sshmux

package module
v0.0.0-...-8039c85 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 1, 2019 License: MIT Imports: 8 Imported by: 0

README

sshmux GoDoc Build Status Go Report Card

SSH multiplexing library, allowing you to write "jump host" style proxies.

sshmux supports jumps through agent-forwarding or secure channel forwarding (ssh -W). For ssh session channels, it also allows for interactive selection of destination. Secure channel forwarding is not interactive, but simply verifies the requested final destination against the permitted hosts list.

sshmux only allows publickey authentication at the current time, but might allow for keyboardinteractive in the future.

Limitations

sshmux can only forward normal sessions (ssh'ing directly to sshmux without a ProxyCommand) if agent forwarding is enabled. This is because your normal session authenticates to sshmux, but sshmux then has to authenticate you with the remote host, requiring a additional access to your agent. sshmux will, however, not forward your agent to the final remote host. Doing this is simple if wanted, but I have to decide on how this is toggled. This also means that the sftp and scp clients bundled with openssh cannot use normal session forwarding. If you want this to work, try to revive this very old bug report about it: https://bugzilla.mindrot.org/show_bug.cgi?id=831.

Using a "ssh -W" ProxyCommand circumvents this limitation, both for ssh and sftp/scp, and also bypasses the interactive server selection, as the client will inform sshmux of the wanted target directly. If the target is permitted, the user will be connected. This also provides more protection for the paranoid, as the connection to the final host is encrypted end-to-end, rather than being plaintext in the memory of sshmux (not something I would worry too much about if the server is solely in your control).

But i just want to run it...

Look at sshmuxd instead, then: https://github.com/joushou/sshmuxd

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func KeyboardChallenge

func KeyboardChallenge(comm io.ReadWriter, user, instruction string, questions []string, echos []bool) ([]string, error)

KeyboardChallenge prompts the user for keyboards challenges.

func StringCallback

func StringCallback(comm io.ReadWriter, prompt string, hide bool) (string, error)

StringCallback prompts the user for a password.

Types

type Remote

type Remote struct {
	// The various names that can be used to select this remote
	Names []string

	// The description used for interactive prompting
	Description string

	// The address of this remote
	Address string

	// The username to connect with
	Username string
}

func DefaultInteractive

func DefaultInteractive(comm io.ReadWriter, session *Session) (*Remote, error)

DefaultInteractive is the default server selection prompt for users during session forward.

type Server

type Server struct {
	// Auther checks if a connection is permitted, and returns a user if
	// recognized.. Returning nil error indicates that the login was allowed,
	// regardless of whether the user was recognized or not. To disallow a
	// connection, return an error.
	Auther func(ssh.ConnMetadata, ssh.PublicKey) (*User, error)

	// Setup takes a Session, the most important task being filling out the
	// permitted remote hosts. Returning an error here will send the error to
	// the user and terminate the connection. This is not as clean as denying
	// the user in Auther, but can be used in case the denial was too dynamic.
	Setup func(*Session) error

	// Interactive is called to ask the user to select a host on the list of
	// potential remote hosts. This is only called in the case where more than
	// one option is available. If an error is returned, it is presented to the
	// user and the connection is terminated. The io.ReadWriter is to be used
	// for user interaction.
	Interactive func(io.ReadWriter, *Session) (*Remote, error)

	// Selected is called when a remote host has been decided upon. The main
	// purpose of this callback is logging, but returning an error will
	// terminate the connection, allowing it to be used as a last-minute
	// bailout.
	Selected func(*Session, string) error

	// Dialer specifies a dial-up function used to establish the underlying
	// network connection to the ssh servers. Defaults to net.Dial.
	Dialer func(network, address string) (net.Conn, error)

	// UsernamePrompt is used to prompt the user for a username. If nil, the
	// username used to connect to sshmux will be used.
	UsernamePrompt func(io.ReadWriter, *Session) (string, error)

	// ConnectionTimeout specifies the timeout to use when forwarding a
	// connection. If zero, a sensible default will be used.
	ConnectionTimeout time.Duration
	// contains filtered or unexported fields
}

Server is the sshmux server instance.

func New

func New(signer ssh.Signer, auth func(ssh.ConnMetadata, ssh.PublicKey) (*User, error), setup func(*Session) error) *Server

New returns a Server initialized with the provided signer and callbacks.

func (*Server) ChannelForward

func (s *Server) ChannelForward(session *Session, newChannel ssh.NewChannel)

ChannelForward establishes a secure channel forward (ssh -W) to the server requested by the user, assuming it is a permitted host.

func (*Server) HandleConn

func (s *Server) HandleConn(c net.Conn)

HandleConn takes a net.Conn and runs it through sshmux.

func (*Server) Serve

func (s *Server) Serve(l net.Listener) error

Serve is an Accept loop that sends the accepted connections through HandleConn.

func (*Server) SessionForward

func (s *Server) SessionForward(session *Session, newChannel ssh.NewChannel, chans <-chan ssh.NewChannel)

SessionForward performs a regular forward, providing the user with an interactive remote host selection if necessary. This forwarding type requires agent forwarding in order to work.

type Session

type Session struct {
	// Conn is the ssh.ServerConn associated with the connection.
	Conn *ssh.ServerConn

	// User is the current user, or nil if unknown.
	User *User

	// Remotes is the allowed set of remote hosts.
	Remotes []*Remote

	// PublicKey is the public key used in this session.
	PublicKey ssh.PublicKey
}

Session describes the current user session.

type User

type User struct {
	// The public key of the user.
	PublicKey ssh.PublicKey

	// The name the user will be referred to as. *NOT* the username used when
	// starting the session.
	Name string
}

User describes an authenticable user.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL