Documentation ¶
Index ¶
- Constants
- Variables
- func ErrIsDisconnectedByUser(err error) bool
- func FingerprintLegacyMD5(pubKey PublicKey) string
- func FingerprintSHA256(pubKey PublicKey) string
- func Marshal(msg interface{}) []byte
- func MarshalAuthorizedKey(key PublicKey) []byte
- func ParseDSAPrivateKey(der []byte) (*dsa.PrivateKey, error)
- func ParseRawPrivateKey(pemBytes []byte) (interface{}, error)
- func ParseRawPrivateKeyWithPassphrase(pemBytes, passphrase []byte) (interface{}, error)
- func TrickTransportPacketCopy(a, b *TrickTransport) error
- func Unmarshal(data []byte, out interface{}) error
- type AlgorithmSigner
- type AuthMethod
- func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod
- func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod
- func Password(secret string) AuthMethod
- func PasswordCallback(prompt func() (secret string, err error)) AuthMethod
- func PublicKeys(signers ...Signer) AuthMethod
- func PublicKeysCallback(getSigners func() (signers []Signer, err error)) AuthMethod
- func RetryableAuthMethod(auth AuthMethod, maxTries int) AuthMethod
- type BannerCallback
- type CertChecker
- type Certificate
- type ClientConfig
- type Config
- type ConnMetadata
- type CryptoPublicKey
- type GSSAPIClient
- type GSSAPIServer
- type GSSAPIWithMICConfig
- type HostKeyCallback
- type KeyboardInteractiveChallenge
- type PassphraseMissingError
- type Permissions
- type PublicKey
- func NewPublicKey(key interface{}) (PublicKey, error)
- func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []string, rest []byte, err error)
- func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey, comment string, rest []byte, ...)
- func ParsePublicKey(in []byte) (out PublicKey, err error)
- type RejectionReason
- type ServerAuthError
- type ServerConfig
- type Signature
- type Signer
- func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
- func NewSignerFromKey(key interface{}) (Signer, error)
- func NewSignerFromSigner(signer crypto.Signer) (Signer, error)
- func ParsePrivateKey(pemBytes []byte) (Signer, error)
- func ParsePrivateKeyWithPassphrase(pemBytes, passphrase []byte) (Signer, error)
- type TrickTransport
Constants ¶
const ( CertAlgoRSAv01 = "ssh-rsa-cert-v01@openssh.com" CertAlgoDSAv01 = "ssh-dss-cert-v01@openssh.com" CertAlgoECDSA256v01 = "ecdsa-sha2-nistp256-cert-v01@openssh.com" CertAlgoECDSA384v01 = "ecdsa-sha2-nistp384-cert-v01@openssh.com" CertAlgoECDSA521v01 = "ecdsa-sha2-nistp521-cert-v01@openssh.com" CertAlgoSKECDSA256v01 = "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" CertAlgoED25519v01 = "ssh-ed25519-cert-v01@openssh.com" CertAlgoSKED25519v01 = "sk-ssh-ed25519-cert-v01@openssh.com" // CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a // Certificate.Type (or PublicKey.Type), but only in // ClientConfig.HostKeyAlgorithms. CertAlgoRSASHA256v01 = "rsa-sha2-256-cert-v01@openssh.com" CertAlgoRSASHA512v01 = "rsa-sha2-512-cert-v01@openssh.com" )
Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms. Unlike key algorithm names, these are not passed to AlgorithmSigner and don't appear in the Signature.Format field.
const ( // Deprecated: use CertAlgoRSAv01. CertSigAlgoRSAv01 = CertAlgoRSAv01 // Deprecated: use CertAlgoRSASHA256v01. CertSigAlgoRSASHA2256v01 = CertAlgoRSASHA256v01 // Deprecated: use CertAlgoRSASHA512v01. CertSigAlgoRSASHA2512v01 = CertAlgoRSASHA512v01 )
const ( UserCert = 1 HostCert = 2 )
Certificate types distinguish between host and user certificates. The values can be set in the CertType field of Certificate.
