An ssh-keygen wrapper for 1337NET, stream-lining access for committee members to containers running on the network. Run knzr --help for a step-by-step guide on how to use the program.

Only available for jumpbox-configured hosts on 1337NET. (At this time this is just Reeves.)

Configuration on jumpboxes

The files knzr and knzr-signer are placed on the /usr/local/bin. knzr is given the root:committee ownership and knzr-signer is given the root:root ownership. Both are also given chmod +x executable permissions.

An SSH Certificate Authority (CA) needs to be available on the jumpbox, the private key is required and the public key is not required (but nice for debugging). In our case, there exists a restricted directory under /etc/ssh/ca where the Nebuchadnezzar SSH CA files exist.

There also exists a sudoers file knzr-sudo matching the exact commands which need to be ran to access the restricted signing files and are included in the /etc/sudoers.d directory. This also means sudo is a dependency.

A configuration directory is required at /etc/knzr which contains a config.yaml which contains a general configuration of the program and targets.yaml which contains a list of hostnames which resolve to the /etc/hosts directory. This also means the /etc/hosts is the actual dictionary of hostname:IPs.