signer

Documentation

Index

• func NewAlgorithmSignerFromSigner(signer crypto.Signer, algorithm string) (ssh.Signer, error)
• func SignCertificateAllRegions(publicKey ssh.PublicKey, token string, forceCommand string, c *config.SSHrimp) (*ssh.Certificate, error)
• func SignCertificateOneRegion(publicKey ssh.PublicKey, token string, forceCommand string, region string, ...) (*ssh.Certificate, error)
• type KMSSigner
  • func NewKMSSigner(key string) *KMSSigner
  • func (s *KMSSigner) Public() crypto.PublicKey
  • func (s *KMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)
• type SSHrimpEvent
• type SSHrimpResult

Functions

func NewAlgorithmSignerFromSigner

func NewAlgorithmSignerFromSigner(signer crypto.Signer, algorithm string) (ssh.Signer, error)

NewAlgorithmSignerFromSigner returns a ssh.Signer with a different default algorithm. Waiting for upstream changes to x/crypto/ssh, see: https://github.com/golang/go/issues/36261

func SignCertificateAllRegions

func SignCertificateAllRegions(publicKey ssh.PublicKey, token string, forceCommand string, c *config.SSHrimp) (*ssh.Certificate, error)

SignCertificateAllRegions iterate through each configured region if there is an error signing the certificate

func SignCertificateOneRegion

func SignCertificateOneRegion(publicKey ssh.PublicKey, token string, forceCommand string, region string, c *config.SSHrimp) (*ssh.Certificate, error)

SignCertificateOneRegion given a public key, identity token and forceCommand, invoke the sshrimp-ca lambda function

Types

type KMSSigner

type KMSSigner struct {
	crypto.Signer
	// contains filtered or unexported fields
}

KMSSigner an AWS asymetric crypto signer

func NewKMSSigner

func NewKMSSigner(key string) *KMSSigner

NewKMSSigner return a new instsance of KMSSigner

func (*KMSSigner) Public

func (s *KMSSigner) Public() crypto.PublicKey

Public returns the public key from KMS

func (*KMSSigner) Sign

func (s *KMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Sign a digest with the private key in KMS

type SSHrimpEvent

type SSHrimpEvent struct {
	PublicKey     string `json:"publickey"`
	Token         string `json:"token"`
	SourceAddress string `json:"sourceaddress"`
	ForceCommand  string `json:"forcecommand"`
}

SSHrimpEvent encodes the user input for the sshrimp-ca lambda

type SSHrimpResult

type SSHrimpResult struct {
	Certificate  string `json:"certificate"`
	ErrorMessage string `json:"errorMessage"`
	ErrorType    string `json:"errorType"`
}

SSHrimpResult encodes the payload format returned from the sshrimp-ca lambda