chown step:step /etc/cron.weekly/rotate-ssh-certificate
    chmod 755 /etc/cron.weekly/rotate-ssh-certificate
}

function ssh_setup () {
    # Update SSH (server) configuration & restart it.
    # sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config # Done by Ansible's init script
    sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
    sed -i 's/#HostbasedUathentication no/HostbasedUathentication no/g' /etc/ssh/sshd_config
    sed -i 's/#IgnoreUserKnownHosts no/IgnoreUserKnownHosts yes/g' /etc/ssh/sshd_config
    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
    echo -e "\n\n###\n# ADDED when installing Step CA\n###\nHostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub\n#The root SSH user public key used to verify SSH user certificates.\nTrustedUserCAKeys ${STEPPATH}/certs/ssh_user_ca_key.pub" >> /etc/ssh/sshd_config
    systemctl restart ssh > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    systemctl is-enabled ssh.service > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    systemctl is-active ssh.service > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"

    step ssh certificate "${HOSTNAME}".myown.home /etc/ssh/ssh_host_ecdsa_key.pub --host --sign --ca-url https://"${IP_ADDRESS}" --root "${ROOTCA_FILE_PATH}" --password-file "${STEPPATH}/secrets/${PASSWDFILE[2]}" --provisioner main --principal "${HOSTNAME}".myown.home --principal "${IP_ADDRESS}" > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
}

function step_init () {
    mkdir -p "${STEPPATH}" 2>"${TMP_ERR_FILE}" && print_success "Directory for STEP CA created." || print_failure "$(<${TMP_ERR_FILE})"

    # Generate the password files and store it in temporary path.
    for file_path in "${PASSWDFILE[@]}"; do
        generate_password > "${file_path}"
        chmod 400 "${file_path}"
    done

    # Init (so it can be started)
    step ca init --address=:443 --deployment-type standalone --dns "${IP_ADDRESS}" --dns "${HOSTNAME}".myown.home --name ProvenOne --password-file "${PASSWDFILE[0]}" --provisioner main --provisioner-password-file "${PASSWDFILE[1]}" --ssh > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"

    # Add root_ca to trust store of machine.
    cp "/root/.step/certs/root_ca.crt" "${ROOTCA_FILE_PATH}"
    update-ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Public key of CA copied and loaded in to trust store." || print_failure "$(<${TMP_ERR_FILE})"

    # Remove and create provisioners
    step_provisioner_configure

    # Move Step CA from root user('s folder) to folder which can be ran be the user step.
    mv --update $(step path)/* "${STEPPATH}"
    rm -r /root/.step/
    # Move the password files as well.
    for file_path in "${PASSWDFILE[@]}"; do
        mv  "${file_path}" "${STEPPATH}/secrets/${file_path}"
    done
    # Make sure all directories and files have the correct owner
    chown -R step:step "${STEPPATH}"

    # Change the configuration of STEP CA to reflect the STEP PATH change done above.
    sed -i 's/root\/.step/etc\/step-ca/g' "${STEPPATH}"/config/ca.json
    sed -i 's/root\/.step/etc\/step-ca/g' "${STEPPATH}"/config/defaults.json

    print_success "Step initialized succesfully and moved everything to the created STEP CA directory."
}

function step_install () {
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get install -y --no-install-recommends curl gpg ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' | tee /etc/apt/sources.list.d/smallstep.list > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get -y install step-cli step-ca > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Step CLI & Step CA installed" || print_failure "$(<${TMP_ERR_FILE})"
}

function step_install_and_start () {
    step_install

    step_init

    step_service_create_and_start

    step_validate
}

step_provisioner_configure () {
    [created or remove provisioners if needed.]
    print_success "Provisioners in Step CA configured."
}

function step_service_create_and_start () {
    # Create service
    cat <<EOF > /etc/systemd/system/step-ca.service
[Unit]
Description=step-ca service
Documentation=https://smallstep.com/docs/step-ca
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=30
StartLimitBurst=3
ConditionFileNotEmpty=${STEPPATH}/config/ca.json

[Service]
Type=simple
User=step
Group=step
Environment=STEPPATH=${STEPPATH}
WorkingDirectory=${STEPPATH}
ExecStart=/usr/bin/step-ca config/ca.json --password-file ${STEPPATH}/secrets/${PASSWDFILE[0]}
ExecReload=/bin/kill --signal HUP $MAINPID
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitInterval=30
StartLimitBurst=3