const ( KeyAlgoRSA = "ssh-rsa" KeyAlgoDSA = "ssh-dss" KeyAlgoECDSA256 = "ecdsa-sha2-nistp256" KeyAlgoSKECDSA256 = "sk-ecdsa-sha2-nistp256@openssh.com" KeyAlgoECDSA384 = "ecdsa-sha2-nistp384" KeyAlgoECDSA521 = "ecdsa-sha2-nistp521" KeyAlgoED25519 = "ssh-ed25519" KeyAlgoSKED25519 = "sk-ssh-ed25519@openssh.com" // KeyAlgoRSASHA256 and KeyAlgoRSASHA512 are only public key algorithms, not // public key formats, so they can't appear as a PublicKey.Type. The // corresponding PublicKey.Type is KeyAlgoRSA. See RFC 8332, Section 2. KeyAlgoRSASHA256 = "rsa-sha2-256" KeyAlgoRSASHA512 = "rsa-sha2-512" )
Public key algorithms names. These values can appear in PublicKey.Type, ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner arguments.
const ( // Deprecated: use KeyAlgoRSA. SigAlgoRSA = KeyAlgoRSA // Deprecated: use KeyAlgoRSASHA256. SigAlgoRSASHA2256 = KeyAlgoRSASHA256 // Deprecated: use KeyAlgoRSASHA512. SigAlgoRSASHA2512 = KeyAlgoRSASHA512 )
const CertTimeInfinity = 1<<64 - 1
CertTimeInfinity can be used for OpenSSHCertV01.ValidBefore to indicate that a certificate does not expire.
Variables ¶
var ErrNoAuth = errors.New("ssh: no auth passed yet")
ErrNoAuth is the error value returned if no authentication method has been passed yet. This happens as a normal part of the authentication loop, since the client first tries 'none' authentication to discover available methods. It is returned in ServerAuthError.Errors from NewServerConn.
Functions ¶
func ErrIsDisconnectedByUser ¶
func FingerprintLegacyMD5 ¶
FingerprintLegacyMD5 returns the user presentation of the key's fingerprint as described by RFC 4716 section 4.
func FingerprintSHA256 ¶
FingerprintSHA256 returns the user presentation of the key's fingerprint as unpadded base64 encoded sha256 hash. This format was introduced from OpenSSH 6.8. https://www.openssh.com/txt/release-6.8 https://tools.ietf.org/html/rfc4648#section-3.2 (unpadded base64 encoding)
func Marshal ¶
func Marshal(msg interface{}) []byte
Marshal serializes the message in msg to SSH wire format. The msg argument should be a struct or pointer to struct. If the first member has the "sshtype" tag set to a number in decimal, that number is prepended to the result. If the last of member has the "ssh" tag set to "rest", its contents are appended to the output.
func MarshalAuthorizedKey ¶
MarshalAuthorizedKey serializes key for inclusion in an OpenSSH authorized_keys file. The return value ends with newline.
func ParseDSAPrivateKey ¶
func ParseDSAPrivateKey(der []byte) (*dsa.PrivateKey, error)
ParseDSAPrivateKey returns a DSA private key from its ASN.1 DER encoding, as specified by the OpenSSL DSA man page.
func ParseRawPrivateKey ¶
ParseRawPrivateKey returns a private key from a PEM encoded private key. It supports RSA (PKCS#1), PKCS#8, DSA (OpenSSL), and ECDSA private keys. If the private key is encrypted, it will return a PassphraseMissingError.
func ParseRawPrivateKeyWithPassphrase ¶
ParseRawPrivateKeyWithPassphrase returns a private key decrypted with passphrase from a PEM encoded private key. If the passphrase is wrong, it will return x509.IncorrectPasswordError.
func TrickTransportPacketCopy ¶
func TrickTransportPacketCopy(a, b *TrickTransport) error
func Unmarshal ¶
Unmarshal parses data in SSH wire format into a structure. The out argument should be a pointer to struct. If the first member of the struct has the "sshtype" tag set to a '|'-separated set of numbers in decimal, the packet must start with one of those numbers. In case of error, Unmarshal returns a ParseError or UnexpectedMessageError.
