34 lines
1.1 KiB
Bash
34 lines
1.1 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Konfiguration
|
|
CA_HOST="100.87.87.5" # Hostname oder IP der CA-VM
|
|
CA_USER="alf" # Nutzer auf CA-VM
|
|
CA_PORT=22 # Port SSH-Zugang CA
|
|
CA_TARGET=2222 # Port SSH-Zugang Ziel-VM
|
|
REMOTE_SIGN_SCRIPT="/home/alf/remote_sign.sh"
|
|
TARGET_HOST="100.87.87.80" # Zielsystem (Rechner 2)
|
|
SSH_USER="alf" # Ziel-Login-Benutzer
|
|
KEY_DIR="./temp_keys"
|
|
KEY_NAME="temp_user_key"
|
|
VALIDITY=300 # 5 Minuten
|
|
|
|
mkdir -p "$KEY_DIR"
|
|
cd "$KEY_DIR"
|
|
|
|
# 1. Temporären Key erzeugen
|
|
ssh-keygen -f "$KEY_NAME" -N "" -C "$SSH_USER@temp" > /dev/null
|
|
|
|
# 2. Public Key zur CA kopieren
|
|
scp -P "$CA_PORT" "${KEY_NAME}.pub" "${CA_USER}@${CA_HOST}:/tmp/"
|
|
|
|
# 3. Signaturprozess auf CA anstoßen
|
|
ssh -p "$CA_PORT" "${CA_USER}@${CA_HOST}" \
|
|
"$REMOTE_SIGN_SCRIPT /tmp/${KEY_NAME}.pub $SSH_USER $VALIDITY"
|
|
|
|
# 4. Zertifikat zurückholen
|
|
scp -P "$CA_PORT" "${CA_USER}@${CA_HOST}:/tmp/${KEY_NAME}-cert.pub" .
|
|
|
|
# 5. Verbindung aufbauen zum Zielsystem über alternativen Port
|
|
ssh -p "$CA_TARGET" -i "$KEY_NAME" "$SSH_USER@$TARGET_HOST"
|