> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/nitride/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/nitride/tutorials/outdated-provisioning-ssh-keys.md).

# OUTDATED Provisioning SSH keys

In this tutorial, we'll generate SSH secrets that we'll use to connect to our Azure VM via SSH.

## Create a template

The first step will be to create a template for VM. You can refer to the ["Create a Buckypaper VMs template"](https://docs.enclaive.cloud/nitride/tutorials/use-cases/create-a-buckypaper-vm-template.) tutorial for a better understanding of how to do this.

## Create a namespace

The second step will be to create a namespace. This is a mandatory requirement for creating attestation. You can learn how to create and use namespaces in the [documentation](https://docs.enclaive.cloud/vault/tutorials/use-cases/namespaces).

## Create dkv-v2 engines

The third step is to create two engines. The first is called "vm-auth", where we'll store the SSH secrets. The second engine is called "buckypaper", where we will store the description key.

{% tabs %}
{% tab title="VM Auth" %} <mark style="color:green;">`POST`</mark> `http://localhost:8200/v1/sys/mounts/vm-auth`

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Body**

<table><thead><tr><th width="256">Name</th><th>Type</th><th>Value</th></tr></thead><tbody><tr><td><code>type</code></td><td>string</td><td>dkv-v2</td></tr></tbody></table>

**Response**

```
204 No Content
```

{% endtab %}

{% tab title="Buckypaper" %} <mark style="color:green;">`POST`</mark> `http://localhost:8200/v1/sys/mounts/buckypaper`

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Body**

<table><thead><tr><th width="219">Name</th><th>Type</th><th>Value</th></tr></thead><tbody><tr><td><code>type</code></td><td>string</td><td>dkv-v2</td></tr></tbody></table>

**Response**

```
204 No Content
```

{% endtab %}
{% endtabs %}

## Generate SSH secrets

At this stage, we need to generate SSH secrets. SSH KEY - generation of private and public key. SSH PW - password generation.

{% tabs %}
{% tab title="Azure" %}
{% tabs %}
{% tab title="SSH KEY" %} <mark style="color:green;">`GET`</mark> `http://localhost:8200/v1/vm-auth/data/:user/ssh-key/:name`

We have generated the secrets for the **azure** user, which will be stored under the name "**azureuser**".

**Params**

<table><thead><tr><th width="258">Name</th><th>Type</th><th>Value</th></tr></thead><tbody><tr><td>user</td><td>string</td><td>azure</td></tr><tr><td>name</td><td>string</td><td><code>azureuser</code></td></tr></tbody></table>

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Response**

```json
{
    "request_id": "729ee29d-ddf5-58a7-ffe5-8bd61d2b9b46",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "data": {
            "private": "LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0egpjMmd0WldReU5UVXhPUUFBQUNDd0pDTDdaZmlkanpxUW9EN1BmcXYwbHBpWTFJbTJ3akphbVpKdEFlZUQxUUFBCkFJaW1NYnN4cGpHN01RQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDQ3dKQ0w3WmZpZGp6cVFvRDdQZnF2MGxwaVkKMUltMndqSmFtWkp0QWVlRDFRQUFBRUN4S3dRNTNFWGN0UGdlUjA1WnRWNmNMcStRSDZBclYrNmw4TmsvMFZhYwpTYkFrSXZ0bCtKMlBPcENnUHM5K3EvU1dtSmpVaWJiQ01scVprbTBCNTRQVkFBQUFBQUVDQXdRRgotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K",
            "public": "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUxBa0l2dGwrSjJQT3BDZ1BzOStxL1NXbUpqVWliYkNNbHFaa20wQjU0UFYK"
        },
        "metadata": {
            "created_time": "2024-04-22T07:40:18.023159651Z",
            "custom_metadata": null,
            "deletion_time": "",
            "destroyed": false,
            "version": 1
        }
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null
}
```

{% endtab %}

{% tab title="SSH PW" %} <mark style="color:green;">`GET`</mark> `http://localhost:8200/v1/vm-auth/data/:user/ssh-pw/:name`

We have generated the secrets for the **azure** user, which will be stored under the name "**azureuser**".

