n0mad1k/bigbrother
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate per-device SSH keypair instead of copying operator keys

Browse Source 
Each device gets a unique ed25519 keypair generated at preconfig time.
Private key goes to Infisical (bigbrother/SSH_PRIVKEY_<ID>), public key
to the SD card only. No operator keys or identifying comments on device.
This commit is contained in:
Cobra
2026-04-07 13:42:45 -04:00
parent 77aac72d31
commit e1f937f42c
2 changed files with 49 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy.sh
+1 -7
View File
@@ -75,13 +75,7 @@ if [[ $SETUP_EXIT -ne 0 ]]; then
exit $SETUP_EXIT
fi
# ── 4. Strip key comments from authorized_keys ───────────────────────────────
step "Stripping SSH key comments (OPSEC)..."
ssh -o StrictHostKeyChecking=no "$TARGET" \
"awk '{print \$1, \$2}' /root/.ssh/authorized_keys > /tmp/.ak_clean && mv /tmp/.ak_clean /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys" 2>/dev/null || true
info "Key comments stripped"
# ── 5. Final status ──────────────────────────────────────────────────────────
# ── 4. Final status ──────────────────────────────────────────────────────────
echo ""
step "Deployment status"
ssh -o StrictHostKeyChecking=no "$TARGET" \