Types ¶
type AlgorithmSigner ¶
type AlgorithmSigner interface { Signer // SignWithAlgorithm is like Signer.Sign, but allows specifying a desired // signing algorithm. Callers may pass an empty string for the algorithm in // which case the AlgorithmSigner will use a default algorithm. This default // doesn't currently control any behavior in this package. SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error) }
An AlgorithmSigner is a Signer that also supports specifying an algorithm to use for signing.
An AlgorithmSigner can't advertise the algorithms it supports, so it should be prepared to be invoked with every algorithm supported by the public key format.
type AuthMethod ¶
type AuthMethod interface {
// contains filtered or unexported methods
}
An AuthMethod represents an instance of an RFC 4252 authentication method.
func GSSAPIWithMICAuthMethod ¶
func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod
GSSAPIWithMICAuthMethod is an AuthMethod with "gssapi-with-mic" authentication. See RFC 4462 section 3 gssAPIClient is implementation of the GSSAPIClient interface, see the definition of the interface for details. target is the server host you want to log in to.
func KeyboardInteractive ¶
func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod
KeyboardInteractive returns an AuthMethod using a prompt/response sequence controlled by the server.
func Password ¶
func Password(secret string) AuthMethod
Password returns an AuthMethod using the given password.
func PasswordCallback ¶
func PasswordCallback(prompt func() (secret string, err error)) AuthMethod
PasswordCallback returns an AuthMethod that uses a callback for fetching a password.
func PublicKeys ¶
func PublicKeys(signers ...Signer) AuthMethod
PublicKeys returns an AuthMethod that uses the given key pairs.
func PublicKeysCallback ¶
func PublicKeysCallback(getSigners func() (signers []Signer, err error)) AuthMethod
PublicKeysCallback returns an AuthMethod that runs the given function to obtain a list of key pairs.
func RetryableAuthMethod ¶
func RetryableAuthMethod(auth AuthMethod, maxTries int) AuthMethod
RetryableAuthMethod is a decorator for other auth methods enabling them to be retried up to maxTries before considering that AuthMethod itself failed. If maxTries is <= 0, will retry indefinitely
This is useful for interactive clients using challenge/response type authentication (e.g. Keyboard-Interactive, Password, etc) where the user could mistype their response resulting in the server issuing a SSH_MSG_USERAUTH_FAILURE (rfc4252 #8 [password] and rfc4256 #3.4 [keyboard-interactive]); Without this decorator, the non-retryable AuthMethod would be removed from future consideration, and never tried again (and so the user would never be able to retry their entry).
type BannerCallback ¶
BannerCallback is the function type used for treat the banner sent by the server. A BannerCallback receives the message sent by the remote server.
type CertChecker ¶
type CertChecker struct { // SupportedCriticalOptions lists the CriticalOptions that the // server application layer understands. These are only used // for user certificates. SupportedCriticalOptions []string // IsUserAuthority should return true if the key is recognized as an // authority for the given user certificate. This allows for // certificates to be signed by other certificates. This must be set // if this CertChecker will be checking user certificates. IsUserAuthority func(auth PublicKey) bool // IsHostAuthority should report whether the key is recognized as // an authority for this host. This allows for certificates to be // signed by other keys, and for those other keys to only be valid // signers for particular hostnames. This must be set if this // CertChecker will be checking host certificates. IsHostAuthority func(auth PublicKey, address string) bool // Clock is used for verifying time stamps. If nil, time.Now // is used. Clock func() time.Time // UserKeyFallback is called when CertChecker.Authenticate encounters a // public key that is not a certificate. It must implement validation // of user keys or else, if nil, all such keys are rejected. UserKeyFallback func(conn ConnMetadata, key PublicKey) (*Permissions, error) // HostKeyFallback is called when CertChecker.CheckHostKey encounters a // public key that is not a certificate. It must implement host key // validation or else, if nil, all such keys are rejected. HostKeyFallback HostKeyCallback // IsRevoked is called for each certificate so that revocation checking // can be implemented. It should return true if the given certificate // is revoked and false otherwise. If nil, no certificates are // considered to have been revoked. IsRevoked func(cert *Certificate) bool }
CertChecker does the work of verifying a certificate. Its methods can be plugged into ClientConfig.HostKeyCallback and ServerConfig.PublicKeyCallback. For the CertChecker to work, minimally, the IsAuthority callback should be set.