**Params**

| Name | Type   | Value       |
| ---- | ------ | ----------- |
| user | string | azure       |
| name | string | `azureuser` |

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Response**

```json
{
    "request_id": "0c47dfbe-b2b7-a764-bd6c-ef8007ed1827",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "data": {
            "value": "H36VDP5D335PJIXNMHSBULJOSJUPZIHVJAIRLFJTTZAAWU3FWTJQ"
        },
        "metadata": {
            "created_time": "2024-04-22T07:47:08.024377569Z",
            "custom_metadata": null,
            "deletion_time": "",
            "destroyed": false,
            "version": 1
        }
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null
}
```

{% endtab %}
{% endtabs %}
{% endtab %}

{% tab title="AWS" %}
{% tabs %}
{% tab title="SSH KEY" %} <mark style="color:green;">`GET`</mark> `http://localhost:8200/v1/vm-auth/data/:user/ssh-key/:name`

We have generated the secrets for the **azure** user, which will be stored under the name "**azureuser**".

**Params**

<table><thead><tr><th width="258">Name</th><th>Type</th><th>Value</th></tr></thead><tbody><tr><td>user</td><td>string</td><td>aws</td></tr><tr><td>name</td><td>string</td><td><code>ec2-user</code></td></tr></tbody></table>

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Response**

```json
{
    "request_id": "729ee29d-ddf5-58a7-ffe5-8bd61d2b9b46",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "data": {
            "private": "LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0egpjMmd0WldReU5UVXhPUUFBQUNDd0pDTDdaZmlkanpxUW9EN1BmcXYwbHBpWTFJbTJ3akphbVpKdEFlZUQxUUFBCkFJaW1NYnN4cGpHN01RQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDQ3dKQ0w3WmZpZGp6cVFvRDdQZnF2MGxwaVkKMUltMndqSmFtWkp0QWVlRDFRQUFBRUN4S3dRNTNFWGN0UGdlUjA1WnRWNmNMcStRSDZBclYrNmw4TmsvMFZhYwpTYkFrSXZ0bCtKMlBPcENnUHM5K3EvU1dtSmpVaWJiQ01scVprbTBCNTRQVkFBQUFBQUVDQXdRRgotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K",
            "public": "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUxBa0l2dGwrSjJQT3BDZ1BzOStxL1NXbUpqVWliYkNNbHFaa20wQjU0UFYK"
        },
        "metadata": {
            "created_time": "2024-04-22T07:40:18.023159651Z",
            "custom_metadata": null,
            "deletion_time": "",
            "destroyed": false,
            "version": 1
        }
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null
}
```

{% endtab %}

{% tab title="SSH PW" %} <mark style="color:green;">`GET`</mark> `http://localhost:8200/v1/vm-auth/data/:user/ssh-pw/:name`

We have generated the secrets for the **azure** user, which will be stored under the name "**azureuser**".

**Params**

| Name | Type   | Value      |
| ---- | ------ | ---------- |
| user | string | aws        |
| name | string | `ec2-user` |

**Headers**

| Name              | Value                                                                                   |
| ----------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token     | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |
| X-Vault-Namespace | `education`                                                                             |

**Response**

```json
{
    "request_id": "0c47dfbe-b2b7-a764-bd6c-ef8007ed1827",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "data": {
            "value": "H36VDP5D335PJIXNMHSBULJOSJUPZIHVJAIRLFJTTZAAWU3FWTJQ"
        },
        "metadata": {
            "created_time": "2024-04-22T07:47:08.024377569Z",
            "custom_metadata": null,
            "deletion_time": "",
            "destroyed": false,
            "version": 1
        }
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null
}
```

{% endtab %}
{% endtabs %}
{% endtab %}
{% endtabs %}

## Register new workload

<mark style="color:green;">`POST`</mark> `http://localhost:8200/v1/auth/ratls/attestation/create`

For more detailed information on creating attestation, you can refer to the [documentation](https://docs.enclaive.cloud/nitride/developers/api/attestation#register-new-workload).

