Multiple step ssh user profiles

[tashian]

Copying this question from @Church- here for posterity:

A question since you're here. I happen to use SmallStep at work. Is there a way to manage multiple profiles/CA's easily? Bit of a pain switching between my home and work setup. Don't suppose it's as easy as step ssh login foo for work and step ssh login bar for home?

[tashian]

Sort of yes! You can use STEPPATH to set the location of the step config folder, which defaults to $HOME/.step. The caveat is, our SSH configuration shim doesn't handle multiple profiles well, so if you want to use step ssh config to enable for seamless SSO, you will need to change each Included SSH config file (located in $STEPPATH/ssh/config) to add the relevant STEPPATH. For example:

Match exec "bash -c 'STEPPATH=$HOME/.step-homelab step ssh check-host %h'"
        UserKnownHostsFile "/Users/carl/.step/ssh/known_hosts"
        ProxyCommand bash -c 'STEPPATH=$HOME/.step-homelab step ssh proxycommand --provisioner "okta" %r %h %p'

I've opened an issue about this here.

[maraino]

One of the tricks that I use for ssh is to create an alias for ssh that uses $STEPPATH/ssh/config as the ssh client configuration.

alias sssh='ssh -F $(step path)/ssh/config'

The workflow to use a second profile is like:

export STEPPATH=~/step/profile2
sssh my.host.profile2

With my alias STEPPATH=~/step/profile2 sssh my.host.profile2 won't work, because $(step path) will be using the global STEPPATH instead of the you you passed. But a script instead of an alias can be used to allow that.

[tashian]

Ahh good call, that makes sense to send STEPPATH to ssh instead of hardcoding it :D
Going to close my issue then.

[dopey]

We're looping this into a larger project around multiple profiles (not just SSH). Not sure when that's going to happen, but in the mean time are these workarounds sufficient for people's use cases? Please let us know :)