func (*CertChecker) Authenticate ¶
func (c *CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)
Authenticate checks a user certificate. Authenticate can be used as a value for ServerConfig.PublicKeyCallback.
func (*CertChecker) CheckCert ¶
func (c *CertChecker) CheckCert(principal string, cert *Certificate) error
CheckCert checks CriticalOptions, ValidPrincipals, revocation, timestamp and the signature of the certificate.
func (*CertChecker) CheckHostKey ¶
CheckHostKey checks a host key certificate. This method can be plugged into ClientConfig.HostKeyCallback.
type Certificate ¶
type Certificate struct { Nonce []byte Key PublicKey Serial uint64 CertType uint32 KeyId string ValidPrincipals []string ValidAfter uint64 ValidBefore uint64 Permissions Reserved []byte SignatureKey PublicKey Signature *Signature }
An Certificate represents an OpenSSH certificate as defined in [PROTOCOL.certkeys]?rev=1.8. The Certificate type implements the PublicKey interface, so it can be unmarshaled using ParsePublicKey.
func (*Certificate) Marshal ¶
func (c *Certificate) Marshal() []byte
Marshal serializes c into OpenSSH's wire format. It is part of the PublicKey interface.
func (*Certificate) SignCert ¶
func (c *Certificate) SignCert(rand io.Reader, authority Signer) error
SignCert signs the certificate with an authority, setting the Nonce, SignatureKey, and Signature fields.
func (*Certificate) Type ¶
func (c *Certificate) Type() string
Type returns the certificate algorithm name. It is part of the PublicKey interface.
type ClientConfig ¶
type ClientConfig struct { // Config contains configuration that is shared between clients and // servers. Config // User contains the username to authenticate as. User string // Auth contains possible authentication methods to use with the // server. Only the first instance of a particular RFC 4252 method will // be used during authentication. Auth []AuthMethod // HostKeyCallback is called during the cryptographic // handshake to validate the server's host key. The client // configuration must supply this callback for the connection // to succeed. The functions InsecureIgnoreHostKey or // FixedHostKey can be used for simplistic host key checks. HostKeyCallback HostKeyCallback // BannerCallback is called during the SSH dance to display a custom // server's message. The client configuration can supply this callback to // handle it as wished. The function BannerDisplayStderr can be used for // simplistic display on Stderr. BannerCallback BannerCallback // ClientVersion contains the version identification string that will // be used for the connection. If empty, a reasonable default is used. ClientVersion string // HostKeyAlgorithms lists the public key algorithms that the client will // accept from the server for host key authentication, in order of // preference. If empty, a reasonable default is used. Any // string returned from a PublicKey.Type method may be used, or // any of the CertAlgo and KeyAlgo constants. HostKeyAlgorithms []string // Timeout is the maximum amount of time for the TCP connection to establish. // // A Timeout of zero means no timeout. Timeout time.Duration }
A ClientConfig structure is used to configure a Client. It must not be modified after having been passed to an SSH function.