; Process capabilities & privileges
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SecureBits=keep-caps
NoNewPrivileges=yes

; Sandboxing
ProtectSystem=full
ProtectHome=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectKernelModules=true
LockPersonality=true
RestrictSUIDSGID=true
RemoveIPC=true
RestrictRealtime=true
SystemCallFilter=@system-service
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
ReadWriteDirectories=${STEPPATH}/db

[Install]
WantedBy=multi-user.target
EOF

    # Start service
    systemctl daemon-reload > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    systemctl enable --now step-ca > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    print_success "Created a service for Step CA."
}

function step_validate () {
    systemctl is-enabled step-ca.service > /dev/null 2>&1 && print_success "Step CA is enabled." || print_failure "Step CA is not enabled."
    systemctl is-active step-ca.service > /dev/null 2>&1 && print_success "Step CA is active." || print_failure "Step CA is not active."

    # Sleep for the STEP CA enpoint to be reachable.
    sleep 5

    response=$(curl -s https://"${IP_ADDRESS}"/health)
    if echo "$response" | grep "{\"status\":\"ok\"}" > /dev/null 2>&1; then
        print_success "Step CA endpoint is up and running healthy.";
    else
        print_failure "Step CA endpoint is not running (correctly).";
    fi
}

# ###
# # PRE-REQUISTIES
# ###
prepare_host & spinner "Preparing host..." "Host prepared."

rotate_certificate & spinner "Creating CRON job for certificate rotation..." "CRON job created for certificate rotation."

###
# STEP CA
###
step_install_and_start & spinner "Installing Step..." "Step is running."

# In the previous function all the step folders are moved. Therefore, ...
export STEPPATH="${STEPPATH}"

ssh_setup & spinner "Creating SSH host certificate..." "SSH host certificate created."

###
# CREATE REPORT
###
echo -e "\n###################################\n\n"
echo -e "Manual actions YOU need to do:\n\n"
echo -e "   1. Run 'export STEPPATH=\"${STEPPATH}\"' to create the environment variable."
echo -e "\n\n###\n"
echo -e "## Main configuration ##"
echo -e "\n"
echo -e "   2. Copy the content of '${STEPPATH}/secrets/root_ca_key' to your vault and remove the file with 'rm ${STEPPATH}/secrets/root_ca_key'."
echo -e "   3. Copy the content of '${STEPPATH}/secrets/${PASSWDFILE[0]}' to your vault and DO NOT remove the file."
echo -e "   4. Copy the public CA key to the other scripts and DO NOT remove the file."
echo -e "$(<${ROOTCA_FILE_PATH})"
echo -e "\n\n###\n"
echo -e "## SSH configuration ##"
echo -e "\n"
echo -e "   5. Copy the content of '${STEPPATH}/secrets/ssh_host_ca_key' to your vault and DO NOT remove the file with 'rm ${STEPPATH}/secrets/ssh_host_ca_key'."
echo -e "   6. Copy the content of '${STEPPATH}/secrets/ssh_user_ca_key' to your vault and DO NOT remove the file with 'rm ${STEPPATH}/secrets/ssh_user_ca_key'."
echo -e "   7. Copy the content of '${STEPPATH}/secrets/${PASSWDFILE[1]}' to your vault and remove the file with 'rm ${STEPPATH}/secrets/${PASSWDFILE[1]}'."
echo -e "   8. Copy the public SSH host key to the other scipts and DO NOT remove the file."
echo -e "$(<${STEPPATH}/certs/ssh_host_ca_key.pub)"
echo -e "\n\n###\n"
echo -e "   9. DO NOT forget to remove this script."

Script to run an the device acting as a SSH client.

#!/usr/bin/env bash

HOSTCA_PUBLIC_KEY=[paste content $(step path)/certs/ssh_host_ca_key.pub here]
ROOTCA_PUBLIC_KEY=$(cat <<EOF
[paste content $(step path)/certs/root_ca.pub here]
EOF
)

ROOTCA_FILE_PATH=/usr/local/share/ca-certificates/[root_ca.pub].crt
TMP_ERR_FILE="/tmp/error_install_step_script"

