Documentation
¶
Overview ¶
Serves the interactive SSH authentication WebSocket, whose prompt establishes a control master. It runs commands only through Runner and has no view of the session domain. The request that first sees the master turn healthy owns it, so shutdown reaps that exact process.
Package ssh runs bounded remote commands and foreground OpenSSH control masters against per-principal configs. Every operation resolves the alias first; that output also identifies its control socket. Interactive masters disable ControlPersist because persistence backgrounds authentication. Exit status 255 belongs to ssh itself and cannot establish whether a remote command ran; aliases trust literal Host lines in process-owned configs. FirstHop follows each ProxyJump entry as the ssh:// URI it is, so `ssh -G` resolves its user, host and port.
Marker-delimited output is the shared envelope for discovery, scheduler reconciliation, and remote log tails. Each section name occupies a line of its own so SSH banner noise remains outside the framed response. The SSH host is untrusted: an out-of-order, missing, duplicate, or unknown marker rejects the whole response rather than allowing one protocol to interpret another's output.
Index ¶
- Variables
- func AmbiguousExit(err error) bool
- func AuthenticationFailure(message string) bool
- func ClassifyFailure(alias, stderr string, err error) error
- func FailureMessage(stderr string, err error) string
- func Sections(output, prefix string, names []string) (map[string]string, error)
- func ShellQuote(value string) string
- func ValidAlias(value string) bool
- type ClientFrame
- type Configurations
- type ControlManager
- type PrivateKeyMetadata
- type Runner
- func (r Runner) EffectiveTimeout() time.Duration
- func (r Runner) FirstHop(ctx context.Context, alias string) (string, error)
- func (r Runner) Run(ctx context.Context, alias string, stdin io.Reader, remoteArgs ...string) (string, error)
- func (r Runner) RunOutput(ctx context.Context, alias string, stdin io.Reader, remoteArgs ...string) (string, string, error)
- type ServerFrame
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidAlias = security.New("invalid_ssh_alias", "invalid SSH alias", http.StatusBadRequest)
Functions ¶
func AmbiguousExit ¶
func AuthenticationFailure ¶
func ClassifyFailure ¶
func FailureMessage ¶
func ShellQuote ¶
func ValidAlias ¶
Types ¶
type ClientFrame ¶
type Configurations ¶
func (Configurations) ConfigPath ¶
func (c Configurations) ConfigPath(principal security.Principal) string
type ControlManager ¶
type ControlManager struct {
// contains filtered or unexported fields
}
func NewControlManager ¶
func NewControlManager() *ControlManager
func (*ControlManager) Close ¶
func (m *ControlManager) Close()
func (*ControlManager) ServeWebSocket ¶
func (m *ControlManager) ServeWebSocket(writer http.ResponseWriter, request *http.Request, alias string, runner Runner)
type PrivateKeyMetadata ¶
func InspectPrivateKey ¶
func InspectPrivateKey(private []byte) (PrivateKeyMetadata, error)
type Runner ¶
type Runner struct {
SSHBin string
Timeout time.Duration
ControlNamespace string
ConfigPath string
}
Source Files