type Config ¶
type Config struct { // Rand provides the source of entropy for cryptographic // primitives. If Rand is nil, the cryptographic random reader // in package crypto/rand will be used. Rand io.Reader // The maximum number of bytes sent or received after which a // new key is negotiated. It must be at least 256. If // unspecified, a size suitable for the chosen cipher is used. RekeyThreshold uint64 // The allowed key exchanges algorithms. If unspecified then a // default set of algorithms is used. KeyExchanges []string // The allowed cipher algorithms. If unspecified then a sensible // default is used. Ciphers []string // The allowed MAC algorithms. If unspecified then a sensible default // is used. MACs []string }
Config contains configuration data common to both ServerConfig and ClientConfig.
func (*Config) SetDefaults ¶
func (c *Config) SetDefaults()
SetDefaults sets sensible values for unset fields in config. This is exported for testing: Configs passed to SSH functions are copied and have default values set automatically.
type ConnMetadata ¶
type ConnMetadata interface { // User returns the user ID for this connection. User() string // SessionID returns the session hash, also denoted by H. SessionID() []byte // ClientVersion returns the client's version string as hashed // into the session ID. ClientVersion() []byte // ServerVersion returns the server's version string as hashed // into the session ID. ServerVersion() []byte // RemoteAddr returns the remote address for this connection. RemoteAddr() net.Addr // LocalAddr returns the local address for this connection. LocalAddr() net.Addr }
ConnMetadata holds metadata for the connection.
type CryptoPublicKey ¶
CryptoPublicKey, if implemented by a PublicKey, returns the underlying crypto.PublicKey form of the key.
type GSSAPIClient ¶
type GSSAPIClient interface { // InitSecContext initiates the establishment of a security context for GSS-API between the // ssh client and ssh server. Initially the token parameter should be specified as nil. // The routine may return a outputToken which should be transferred to // the ssh server, where the ssh server will present it to // AcceptSecContext. If no token need be sent, InitSecContext will indicate this by setting // needContinue to false. To complete the context // establishment, one or more reply tokens may be required from the ssh // server;if so, InitSecContext will return a needContinue which is true. // In this case, InitSecContext should be called again when the // reply token is received from the ssh server, passing the reply // token to InitSecContext via the token parameters. // See RFC 2743 section 2.2.1 and RFC 4462 section 3.4. InitSecContext(target string, token []byte, isGSSDelegCreds bool) (outputToken []byte, needContinue bool, err error) // GetMIC generates a cryptographic MIC for the SSH2 message, and places // the MIC in a token for transfer to the ssh server. // The contents of the MIC field are obtained by calling GSS_GetMIC() // over the following, using the GSS-API context that was just // established: // string session identifier // byte SSH_MSG_USERAUTH_REQUEST // string user name // string service // string "gssapi-with-mic" // See RFC 2743 section 2.3.1 and RFC 4462 3.5. GetMIC(micFiled []byte) ([]byte, error) // Whenever possible, it should be possible for // DeleteSecContext() calls to be successfully processed even // if other calls cannot succeed, thereby enabling context-related // resources to be released. // In addition to deleting established security contexts, // gss_delete_sec_context must also be able to delete "half-built" // security contexts resulting from an incomplete sequence of // InitSecContext()/AcceptSecContext() calls. // See RFC 2743 section 2.2.3. DeleteSecContext() error }
GSSAPIClient provides the API to plug-in GSSAPI authentication for client logins.
