ca.json malformed when initialising the CA with SSH capabilities

[basilhendroff]

I'm running step-ca in a FreeBSD jail.

Everything is OK if I initialise the CA step ca init and then run it as a daemon service step-ca start, Checking the process log:

root@smallstep:~ # cat /var/log/messages | grep step_ca
Dec  6 22:27:05 smallstep step_ca[1222]: badger 2021/12/06 22:27:05 INFO: All 0 tables opened in 0s
Dec  6 22:27:05 smallstep step_ca[1222]: 2021/12/06 22:27:05 Serving HTTPS on :443 ...

On the other hand, if I start afresh and include SSH support step ca init --ssh, starting the service fails. This is what I see in the process log:

root@smallstep:~ # cat /var/log/messages | grep step_ca
Dec  7 03:02:41 smallstep step_ca[12539]: error reading templates/ssh/include.tpl: stat /.step/templates/ssh/include.tpl: no such file or directory

Note the step path:

root@smallstep:~ # step path
/var/db/step_ca/ca

When I check /var/db/step_ca/ca/config/ca.json, I note that the step path hasn't been prefixed to the "template" paths.

        "templates": {
                "ssh": {
                        "user": [
                                {
                                        "name": "include.tpl",
                                        "type": "snippet",
                                        "template": "templates/ssh/include.tpl",
                                        "path": "~/.ssh/config",
                                        "comment": "#"
                                },
                                {
                                        "name": "config.tpl",
                                        "type": "file",
                                        "template": "templates/ssh/config.tpl",
                                        "path": "ssh/config",
                                        "comment": "#"
                                },
                                {
                                        "name": "known_hosts.tpl",
                                        "type": "file",
                                        "template": "templates/ssh/known_hosts.tpl",
                                        "path": "ssh/known_hosts",
                                        "comment": "#"
                                }
                        ],
                        "host": [
                                {
                                        "name": "sshd_config.tpl",
                                        "type": "snippet",
                                        "template": "templates/ssh/sshd_config.tpl",
                                        "path": "/etc/ssh/sshd_config",
                                        "comment": "#",
                                        "requires": [
                                                "Certificate",
                                                "Key"
                                        ]
                                },
                                {
                                        "name": "ca.tpl",
                                        "type": "snippet",
                                        "template": "templates/ssh/ca.tpl",
                                        "path": "/etc/ssh/ca.pub",
                                        "comment": "#"
                                }
                        ]
                }
        }

If I manually adjust the file, I can then start the step-ca service. Is this a known issue, or could this be an issue specific to the FreeBSD port?

root@smallstep:~ # step-ca version
Smallstep CA/0.17.2 (freebsd/amd64)
Release Date: 2021-12-06 19:39 UTC

[tashian]

Hi @basilhendroff, what is the output of step version?
We've made a lot of changes on the configuration side of things recently.
Could you try this with step and step-ca versions 0.18.0?

[maraino]

The missing prefix of step path in the templates is on purpose. If the paths are relative, they are relative to the step path (you can add a custom one with the STEPPATH environment variable). This is not yet supported by all paths in the ca.json.

[maraino]

Another thing to take into account is that starting with step 0.18.0 if contexts are in use, they are not enabled by default, STEPPATH and step path might not be the same.

With contexts enabled:

• STEPPATH is the base directory for step, defaults to ~/.step, and it can be obtained with step path --base
• step path is the base directory for the configured CA, and this can be for example ~/.step/authorities/my-ca

[basilhendroff]

Hi @tashian

what is the output of step version?

root@smallstep:~ # step version
Smallstep CLI/0.17.2 (freebsd/amd64)
Release Date: 2021-12-07 00:39 UTC

Could you try this with step and step-ca versions 0.18.0?

These haven't yet filtered down to the stable (quarterly) package repo https://www.freshports.org/security/step-certificates/, but I should be able to switch across to the most recent (latest) package branch. I'll make a point of doing that.

Hi @maraino

If the paths are relative, they are relative to the step path

I see.

you can add a custom one with the STEPPATH environment variable.

I had.

root@smallstep:~ # env | grep STEPPATH
STEPPATH=/var/db/step_ca/ca

This is not yet supported by all paths in the ca.json

So, a manual adjustment is required for the moment?

Another thing to take into account is that starting with step 0.18.0 if contexts are in use, they are not enabled by default, STEPPATH and step path might not be the same.

Thanks for the heads up!

[maraino]

Manual adjusting should not be necessary for those files in templates, it's supported there. But for example, it is not supported in fields like "root", "crt", "key" and others.