**Body**

<table><thead><tr><th width="164">Name</th><th width="152">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>template</code></td><td>string</td><td>f05d8808-547a-4e9a-9843-07c3f55b7e67</td></tr><tr><td><code>namespace</code></td><td>string</td><td>education</td></tr><tr><td><code>webhook</code></td><td>string</td><td>http://localhost:3000/webhook</td></tr></tbody></table>

**Headers**

| Name          | Value                                                                                   |
| ------------- | --------------------------------------------------------------------------------------- |
| X-Vault-Token | [\<token>](https://docs.enclaive.cloud/vault/api/auth-methods/jwt-oidc-auth-method-api) |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
    "request_id": "0bde6eee-f55b-e9a5-e1ba-7a382c6a0d50",
    "lease_id": "",
    "renewable": false,
    "lease_duration": 0,
    "data": {
        "instance": "77255d88-754c-42a3-954f-58fb86bf48a5"
    },
    "wrap_info": null,
    "warnings": null,
    "auth": null
}
```

{% endtab %}
{% endtabs %}

## Create a VM

{% tabs %}
{% tab title="Azure" %}
At this stage, we will create an Azure VM from the DC2as\_v5 family with the Ubuntu 20\_04-lts-cvm operating system version, as it supports confidential VMs.

When creating the VM, you should also include cloud-init. The configuration for cloud-init is shown below.

<table><thead><tr><th width="237">ENV</th><th width="237">Description</th><th>Value</th></tr></thead><tbody><tr><td>ENCLAIVE_PROTOCOL</td><td></td><td>sev-snp</td></tr><tr><td>ENCLAIVE_SOURCE</td><td>The provider name that we specified during the measurement creation.</td><td>azure</td></tr><tr><td>ENCALIVE_INSTANCE</td><td>The "instance" field that we obtained during the attestation creation.</td><td>77255d88-754c-42a3-954f-58fb86bf48a5</td></tr><tr><td>ENCALIVE_RESOURCE</td><td>Virtual machine name</td><td>azure-vm</td></tr><tr><td>ENCALIVE_NITRIDE</td><td>Nitride URL</td><td>http://localhost:8200</td></tr><tr><td>ENCALIVE_KEYSTORE</td><td>Vault URL</td><td>http://localhost:8200</td></tr><tr><td>ENCLAIVE_FEATURES</td><td>The path from which secrets are added to the VM for a particular user.</td><td>method:user:secret:name</td></tr></tbody></table>

In the ENCLAVE\_FEATURES variable, "method" can be either "ssh-key" or "ssh-pw", "user" is the scope in which the secrets are stored, "secret" is the name under which we store the secret, and "name" is the username to which the keys are added. We need to set which method for SSH connection will be added for the user.

{% tabs %}
{% tab title="SSH KEY" %}

```
ENCLAIVE_FEATURES=ssh-key:azure:azureuser:root
```

{% endtab %}

{% tab title="SSH PW" %}

```
ENCLAIVE_FEATURES=ssh-pw:azure:azureuser:root
```

{% endtab %}
{% endtabs %}

```
#cloud-config
runcmd:
  - |
    set -eu

    export ENCLAIVE_PROTOCOL=sev-snp
    export ENCLAIVE_SOURCE=azure
    export ENCLAIVE_INSTANCE=77255d88-754c-42a3-954f-58fb86bf48a5
    export ENCLAIVE_RESOURCE=azure-vm
    export ENCLAIVE_NITRIDE=http://localhost:8200
    export ENCLAIVE_KEYSTORE=http://localhost:8200
    export ENCLAIVE_FEATURES=ssh-pw:azure:azureuser:root
    
    if [ -x "$(command -v curl)" ];then
      COMMAND="wget -q -O"
    elif [ -v "$(command -v wget)" ];then
      COMMAND="curl -s -o"
    else
      echo "Not installed: curl|wget"
      exit 1
    fi
    