type GSSAPIServer ¶
type GSSAPIServer interface { // AcceptSecContext allows a remotely initiated security context between the application // and a remote peer to be established by the ssh client. The routine may return a // outputToken which should be transferred to the ssh client, // where the ssh client will present it to InitSecContext. // If no token need be sent, AcceptSecContext will indicate this // by setting the needContinue to false. To // complete the context establishment, one or more reply tokens may be // required from the ssh client. if so, AcceptSecContext // will return a needContinue which is true, in which case it // should be called again when the reply token is received from the ssh // client, passing the token to AcceptSecContext via the // token parameters. // The srcName return value is the authenticated username. // See RFC 2743 section 2.2.2 and RFC 4462 section 3.4. AcceptSecContext(token []byte) (outputToken []byte, srcName string, needContinue bool, err error) // VerifyMIC verifies that a cryptographic MIC, contained in the token parameter, // fits the supplied message is received from the ssh client. // See RFC 2743 section 2.3.2. VerifyMIC(micField []byte, micToken []byte) error // Whenever possible, it should be possible for // DeleteSecContext() calls to be successfully processed even // if other calls cannot succeed, thereby enabling context-related // resources to be released. // In addition to deleting established security contexts, // gss_delete_sec_context must also be able to delete "half-built" // security contexts resulting from an incomplete sequence of // InitSecContext()/AcceptSecContext() calls. // See RFC 2743 section 2.2.3. DeleteSecContext() error }
GSSAPIServer provides the API to plug in GSSAPI authentication for server logins.
type GSSAPIWithMICConfig ¶
type GSSAPIWithMICConfig struct { // AllowLogin, must be set, is called when gssapi-with-mic // authentication is selected (RFC 4462 section 3). The srcName is from the // results of the GSS-API authentication. The format is username@DOMAIN. // GSSAPI just guarantees to the server who the user is, but not if they can log in, and with what permissions. // This callback is called after the user identity is established with GSSAPI to decide if the user can login with // which permissions. If the user is allowed to login, it should return a nil error. AllowLogin func(conn ConnMetadata, srcName string) (*Permissions, error) // Server must be set. It's the implementation // of the GSSAPIServer interface. See GSSAPIServer interface for details. Server GSSAPIServer }
type HostKeyCallback ¶
HostKeyCallback is the function type used for verifying server keys. A HostKeyCallback must return nil if the host key is OK, or an error to reject it. It receives the hostname as passed to Dial or NewClientConn. The remote address is the RemoteAddr of the net.Conn underlying the SSH connection.
type KeyboardInteractiveChallenge ¶
type KeyboardInteractiveChallenge func(name, instruction string, questions []string, echos []bool) (answers []string, err error)
KeyboardInteractiveChallenge should print questions, optionally disabling echoing (e.g. for passwords), and return all the answers. Challenge may be called multiple times in a single session. After successful authentication, the server may send a challenge with no questions, for which the name and instruction messages should be printed. RFC 4256 section 3.3 details how the UI should behave for both CLI and GUI environments.
type PassphraseMissingError ¶
type PassphraseMissingError struct { // PublicKey will be set if the private key format includes an unencrypted // public key along with the encrypted private key. PublicKey PublicKey }
A PassphraseMissingError indicates that parsing this private key requires a passphrase. Use ParsePrivateKeyWithPassphrase.
func (*PassphraseMissingError) Error ¶
func (*PassphraseMissingError) Error() string
type Permissions ¶
type Permissions struct { // CriticalOptions indicate restrictions to the default // permissions, and are typically used in conjunction with // user certificates. The standard for SSH certificates // defines "force-command" (only allow the given command to // execute) and "source-address" (only allow connections from // the given address). The SSH package currently only enforces // the "source-address" critical option. It is up to server // implementations to enforce other critical options, such as // "force-command", by checking them after the SSH handshake // is successful. In general, SSH servers should reject // connections that specify critical options that are unknown // or not supported. CriticalOptions map[string]string // Extensions are extra functionality that the server may // offer on authenticated connections. Lack of support for an // extension does not preclude authenticating a user. Common // extensions are "permit-agent-forwarding", // "permit-X11-forwarding". The Go SSH library currently does // not act on any extension, and it is up to server // implementations to honor them. Extensions can be used to // pass data from the authentication callbacks to the server // application layer. Extensions map[string]string }
The Permissions type holds fine-grained permissions that are specific to a user or a specific authentication method for a user. The Permissions value for a successful authentication attempt is available in ServerConn, so it can be used to pass information from the user-authentication phase to the application layer.
type PublicKey ¶
type PublicKey interface { // Type returns the key format name, e.g. "ssh-rsa". Type() string // Marshal returns the serialized key data in SSH wire format, with the name // prefix. To unmarshal the returned data, use the ParsePublicKey function. Marshal() []byte // Verify that sig is a signature on the given data using this key. This // method will hash the data appropriately first. sig.Format is allowed to // be any signature algorithm compatible with the key type, the caller // should check if it has more stringent requirements. Verify(data []byte, sig *Signature) error }
PublicKey represents a public key using an unspecified algorithm.
