This is a fork of execd by progrium. This version of execd is far different, but for posterity the original readme is included below.
- Authentication over etcd
- Keys go in
/flitter/builder/users/$USERNAME/$FINGERPRINT-> b64 encoded key
- Keys go in
- Only allow git pushes to be made
- Command line flag for etcd endpoint added
Usage is identical to stock
execd except the
auth-handler is removed.
A very lightweight SSH server frontend written in Go. The backend auth and execution logic is handled by commands you specify, letting you customize its behavior via your own scripts/executables.
Usage: ./execd [options] <auth-handler> <exec-handler> -d=false: debug mode displays handler output -e=false: pass environment to handlers -k="": pem file of private keys (read from SSH_PRIVATE_KEYS by default) -p="22": port to listen on -s=false: run exec handler via SHELL
auth-handler $user $key
$userargument is the name of the user being used to attempt the connection
$keyargument is the public key data being provided for authentication
auth-handler is the path to an executable that's used for authenticating
incoming SSH connections. If it returns with exit status 0, the connection will
be allowed, otherwise it will be denied. The output of auth-handler must be
empty, or key-value pairs in the form
KEY=value separated by newlines, which
will be added to the environment of exec-handler.
Although auth-handler is required, you can still achieve no-auth open access by
/usr/bin/true as auth-handler.
$command...arguments is the command line that was specified to run by the SSH client
exec-handler is the path to an executable that's used to execute the command
provided by the client. The meaning of that is quite flexible. All of the
stdout and stderr is returned to the client, including the exit status. If the
client provides stdin, that's passed to the exec-handler. Any environment
variables provided by the auth-handler output will be available to
exec-handler, as well as
Credit / History
It started with gitreceive, which was then used in Dokku. Then I made a more generalized version of gitreceive, more similar to execd, called sshcommand, which eventually replaced gitreceive in Dokku. When I started work on Flynn, the first projects included gitreceived (a standalone daemon version of gitreceive). This was refined by the Flynn community, namely Jonathan Rudenberg.
Eventually I came to realize gitreceived could be generalized / simplified further in a way that could be used with the original gitreceive, and replace sshcommand, and be used in Dokku, and potentially replace gitreceived in Flynn. This project takes learnings from all those projects, though mostly gitreceived.
This project was made possible thanks to DigitalOcean.
Command execd is a simple SSH server that allows a user to run single commands on a remote server, suitable for things like git deploys. This is a fork of execd by progrium. This version of execd is far different.
Usage: ./execd [options] <exec-handler> -debug=false: debug mode displays handler output -env-pass=false: pass environment to handlers -etcd-node="http://127.0.0.1:4001": etcd node to connect to -key="": pem file of private keys (read from SSH_PRIVATE_KEYS by default) -port="22": port to listen on
It is not suggested you run this outside of flitter as-is unless you know what you are doing.
- Authentication over etcd - Keys go in `/flitter/builder/users/$USERNAME/$FINGERPRINT` -> b64 encoded key - Only allow git pushes to be made - Command line flag for etcd endpoint added - Remove `auth-handler`