nbeguier / cassh

SSH CA administration via CLI and GUI
https://medium.com/leboncoin-engineering-blog/cassh-ssh-key-signing-tool-39fd3b8e4de7
Apache License 2.0
73 stars 20 forks source link

Add a "signed" filed to the "cassh status" command #14

Closed xakraz closed 7 years ago

xakraz commented 7 years ago

Context

When you add a key, you can see explicitly that the status is Pending

$ cassh status
{
    "expiration": "1970-01-01 01:00:00 (UTC+0000)", 
    "realname": "Firstname Lastname", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "PENDING", 
    "username": "username"
}

After an admin "activate" a user, same result, we can clearly see the status:

 $ cassh status
Please type your LDAP password (user=Xavier Krantz): 
{
    "expiration": "1970-01-01 01:00:00 (UTC+0000)", 
    "realname": "Xavier Krantz", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "ACTIVE", 
    "username": "username"
}

However, currently there is no way to know if the key is signed ... Even if we can guess it, since we have an expiration date that is defined in the future:

$ cassh status
{
    "expiration": "2017-08-26 11:29:19 (UTC+0000)", 
    "realname": "Firstname Lastname", 
    "ssh_key_hash": "2048 e8:00:ed:f3:ae:8c:d1:65:e6:3b:48:8f:d5:84:fd:f5 ", 
    "status": "ACTIVE", 
    "username": "username"
}

Feature Request:

It could be nice to have an explicit field for quick understanding, especially for users who are not very familiar with CLI and ssh practices. Maybe a new field or update the status filed to SIGNED ?

nbeguier commented 7 years ago

Good idea, I'll add two more status : SIGNED and EXPIRED

nbeguier commented 7 years ago

{ "expiration": "2017-08-26 11:51:58", "realname": "Nicolas Beguier", "ssh_key_hash": "2048 7b:5f:73:66:68:5f:73:fe:09:a7:5c:3e:72:xx:d1:97 ", "status": "SIGNED", "username": "username" }