mirror of
https://github.com/trailofbits/algo.git
synced 2025-04-11 11:47:08 +02:00
c9352a1801
The ssh-key we generated used 2048 bits while even openssh's ssh-keygen defaults to 3072 nowadays [0].
While RSA-2048 is probably ok (?) and what NIST recommends for keys until around 2030, its probably better to switch to more bits.
This is also just a temporary solution as we should also switch to ed25519.
Thanks to Dan M (@dmur1 or dan@hexarcana.ch) for pointing this out.
[0] 19d3ee2f3a/ssh-keygen.c (L83)
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
---
|
|
- block:
|
|
- name: Display the invocation environment
|
|
shell: >
|
|
./algo-showenv.sh \
|
|
'algo_provider "{{ algo_provider }}"' \
|
|
{% if ipsec_enabled %}
|
|
'algo_ondemand_cellular "{{ algo_ondemand_cellular }}"' \
|
|
'algo_ondemand_wifi "{{ algo_ondemand_wifi }}"' \
|
|
'algo_ondemand_wifi_exclude "{{ algo_ondemand_wifi_exclude }}"' \
|
|
{% endif %}
|
|
'algo_dns_adblocking "{{ algo_dns_adblocking }}"' \
|
|
'algo_ssh_tunneling "{{ algo_ssh_tunneling }}"' \
|
|
'wireguard_enabled "{{ wireguard_enabled }}"' \
|
|
'dns_encryption "{{ dns_encryption }}"' \
|
|
> /dev/tty || true
|
|
tags: debug
|
|
|
|
- name: Install the requirements
|
|
pip:
|
|
state: present
|
|
name:
|
|
- pyOpenSSL>=0.15
|
|
- segno
|
|
tags:
|
|
- always
|
|
- skip_ansible_lint
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- block:
|
|
- name: Generate the SSH private key
|
|
openssl_privatekey:
|
|
path: "{{ SSH_keys.private }}"
|
|
size: 4096
|
|
mode: "0600"
|
|
type: RSA
|
|
|
|
- name: Generate the SSH public key
|
|
openssl_publickey:
|
|
path: "{{ SSH_keys.public }}"
|
|
privatekey_path: "{{ SSH_keys.private }}"
|
|
format: OpenSSH
|
|
|
|
- name: Copy the private SSH key to /tmp
|
|
copy:
|
|
src: "{{ SSH_keys.private }}"
|
|
dest: "{{ SSH_keys.private_tmp }}"
|
|
force: true
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
become: false
|
|
when: algo_provider != "local"
|