    $COMMAND client "$ENCLAIVE_NITRIDE/static/enclaivelet"
    $COMMAND provision "$ENCLAIVE_NITRIDE/static/provision"
    
    chmod +x client provision
    ./client

    echo 'PermitRootLogin yes' | sudo tee -a /etc/ssh/sshd_config
    sudo systemctl restart sshd
```

{% endtab %}

{% tab title="AWS" %}
At this stage, we will create an AWS EC2 from the M6a family with the Ubuntu 23.04 operating system version, as it supports confidential VMs.

When creating the VM, you should also include cloud-init. The configuration for cloud-init is shown below.

<table><thead><tr><th width="237">ENV</th><th width="237">Description</th><th>Value</th></tr></thead><tbody><tr><td>ENCLAIVE_PROTOCOL</td><td></td><td>sev-snp</td></tr><tr><td>ENCLAIVE_SOURCE</td><td>The provider name that we specified during the measurement creation.</td><td>aws</td></tr><tr><td>ENCALIVE_INSTANCE</td><td>The "instance" field that we obtained during the attestation creation.</td><td>77255d88-754c-42a3-954f-58fb86bf48a5</td></tr><tr><td>ENCALIVE_RESOURCE</td><td>Virtual machine name</td><td>aws-vm</td></tr><tr><td>ENCALIVE_NITRIDE</td><td>Nitride URL</td><td>http://localhost:8200</td></tr><tr><td>ENCALIVE_KEYSTORE</td><td>Vault URL</td><td>http://localhost:8200</td></tr><tr><td>ENCLAIVE_FEATURES</td><td>The path from which secrets are added to the VM for a particular user.</td><td>method:user:secret:name</td></tr></tbody></table>

In the ENCLAVE\_FEATURES variable, "method" can be either "ssh-key" or "ssh-pw", "user" is the scope in which the secrets are stored, "secret" is the name under which we store the secret, and "name" is the username to which the keys are added. We need to set which method for SSH connection will be added for the user.

{% tabs %}
{% tab title="SSH KEY" %}

```
ENCLAIVE_FEATURES=ssh-key:aws:ec2-user:root
```

{% endtab %}

{% tab title="SSH PW" %}

```
ENCLAIVE_FEATURES=ssh-pw:aws:ec2-user:root
```

{% endtab %}
{% endtabs %}

```
#cloud-config
runcmd:
  - |
    set -eu

    export ENCLAIVE_PROTOCOL=sev-snp
    export ENCLAIVE_SOURCE=aws
    export ENCLAIVE_INSTANCE=77255d88-754c-42a3-954f-58fb86bf48a5
    export ENCLAIVE_RESOURCE=aws-vm
    export ENCLAIVE_NITRIDE=http://localhost:8200
    export ENCLAIVE_KEYSTORE=http://localhost:8200
    export ENCLAIVE_FEATURES=ssh-pw:aws:ec2-user:root
    
    sudo apt-get update -y
    sudo apt-get install -y linux-modules-extra-$(uname -r)
    sudo modprobe sev-guest
    
    if [ -x "$(command -v curl)" ];then
      COMMAND="wget -q -O"
    elif [ -v "$(command -v wget)" ];then
      COMMAND="curl -s -o"
    else
      echo "Not installed: curl|wget"
      exit 1
    fi
    
    $COMMAND client "$ENCLAIVE_NITRIDE/static/enclaivelet"
    $COMMAND provision "$ENCLAIVE_NITRIDE/static/provision"
    
    chmod +x client provision
    ./client

    echo 'PermitRootLogin yes' | sudo tee -a /etc/ssh/sshd_config
    sudo systemctl restart sshd
```

{% endtab %}
{% endtabs %}

Once all the steps have been completed, the result of the attestation will be sent to the webhook you specified when creating the attestation. Below is an example of what is sent to the webhook. Ensure that the **webhook** accepts the **HTTP POST** method.

```json
{
  "Success": true,
  "Message": "success",
  "Instance": "77255d88-754c-42a3-954f-58fb86bf48a5",
  "Resource": "name",
  "Quote": "eyJWZXJzaWlE9PSJ9fQ=="
}
```

After receiving the attestation result via **webhook**, we can connect to the VM using the secrets we created earlier.

{% tabs %}
{% tab title="SSH KEY" %}

```
ssh -i <PATH TO SSH KEY> root@<IP ADDRESS>
```

{% endtab %}

{% tab title="SSH PW" %}

```
ssh root@<IP ADDRESS>
```

{% endtab %}
{% endtabs %}