obelisk/rustica

An SSHCA that uses a standard Yubikey to issue new host and user certificates.

Rust developer 🦀 but lots of previous Go (goquery) and C++ (osquery) work.

Currently: 🛠️ing things that should exist under permissive licences for everyone to use.

Useful Projects

Rustica 🦀 🔐

Scale hardware SSH keys for access and code signing across your infrastructure and developers. Cryptographically guarantee hardware backed and hypershort lived certificates that never need revocation.

Exhibit ✨📱✨

Give interactive presentations without giving external services access to your slide data. Major updates coming soon.

Plaid ⏱️ 🚀

Go fast writing automations in Rust. Write rules, compile to WASM, execute at the speed of logs.

Useful Libraries

Endpoint Security Rust Bindings 🛡️

Build your own memory safe endpoint security product for macOS (and eventually maybe other *OS platforms 🤔). Helpful abstractions over many events ES provides with it being easy to add more.

sshcerts 🔐 🔑

Very functional SSH certificates and keys library built in Rust. Even handles generation and validation of SSH hardware key attestation data for FIDO devices.

rustica's Issues

Use $HOME/.config/rusticaagent for configuration

It would be nice to use XDG base directories for configuration files to keep config files all in one place.

To fully respect the config home, I believe it would default to $HOME/.config/rusticaagent or if XDG_CONFIG_HOME is set it would use $XDG_CONFIG_HOME/rusticaagent. For backward compatibility, falling back to $HOME/.rusticaagent would be a good idea.

README is outdated

Should be updated after #5 since that changed how the system is configured and deployed.

Influx Lag Blocks Certificate Issuance

When using Influx logging, if influx stops responding, the web request must timeout before the certificate is passed to the client.

This should be happening in another thread.