Documentation
¶
Overview ¶
Package sshcert manages short-lived, per-environment SSH certificates and their backing ephemeral keypairs on disk for use by the OpenSSH client.
Index ¶
- Constants
- func CertAuthorityPrincipal(nodeID, linuxUser string) string
- func CertPath(brevDir, envID string) string
- func CertValidAt(cert *ssh.Certificate, now time.Time, margin time.Duration) bool
- func Dir(brevDir string) string
- func EnvironmentCertEligible(labels map[string]string) bool
- func GenerateKeyPair() (privKeyPEM []byte, pubKeyOpenSSH string, err error)
- func HasCertAuthorityLine(homeDir, nodeID string) bool
- func HasValidCertAuth(fs afero.Fs, keyPath, certPath string, now time.Time, margin time.Duration) (bool, error)
- func KeyPath(brevDir, envID string) string
- func ParseCertificate(certOpenSSH string) (*ssh.Certificate, error)
- func PublicKeyMatches(a, b ssh.PublicKey) bool
- func RemoveCertAuthorityLine(homeDir, nodeID, linuxUser string) (bool, error)
- func WriteFiles(fs afero.Fs, keyPath, certPath string, privKeyPEM []byte, certOpenSSH string) error
Constants ¶
const ( LabelKeySSHProvider = "sshprovider" SSHProviderCertAuth = "certauth" )
Label constants mirroring dev-plane's internal/labels package
const DefaultRenewalMargin = 60 * time.Second
DefaultRenewalMargin is how long before expiry we renew, to avoid a race where the cert expires between mint and the subsequent ssh use.
Variables ¶
This section is empty.
Functions ¶
func CertAuthorityPrincipal ¶
CertAuthorityPrincipal returns the SSH certificate principal for a node and Linux user
func CertPath ¶
CertPath follows OpenSSH's <IdentityFile>-cert.pub convention, so a single IdentityFile directive loads both the key and the cert.
func CertValidAt ¶
func EnvironmentCertEligible ¶
func GenerateKeyPair ¶
func HasCertAuthorityLine ¶
HasCertAuthorityLine reports whether authorized_keys contains a Brev cert-authority line for the given node (any Linux user).
func HasValidCertAuth ¶
func ParseCertificate ¶
func ParseCertificate(certOpenSSH string) (*ssh.Certificate, error)
func PublicKeyMatches ¶
func RemoveCertAuthorityLine ¶
RemoveCertAuthorityLine removes the cert-authority line for the given node and Linux user from ~/.ssh/authorized_keys. Returns true if a line was removed. Missing file is treated as nothing-to-remove.
Types ¶
This section is empty.
Source Files