OpenSSH user certificates: short-lived access and revocation in a loopback lab

Run on the authorized diagnostic host or disposable lab VM. Compare the installed OS and required packages below with the selected path. Obtain missing tools from the distribution’s enabled official repositories through your approved package-management process; this workflow does not reinstall an existing server or switch its repository.

Ubuntu 26.10 is the reviewed default, with 26.04 LTS and 24.04 LTS alternatives. Check the actual package build and local configuration rather than assuming identical versions.

The client package is openssh-client. The normal ssh (sometimes ssh.socket) service is inspected only; this lab does not start/restart/reload it. Use an existing valid authorized non-root account. The Red Hat-family path generates RSA3072 lab keys because Ed25519 is unavailable in FIPS mode; this is not a claim of FIPS certification.

If the packaged privilege-separation prerequisite is missing, complete the native package setup on the disposable VM before this lab. Do not work around a missing /run/sshd by weakening privilege separation or changing the administration daemon.

cat /etc/os-release
dpkg-query -W openssh-server openssh-client iproute2
command -v ssh ssh-keygen ss
systemctl show ssh.service -p ActiveState -p FragmentPath
sudo test -x /usr/sbin/sshd
sudo test -d /run/sshd

Use a disposable VM with the OpenSSH server already installed and a known unlocked non-root lab account labuser. Keep your normal administration session open. A missing account, locked account or occupied port is a stop condition. The sample does not create/unlock accounts or alter PAM policy. Verify the chosen path is new and not a symlink, mount or application data directory.

date -u +'%Y-%m-%dT%H:%M:%SZ'
ssh -V
getent passwd 'labuser'
test "$(id -u 'labuser')" -ne 0 || exit 1
sudo ss -lntp 'sport = :22222'
sudo test ! -e '/var/lib/academy-ssh-cert-lab' || exit 1
sudo mkdir -m 0700 -- '/var/lib/academy-ssh-cert-lab'

Run on the lab VM. CA and user-key commands prompt interactively for passphrases; enter them only in the terminal, never the public-value form or a command argument. The separate unattended host key has an empty passphrase because sshd needs it, but remains inside the root-only lab directory. Do not reuse production keys. File prompts must never overwrite an existing key.

sudo ssh-keygen -t ed25519 -f '/var/lib/academy-ssh-cert-lab/user-ca' -C academy-lab-ca
sudo ssh-keygen -t ed25519 -f '/var/lib/academy-ssh-cert-lab/client' -C academy-lab-user
sudo ssh-keygen -t ed25519 -N '' -f '/var/lib/academy-ssh-cert-lab/host' -C academy-lab-host
sudo ssh-keygen -lf '/var/lib/academy-ssh-cert-lab/user-ca.pub'
sudo ssh-keygen -lf '/var/lib/academy-ssh-cert-lab/host.pub'

The privileged daemon reads a root-owned principals file for the selected account. It must contain exactly the allowed principal, not a wildcard. Initially the separate RevokedKeys file is an empty readable text file; later it will be atomically replaced by a KRL. An unreadable RevokedKeys file can fail all public-key authentication, so readability is a security and availability requirement.

AuthorizedPrincipalsFile may be opened after switching to the target account. Give the root-owned parent traverse-only access0711 and public principals0644 under0755; keep every private key root-owned0600. This exposes only known public paths, not directory listing or private keys, and prevents a false login failure caused by the initial0700 lab root.

sudo chmod 0600 '/var/lib/academy-ssh-cert-lab/user-ca' '/var/lib/academy-ssh-cert-lab/client' '/var/lib/academy-ssh-cert-lab/host'
sudo chmod 0711 '/var/lib/academy-ssh-cert-lab'
sudo install -d -m 0755 '/var/lib/academy-ssh-cert-lab/principals'
printf '%s\n' 'academy-operator' | sudo tee '/var/lib/academy-ssh-cert-lab/principals/labuser' >/dev/null
sudo chmod 0644 '/var/lib/academy-ssh-cert-lab/principals/labuser'
sudo install -m 0644 /dev/null '/var/lib/academy-ssh-cert-lab/revoked'
sudoedit '/var/lib/academy-ssh-cert-lab/sshd_config'