Some PublicKeys provided by this package also implement CryptoPublicKey.
func NewPublicKey ¶
NewPublicKey takes an *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey, or ed25519.PublicKey returns a corresponding PublicKey instance. ECDSA keys must use P-256, P-384 or P-521.
func ParseAuthorizedKey ¶
func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []string, rest []byte, err error)
ParseAuthorizedKey parses a public key from an authorized_keys file used in OpenSSH according to the sshd(8) manual page.
func ParseKnownHosts ¶
func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey, comment string, rest []byte, err error)
ParseKnownHosts parses an entry in the format of the known_hosts file.
The known_hosts format is documented in the sshd(8) manual page. This function will parse a single entry from in. On successful return, marker will contain the optional marker value (i.e. "cert-authority" or "revoked") or else be empty, hosts will contain the hosts that this entry matches, pubKey will contain the public key and comment will contain any trailing comment at the end of the line. See the sshd(8) manual page for the various forms that a host string can take.
The unparsed remainder of the input will be returned in rest. This function can be called repeatedly to parse multiple entries.
If no entries were found in the input then err will be io.EOF. Otherwise a non-nil err value indicates a parse error.
func ParsePublicKey ¶
ParsePublicKey parses an SSH public key formatted for use in the SSH wire protocol according to RFC 4253, section 6.6.
type RejectionReason ¶
type RejectionReason uint32
RejectionReason is an enumeration used when rejecting channel creation requests. See RFC 4254, section 5.1.
const ( Prohibited RejectionReason = iota + 1 ConnectionFailed UnknownChannelType ResourceShortage )
type ServerAuthError ¶
type ServerAuthError struct { // Errors contains authentication errors returned by the authentication // callback methods. The first entry is typically ErrNoAuth. Errors []error }
ServerAuthError represents server authentication errors and is sometimes returned by NewServerConn. It appends any authentication errors that may occur, and is returned if all of the authentication methods provided by the user failed to authenticate.
func (ServerAuthError) Error ¶
func (l ServerAuthError) Error() string
type ServerConfig ¶
type ServerConfig struct { // Config contains configuration shared between client and server. Config // NoClientAuth is true if clients are allowed to connect without // authenticating. // To determine NoClientAuth at runtime, set NoClientAuth to true // and the optional NoClientAuthCallback to a non-nil value. NoClientAuth bool // NoClientAuthCallback, if non-nil, is called when a user // attempts to authenticate with auth method "none". // NoClientAuth must also be set to true for this be used, or // this func is unused. NoClientAuthCallback func(ConnMetadata) (*Permissions, error) // MaxAuthTries specifies the maximum number of authentication attempts // permitted per connection. If set to a negative number, the number of // attempts are unlimited. If set to zero, the number of attempts are limited // to 6. MaxAuthTries int // PasswordCallback, if non-nil, is called when a user // attempts to authenticate using a password. PasswordCallback func(conn ConnMetadata, password []byte) (*Permissions, error) // PublicKeyCallback, if non-nil, is called when a client // offers a public key for authentication. It must return a nil error // if the given public key can be used to authenticate the // given user. For example, see CertChecker.Authenticate. A // call to this function does not guarantee that the key // offered is in fact used to authenticate. To record any data // depending on the public key, store it inside a // Permissions.Extensions entry. PublicKeyCallback func(conn ConnMetadata, key PublicKey) (*Permissions, error) // KeyboardInteractiveCallback, if non-nil, is called when // keyboard-interactive authentication is selected (RFC // 4256). The client object's Challenge function should be // used to query the user. The callback may offer multiple // Challenge rounds. To avoid information leaks, the client // should be presented a challenge even if the user is // unknown. KeyboardInteractiveCallback func(conn ConnMetadata, client KeyboardInteractiveChallenge) (*Permissions, error) // AuthLogCallback, if non-nil, is called to log all authentication // attempts. AuthLogCallback func(conn ConnMetadata, method string, err error) // ServerVersion is the version identification string to announce in // the public handshake. // If empty, a reasonable default is used. // Note that RFC 4253 section 4.2 requires that this string start with // "SSH-2.0-". ServerVersion string // BannerCallback, if present, is called and the return string is sent to // the client after key exchange completed but before authentication. BannerCallback func(conn ConnMetadata) string // GSSAPIWithMICConfig includes gssapi server and callback, which if both non-nil, is used // when gssapi-with-mic authentication is selected (RFC 4462 section 3). GSSAPIWithMICConfig *GSSAPIWithMICConfig // contains filtered or unexported fields }
ServerConfig holds server specific configuration data.
