From 284f228d1009ccad3c7b38b5c2377cb463fd9346 Mon Sep 17 00:00:00 2001
From: darkclip <darkclip@hanv.dev>
Date: Sat, 3 Jan 2026 06:01:43 +0800
Subject: [PATCH] update

---
 assets/ssh-ca.pub |   1 +
 assets/ssh-krl    | Bin 0 -> 44 bytes
 configure.sh      |   4 ++++
 3 files changed, 5 insertions(+)
 create mode 100644 assets/ssh-ca.pub
 create mode 100644 assets/ssh-krl

diff --git a/assets/ssh-ca.pub b/assets/ssh-ca.pub
new file mode 100644
index 0000000..40806fa
--- /dev/null
+++ b/assets/ssh-ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXEk6EKWoWsxVDX2sf13N7zSdvz+7NMZIFTUjt1gcG1 TINK
diff --git a/assets/ssh-krl b/assets/ssh-krl
new file mode 100644
index 0000000000000000000000000000000000000000..7f5f45b39af20a476b01c5e94bc66c0c09c2fb08
GIT binary patch
literal 44
ccmWFz_V5n!;bH&+Mi2o5nGv=HFgA<^0BEZNQ2+n{

literal 0
HcmV?d00001

diff --git a/configure.sh b/configure.sh
index 313e12c..1dcea71 100755
--- a/configure.sh
+++ b/configure.sh
@@ -14,7 +14,11 @@ configure(){
     echo -e "APT::Install-Recommends "0";
 APT::Install-Suggests "0";" | tee /etc/apt/apt.conf.d/01norecommend >/dev/null
 
+    cp "$AWD/assets/ssh-ca.pub" /etc/ssh
+    cp "$AWD/assets/ssh-krl" /etc/ssh
     sed -i "s/.*PermitRootLogin.*/PermitRootLogin prohibit-password/g" /etc/ssh/sshd_config || true
+    sed -i "s/.*TrustedUserCAKeys.*/TrustedUserCAKeys /etc/ssh/ssh-ca.pub/g" /etc/ssh/sshd_config || true
+    sed -i "s/.*RevokedKeys.*/RevokedKeys /etc/ssh/ssh-krl/g" /etc/ssh/sshd_config || true
     sed -i "s/.*Host \*.*/Host \*/g" /etc/ssh/ssh_config
     sed -i "/.*HashKnownHosts.*/d" /etc/ssh/ssh_config
     sed -i "/.*HostKeyAlgorithms.*/d" /etc/ssh/ssh_config