Skip to content
Muljax ID

Host Revocation (KRL) Sync

OpenSSH servers check incoming user certificates against a local Key Revocation List (KRL) configured via the RevokedKeys directive in /etc/ssh/sshd_config.

Muljax ID provides an automated endpoint that outputs standard binary OpenSSH Key Revocation Lists (PROTOCOL.krl) ready for direct consumption by sshd:

GET /api/ssh/ca/revoked-keys?format=krl

Alternatively, you can query ?format=raw for newline-delimited text specifications (serial: <id>) or JSON (default).

Deployment Options

Section titled “Deployment Options”

Run this complete setup block as root on your target server (replace https://api.example.com with your API domain):

Terminal window
# 1. Create systemd service
sudo tee /etc/systemd/system/ssh-revoked-keys.service > /dev/null << 'EOF'
[Unit]
Description=Sync OpenSSH Revoked Keys
After=network-online.target
Wants=network-online.target


[Service]
Type=oneshot
ExecStart=/bin/sh -c 'curl -fsSL "https://api.example.com/api/ssh/ca/revoked-keys?format=krl" -o /etc/ssh/revoked_keys.tmp && chmod 644 /etc/ssh/revoked_keys.tmp && mv /etc/ssh/revoked_keys.tmp /etc/ssh/revoked_keys'
EOF


# 2. Create systemd timer (runs every 15 minutes)
sudo tee /etc/systemd/system/ssh-revoked-keys.timer > /dev/null << 'EOF'
[Unit]
Description=Sync OpenSSH Revoked Keys Periodically


[Timer]
OnBootSec=1min
OnUnitActiveSec=15min
Persistent=true


[Install]
WantedBy=timers.target
EOF


# 3. Configure sshd and enable timer
sudo touch /etc/ssh/revoked_keys
grep -qxF 'RevokedKeys /etc/ssh/revoked_keys' /etc/ssh/sshd_config || echo 'RevokedKeys /etc/ssh/revoked_keys' | sudo tee -a /etc/ssh/sshd_config
sudo systemctl daemon-reload
sudo systemctl enable --now ssh-revoked-keys.timer
sudo systemctl reload sshd

Verifying the Host Setup

Section titled “Verifying the Host Setup”

  1. Check Timer Execution:

    Terminal window
    systemctl list-timers ssh-revoked-keys.timer

    Ensure the timer shows active triggers for future executions.

  2. Trigger Manual Synchronization:

    Terminal window
    sudo systemctl start ssh-revoked-keys.service

  3. Inspect Revoked Keys Content:

    Terminal window
    cat /etc/ssh/revoked_keys

  4. Verify Service Logs:

    Terminal window
    journalctl -u ssh-revoked-keys.service -n 50