Documentation
¶
Overview ¶
Package tunnel opens the SSH connection to a profile's bastion and dials the database server through it. Connections are direct-tcpip channels handed to the driver: no local port is ever listened on, so no other account on this machine can use the tunnel.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrAuth = errors.New("ssh: authentication failed")
ErrAuth marks an authentication failure: the bastion refused the credentials, or the key passphrase is wrong.
var ErrHostKeyChanged = errors.New("ssh: REMOTE HOST IDENTIFICATION HAS CHANGED")
ErrHostKeyChanged is a bastion whose key differs from the one recorded in known_hosts: possibly an attacker in the middle. There is no override; the human edits known_hosts after checking the new key.
Functions ¶
func HostKeyAlgorithms ¶
func HostKeyAlgorithms(path string, p config.SSHProfile) ([]string, error)
HostKeyAlgorithms lists the host key algorithms to offer the bastion of p: those of the key types recorded for it in the known_hosts file at path, so that a bastion with several keys is not negotiated onto one that is not recorded (which would look like a changed key). With nothing recorded it lists the plain key algorithms, Ed25519 first and no certificates.
func KnownHosts ¶
func KnownHosts(path string, confirm Confirm) (ssh.HostKeyCallback, error)
KnownHosts verifies host keys against the known_hosts file at path, as OpenSSH with StrictHostKeyChecking=ask: a recorded key must match, an unknown host is trusted only on confirm, and is then recorded.
func KnownHostsPath ¶
KnownHostsPath is the console account's known_hosts.
Types ¶
type Options ¶
type Options struct {
Profile config.SSHProfile
// Home is the console account's home directory, for "~" in Profile.Key.
Home string
// HostKey verifies the bastion's key (see KnownHosts).
HostKey ssh.HostKeyCallback
// HostKeyAlgorithms limits the host key algorithms offered to the
// bastion (see HostKeyAlgorithms); empty keeps the library default.
HostKeyAlgorithms []string
// Secret returns a key passphrase or an SSH password; it is called only
// when one is needed, and Open wipes what it returns.
Secret func(prompt string) ([]byte, error)
// AgentSock is the console's SSH_AUTH_SOCK, "" when unset.
AgentSock string
// Keepalive is the interval between keepalives; 0 means 30s.
Keepalive time.Duration
}
Options configure Open.
type Tunnel ¶
type Tunnel struct {
// contains filtered or unexported fields
}
Tunnel is an open SSH connection to a bastion.
Source Files