sshagent

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 11, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package sshagent implements a filtering SSH agent proxy.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Fingerprint

func Fingerprint(keyBlob []byte) string

Fingerprint computes the SHA256 fingerprint of a public key blob. Returns the fingerprint in the format "SHA256:<base64>".

Types

type AgentClient

type AgentClient interface {
	// List returns all identities (public keys) from the agent.
	List() ([]*Identity, error)
	// Sign requests the agent to sign data using the specified key.
	Sign(key *Identity, data []byte) ([]byte, error)
	// Close closes the connection to the agent.
	Close() error
}

AgentClient is the interface for SSH agent operations.

func ConnectAgent

func ConnectAgent(socketPath string) (AgentClient, error)

ConnectAgent connects to an SSH agent at the given socket path.

type AuditEvent

type AuditEvent struct {
	Action      string // "list", "sign_allowed", "sign_denied"
	Host        string // target host (for sign operations)
	Fingerprint string // key fingerprint (for sign operations)
	Error       string // error message (for denied operations)
}

AuditEvent represents an auditable SSH agent operation.

type AuditFunc

type AuditFunc func(event AuditEvent)

AuditFunc is a callback for audit logging.

type Identity

type Identity struct {
	KeyBlob []byte
	Comment string
}

Identity represents an SSH key identity from the agent.

func (*Identity) Fingerprint

func (id *Identity) Fingerprint() string

Fingerprint returns the SHA256 fingerprint of the key.

type Proxy

type Proxy struct {
	// contains filtered or unexported fields
}

Proxy is a filtering SSH agent proxy that only exposes keys for granted hosts.

func NewProxy

func NewProxy(upstream AgentClient) *Proxy

NewProxy creates a new filtering SSH agent proxy.

func (*Proxy) AllowKey

func (p *Proxy) AllowKey(fingerprint string, hosts []string)

AllowKey permits a key (by fingerprint) for specific hosts.

func (*Proxy) Close

func (p *Proxy) Close() error

Close closes the upstream connection.

func (*Proxy) GetCurrentHost

func (p *Proxy) GetCurrentHost() string

GetCurrentHost returns the current target host.

func (*Proxy) List

func (p *Proxy) List() ([]*Identity, error)

List returns only the identities that are allowed by the proxy.

func (*Proxy) SetAuditFunc

func (p *Proxy) SetAuditFunc(fn AuditFunc)

SetAuditFunc sets the audit callback function.

func (*Proxy) SetCurrentHost

func (p *Proxy) SetCurrentHost(host string)

SetCurrentHost sets the target host for sign request validation. This is called by the SSH wrapper to indicate which host is being connected to.

func (*Proxy) Sign

func (p *Proxy) Sign(key *Identity, data []byte) ([]byte, error)

Sign forwards a sign request if the key is allowed for the current host.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server listens for SSH agent protocol connections and proxies requests. It can listen on either a Unix socket or TCP, depending on configuration.

func NewServer

func NewServer(proxy *Proxy, socketPath string) *Server

NewServer creates a new SSH agent server listening on a Unix socket.

func NewTCPServer

func NewTCPServer(proxy *Proxy, addr string) *Server

NewTCPServer creates a new SSH agent server listening on TCP. The addr should be in the form "host:port" or ":port".

func (*Server) Proxy

func (s *Server) Proxy() *Proxy

Proxy returns the underlying filtering proxy.

func (*Server) SocketPath

func (s *Server) SocketPath() string

SocketPath returns the path to the Unix socket (empty if using TCP).

func (*Server) Start

func (s *Server) Start() error

Start begins listening on either Unix socket or TCP, depending on configuration.

func (*Server) Stop

func (s *Server) Stop() error

Stop gracefully shuts down the server.

func (*Server) TCPAddr

func (s *Server) TCPAddr() string

TCPAddr returns the TCP address the server is listening on. Returns empty string if not using TCP or not yet started.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL