Documentation
¶
Overview ¶
Package config loads lockssh profiles from the project and user config files, applies the defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile. The file lookup, the secret-safe decoding, the shared profile base and the diff helpers are lockkit's.
Index ¶
- Constants
- Variables
- func DefaultDetectors() []string
- func Load(cwd string) (map[string]Profile, string, error)
- func LoadFile(path string) (map[string]Profile, error)
- func LoadFrom(cwd, userConfigPath string) (map[string]Profile, string, error)
- func ParseProfiles(data []byte, name string) (map[string]Profile, error)
- type AutoRules
- type AutoValue
- type Limits
- type Policy
- type Profile
Constants ¶
const ( // ActConnect: use the console's SSH session (a connect ticket; under // "ask" the lock takes a human's approval of the first one of each // console run and approved policy). ActConnect = "connect" // ActRun: a command an allow rule matches. Under "auto" it runs at // once: the human approved the allow list in the policy review. ActRun = "run" // ActExec: a command no allow rule matches, on a profile with // exec = true. ActExec = "exec" // ActUnmask: a command's output in clear. Never approved by an auto // rule, whatever this rule says: only deny changes anything. ActUnmask = "unmask" )
Actions of the auto rules.
const ( MaxOutputCeiling = 512 << 10 MaxRequestTimeout = 10 * time.Minute )
Ceilings of the per-command limits.
const ( MinIdleTimeout = time.Minute MaxMaxSession = 24 * time.Hour )
Bounds of the session limits: MinIdleTimeout <= idle_timeout <= max_session <= MaxMaxSession.
const ( DefaultIdleTimeout = 20 * time.Minute DefaultMaxSession = 4 * time.Hour )
Default session limits.
const ( AuthKey = kconfig.SSHAuthKey AuthPassword = kconfig.SSHAuthPassword )
Authentication methods of a profile.
const CredentialsNone = console.CredentialsNone
CredentialsNone is the credentials mode of an unencrypted key: the console asks for nothing.
const FullAuto = "full-auto"
FullAuto is the preset that sets every action to auto (`auto = "full-auto"`).
Variables ¶
var AutoActions = []string{ActConnect, ActRun, ActExec, ActUnmask}
AutoActions lists every action, in display order.
Functions ¶
func DefaultDetectors ¶
func DefaultDetectors() []string
DefaultDetectors is the detector set of a profile that sets none: the usual personal values, public IP addresses (command output is full of them) and secrets (a config file or an environment dump). National id detectors are opt-in.
func Load ¶
Load reads the project config (found by walking up from cwd) and the user config. On a profile name present in both, the project profile wins as a whole. It also returns the project root ("" when none).
Types ¶
type AutoRules ¶
type AutoRules struct {
Connect AutoValue `json:"connect,omitempty"`
Run AutoValue `json:"run,omitempty"`
Exec AutoValue `json:"exec,omitempty"`
Unmask AutoValue `json:"unmask,omitempty"`
}
AutoRules are a profile's auto rules. An empty field is the action's default (AutoDefault): Canonical empties the fields equal to it, so a profile that sets no rule keeps the fingerprint it had before the rules existed.
func (AutoRules) IsFullAuto ¶
IsFullAuto reports whether every action is auto.
func (AutoRules) Rule ¶
Rule is the effective rule of action: the profile's, or the default. An unknown action is denied (fail closed).
type AutoValue ¶
type AutoValue string
AutoValue is how `lox run`'s auto mode treats one action of a profile: approved without a question (auto), asked of the human (ask), or refused even when asked (deny). Manual mode asks everything a ticket carries whatever the rule; deny refuses in both modes.
Auto values, from the tightest to the loosest.
func AutoDefault ¶
AutoDefault is the rule of action when the profile sets none.
func ParseAutoValue ¶
ParseAutoValue parses auto, ask or deny. Its error never quotes s.
type Limits ¶
type Limits struct {
// RequestTimeout ends a command that runs longer (its session is
// closed; the result says timed_out).
RequestTimeout time.Duration `json:"request_timeout"`
// MaxOutputBytes caps stdout and stderr, each, before masking.
MaxOutputBytes int `json:"max_output_bytes"`
}
Limits bound one command.
func DefaultLimits ¶
func DefaultLimits() Limits
DefaultLimits returns the limits applied to unset limit fields.
type Policy ¶
type Policy struct {
Profile Profile `json:"profile"`
}
Policy is the security-relevant view of one profile: what the console fingerprints, compares with the last approved one and asks the human about before applying any loosening.
func Canonical ¶
Canonical sorts and de-duplicates the lists of p: its JSON is the fingerprinted form.
func (Policy) Diff ¶
Diff lists the changes from approved to p and marks each loosening: a new allow rule, exec turned on, another known_hosts file, a removed detector, a larger output cap, a longer request timeout, an auto rule made looser (deny < ask < auto), and the shared rules of the profile base (kconfig.DiffBase: the login, the SSH target, production, credentials).
type Profile ¶
type Profile struct {
Name string `json:"name"`
kconfig.Base
// KnownHosts is the known_hosts file the host key is checked against;
// "" is the console account's ~/.ssh/known_hosts, where an unknown key
// may be trusted on the console.
KnownHosts string `json:"known_hosts,omitempty"`
// Exec lets the agent ask for a command no allow rule matches (each
// one a ticket the human decides).
Exec bool `json:"exec"`
// Allow are the allow rules in canonical text form, sorted.
Allow []string `json:"allow"`
Detectors []string `json:"detectors"`
Limits Limits `json:"limits"`
// Auto are the profile's auto rules (`lox run`'s auto mode).
Auto AutoRules `json:"auto,omitzero"`
}
Profile is one SSH host with its policy. It never holds a secret. Its SSH target is Base.SSH (host, port, user, auth, key, credentials), so that lockkit's console treats a change of any of them as a connection change.
Source Files