# COLOURS
RD=$(echo "\033[01;31m")
GN=$(echo "\033[1;92m")
CL=$(echo "\033[m")

function spinner () {
    pid="$!"
    i=1
    sp="\|/-"

    printf "$1 "
    while ps -p "${pid}" > /dev/null
    do
        printf "\b%c" "${sp:i++%4:1}"
        sleep 0.1
    done

    printf "\r${GN}✔${CL} $2\n"
}

function print_failure () {
    printf "\n${RD}X ERROR: $1${CL}\n\n";
    exit 1
}

function print_success () {
    printf "\r${GN}✔${CL} $1\n";
}

function root_ca_install () {
    echo "${ROOTCA_PUBLIC_KEY}" > "${ROOTCA_FILE_PATH}"
    update-ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Public key of CA copied and loaded in to trust store." || print_failure "$(<${TMP_ERR_FILE})"
}

function setup_alias () {
    local toAdd="\nalias ssh_cert=\"eval \\\"\$(ssh-agent -s)\\\" && printf \\\"\\033[93mYou need to enter the password of the $(step path)/secrets/ssh_user_ca_key.\\033[m\\n\\\" && step ssh certificate [redacted] id_ecdsa --ca-url https://certificated.myown.home --root ${ROOTCA_FILE_PATH} --provisioner main\""

    if ! grep -q ssh_cert ~/.bashrc; then
        echo -e "${toAdd}" >> ~/.bashrc
    fi
}

function set_known_hosts () {
    echo "@cert-authority *myown.home ${HOSTCA_PUBLIC_KEY}" > ~/.ssh/known_hosts
    echo "@cert-authority [xxx.xxx.xxx].* ${HOSTCA_PUBLIC_KEY}" > ~/.ssh/known_hosts
}

function step_install () {
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get install -y --no-install-recommends curl gpg ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' | tee /etc/apt/sources.list.d/smallstep.list > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get -y install step-cli > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Step CLI installed" || print_failure "$(<${TMP_ERR_FILE})"
}

###
# EXECUTE
###

step_install & spinner "Installing Step..." "Step is running."

root_ca_install & spinner "Installing ProvenOne's root CA to the trusted store..." "Installed root CA."

setup_alias & spinner "Setting up an alias to acquire a SSH user certificate..." "Bash alias set."

set_known_hosts & spinner "Configuring SSH cert authority..." "SSH cert authority configured."


###
# CREATE REPORT
###
echo -e "\n###################################\n\n"
echo -e "Provisioned device (client) to SSH into hosts."
echo -e "Run 'ssh_cert' before connecting via SSH. Upon asked, enter the $(step path)/secrets/ssh_user_ca_key."
echo -e "\n\n###\n"
echo -e "Manual actions YOU need to do:\n\n"
echo -e "  1. DO NOT forget to remove this script."
echo -e "\n###################################\n\n"

Script to run an the device acting as a SSH host.

#!/usr/bin/env bash

PROVISIONER_PASSWD=""
ROOTCA_PUBLIC_KEY=$(cat <<EOF
[paste content $(step path)/certs/root_ca.pub here]
EOF
)
USERCA_PUBLIC_KEY=[paste content $(step path)/certs/ssh_user_ca_key.pub here]


IP_ADDRESS=$(hostname -I | awk '{print $1}')
ROOTCA_FILE_PATH=/usr/local/share/ca-certificates/[your root_ca.pub].crt
STEPPATH=[redacted]
TMP_ERR_FILE="/tmp/error_install_step_script"

# COLOURS
RD=$(echo "\033[01;31m")
GN=$(echo "\033[1;92m")
CL=$(echo "\033[m")

function spinner () {
    pid="$!"
    i=1
    sp="\|/-"

    printf "$1 "
    while ps -p "${pid}" > /dev/null
    do
        printf "\b%c" "${sp:i++%4:1}"
        sleep 0.1
    done

    printf "\b\n${GN}✔${CL} $2\n"
}

function get_provisioner_passwd () {
    PROVISIONER_PASSWD=$(whiptail --passwordbox "What is the STEP CA key of the Provisioner 'main'?" 8 130 --title "SSH provisioner key" 3>&1 1>&2 2>&3)
                                                                                                  # A trick to swap stdout and stderr.
    exitstatus=$?
    if [ $exitstatus != 0 ]; then
        print_failure "User canceled script when asked for STEP CA provisioner key."
        PROVISIONER_PASSWD=""
    fi
}

function prepare_host () {
    # Only the edcsa type will be used, remove everything else.
    if (ls /etc/ssh/ | grep ssh_host_ed255* | wc -l) > 0; then
        rm /etc/ssh/ssh_host_ed255* 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    fi
    if (ls /etc/ssh/ | grep ssh_host_rs* | wc -l) > 0; then
        rm /etc/ssh/ssh_host_r* 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    fi
    print_success "Removed all SSH keys except the type Step CA will use."

