Add algo signer to support openssl as of recent

mikegreen · web-flow · commit e46313bb644c · 2021-08-25T15:02:23.000-06:00
"algorithm_signer": "rsa-sha2-256"
to prevent /var/log/auth.log `userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]` due to vault defaulting to ssh-rsa which is insecure
diff --git a/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx b/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx
@@ -106,6 +106,7 @@ team, or configuration management tooling.
     ```text
     $ vault write ssh-client-signer/roles/my-role -<<"EOH"
     {
+      "algorithm_signer": "rsa-sha2-256",
       "allow_user_certificates": true,
       "allowed_users": "*",
       "allowed_extensions": "permit-pty,permit-port-forwarding",

Original file line number	Diff line number	Diff line change
`@@ -106,6 +106,7 @@ team, or configuration management tooling.`
`106`	`106`	```text
`107`	`107`	`$ vault write ssh-client-signer/roles/my-role -<<"EOH"`
`108`	`108`	`{`
	`109`	`+ "algorithm_signer": "rsa-sha2-256",`
`109`	`110`	`"allow_user_certificates": true,`
`110`	`111`	`"allowed_users": "*",`
`111`	`112`	`"allowed_extensions": "permit-pty,permit-port-forwarding",`