func (*ServerConfig) AddHostKey ¶
func (s *ServerConfig) AddHostKey(key Signer)
AddHostKey adds a private key as a host key. If an existing host key exists with the same public key format, it is replaced. Each server config must have at least one host key.
type Signer ¶
type Signer interface { // PublicKey returns the associated PublicKey. PublicKey() PublicKey // Sign returns a signature for the given data. This method will hash the // data appropriately first. The signature algorithm is expected to match // the key format returned by the PublicKey.Type method (and not to be any // alternative algorithm supported by the key format). Sign(rand io.Reader, data []byte) (*Signature, error) }
A Signer can create signatures that verify against a public key.
Some Signers provided by this package also implement AlgorithmSigner.
func NewCertSigner ¶
func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
NewCertSigner returns a Signer that signs with the given Certificate, whose private key is held by signer. It returns an error if the public key in cert doesn't match the key used by signer.
func NewSignerFromKey ¶
NewSignerFromKey takes an *rsa.PrivateKey, *dsa.PrivateKey, *ecdsa.PrivateKey or any other crypto.Signer and returns a corresponding Signer instance. ECDSA keys must use P-256, P-384 or P-521. DSA keys must use parameter size L1024N160.
func NewSignerFromSigner ¶
NewSignerFromSigner takes any crypto.Signer implementation and returns a corresponding Signer interface. This can be used, for example, with keys kept in hardware modules.
func ParsePrivateKey ¶
ParsePrivateKey returns a Signer from a PEM encoded private key. It supports the same keys as ParseRawPrivateKey. If the private key is encrypted, it will return a PassphraseMissingError.
func ParsePrivateKeyWithPassphrase ¶
ParsePrivateKeyWithPassphrase returns a Signer from a PEM encoded private key and passphrase. It supports the same keys as ParseRawPrivateKeyWithPassphrase.
type TrickTransport ¶
type TrickTransport struct {
// contains filtered or unexported fields
}
func NewClientTrickTransport ¶
func NewClientTrickTransport(c net.Conn, addr string, config *ClientConfig) (*TrickTransport, error)
func NewServerTrickTransport ¶
func NewServerTrickTransport(c net.Conn, config *ServerConfig) (*TrickTransport, error)
func (*TrickTransport) ReadPacket ¶
func (t *TrickTransport) ReadPacket() ([]byte, error)
func (*TrickTransport) User ¶
func (t *TrickTransport) User() string
func (*TrickTransport) WritePacket ¶
func (t *TrickTransport) WritePacket(p []byte) error
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
internal
|
|
bcrypt_pbkdf
Package bcrypt_pbkdf implements bcrypt_pbkdf(3) from OpenBSD.
|
Package bcrypt_pbkdf implements bcrypt_pbkdf(3) from OpenBSD. |