    if ! grep -q "^step:" /etc/passwd; then
        useradd --user-group --system --home "${STEPPATH}" --shell /bin/false step 2>"${TMP_ERR_FILE}" && print_success "User 'step' created." || print_failure "$(<${TMP_ERR_FILE})"
    fi
}

function print_failure () {
    printf "\n${RD}X ERROR: $1${CL}\n\n";
    exit 1
}

function print_success () {
    printf "\r${GN}✔${CL} $1\n";
}

function root_ca_install () {
    echo "${ROOTCA_PUBLIC_KEY}" > "${ROOTCA_FILE_PATH}"
    update-ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Public key of CA copied and loaded in to trust store." || print_failure "$(<${TMP_ERR_FILE})"
}

function rotate_certificate () {
    cat <<EOF > /etc/cron.weekly/rotate-ssh-certificate
#!/bin/sh
export STEPPATH=${STEPPATH}
step ssh renew /etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key --ca-url https://certificated.myown.home --force --provisioner sshpop --root ${ROOTCA_FILE_PATH} 2> /dev/null
exit 0
EOF

    chown step:step /etc/cron.weekly/rotate-ssh-certificate
    chmod 755 /etc/cron.weekly/rotate-ssh-certificate
}

function ssh_configure () {
    # Update SSH (server) configuration & restart it.
    # sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config # Done by Ansible's init script
    sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
    sed -i 's/#HostbasedUathentication no/HostbasedUathentication no/g' /etc/ssh/sshd_config
    sed -i 's/#IgnoreUserKnownHosts no/IgnoreUserKnownHosts yes/g' /etc/ssh/sshd_config
    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
    echo -e "\n\n###\n# ADDED when installing Step CA\n###\nHostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub\n#The root SSH user public key used to verify SSH user certificates.\nTrustedUserCAKeys /etc/ssh/ssh_user_ca_key.pub" >> /etc/ssh/sshd_config
    systemctl restart ssh > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    systemctl is-enabled ssh.service > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    systemctl is-active ssh.service > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"

    # Update the CA user public key
    echo "${USERCA_PUBLIC_KEY}" > /etc/ssh/ssh_user_ca_key.pub

    # Create host certificate
    echo "${PROVISIONER_PASSWD}" > tmp-pass
    step ssh certificate "${HOSTNAME}".myown.home /etc/ssh/ssh_host_ecdsa_key.pub --ca-url https://certificated.myown.home --host --principal "${HOSTNAME}".myown.home --principal "${IP_ADDRESS}" --provisioner main --provisioner-password-file tmp-pass --root "${ROOTCA_FILE_PATH}" --sign > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    rm tmp-pass
}

function step_install () {
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get install -y --no-install-recommends curl gpg ca-certificates > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' | tee /etc/apt/sources.list.d/smallstep.list > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get update > /dev/null 2>"${TMP_ERR_FILE}" && : || print_failure "$(<${TMP_ERR_FILE})"
    apt-get -y install step-cli > /dev/null 2>"${TMP_ERR_FILE}" && print_success "Step CLI installed" || print_failure "$(<${TMP_ERR_FILE})"
}

###
# EXECUTE
###
get_provisioner_passwd

prepare_host & spinner "Preparing host..." "Host prepared."

step_install & spinner "Installing Step..." "Step is running."

root_ca_install & spinner "Installing ProvenOne's root CA to the trusted store..." "Installed root CA."

ssh_configure & spinner "Configuraring SSH to be used by Step CA..." "SSH configured."

rotate_certificate & spinner "Creating CRON job for certificate rotation..." "CRON job created for certificate rotation."

###
# CREATE REPORT
###
echo -e "\n###################################\n\n"
echo -e "Provisioned device (host) for clients to SSH into it."
echo -e "\n\n"
echo -e "Manual actions YOU need to do:\n\n"
echo -e "  1. DO NOT forget to remove this script."
echo -e "\n###################################\n\n"

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Following tutorial but in the end getting the 'regular' error message that the authenticity of host can't be established. #2373

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Following tutorial but in the end getting the 'regular' error message that the authenticity of host can't be established. #2373

Uh oh!

VinvarLaLece Aug 24, 2025

Replies: 1 comment

Uh oh!

VinvarLaLece Sep 17, 2025 Author

VinvarLaLece
Aug 24, 2025

VinvarLaLece
Sep 17, 2025
Author