Documentation
¶
Overview ¶
Package sshkeys parses, describes, generates and certifies SSH keys (OpenSSH public/private keys, authorized_keys, RFC 4716 and OpenSSH certificates). Encrypted private keys are described without decrypting them whenever the format exposes the public key.
Index ¶
- Constants
- Variables
- func AuthorizedKey(pub ssh.PublicKey, comment string) []byte
- func Generate(a keys.Algorithm, comment string, passphrase []byte) (crypto.Signer, []byte, []byte, error)
- func Marshal(k crypto.PrivateKey, comment string, passphrase []byte) ([]byte, []byte, error)
- func ParseAlgorithm(s string) (keys.Algorithm, error)
- func SignCert(req CertRequest, ca crypto.Signer) (*ssh.Certificate, error)
- func VerifyCert(c *ssh.Certificate, principal string) error
- type CertInfo
- type CertRequest
- type Info
- type Item
Constants ¶
const ( KindPublic = "public" KindPrivate = "private" KindCertificate = "certificate" )
Item kinds.
Variables ¶
var Algorithms = []keys.Algorithm{keys.Ed25519, keys.ECDSAP256, keys.ECDSAP384, keys.ECDSAP521, keys.RSA3072, keys.RSA4096}
Algorithms usable for SSH keys, in the order offered to users.
var DefaultUserExtensions = []string{"permit-X11-forwarding", "permit-agent-forwarding", "permit-port-forwarding", "permit-pty", "permit-user-rc"}
DefaultUserExtensions are what ssh-keygen grants by default.
var ErrNoSSHKey = errors.New("no SSH key found")
ErrNoSSHKey means no SSH key was found.
Functions ¶
func AuthorizedKey ¶
AuthorizedKey renders "type base64 comment\n".
func Generate ¶
func Generate(a keys.Algorithm, comment string, passphrase []byte) (crypto.Signer, []byte, []byte, error)
Generate creates a key pair and returns the OpenSSH private key PEM (encrypted when passphrase is set) and the authorized_keys line.
func ParseAlgorithm ¶
ParseAlgorithm accepts ed25519, ecdsa[-p256|-p384|-p521], rsa[-3072|-4096].
func SignCert ¶
func SignCert(req CertRequest, ca crypto.Signer) (*ssh.Certificate, error)
SignCert issues an OpenSSH certificate. RSA CAs sign with rsa-sha2-512, never SHA-1 ssh-rsa.
func VerifyCert ¶
func VerifyCert(c *ssh.Certificate, principal string) error
VerifyCert checks the certificate signature, validity window and that principal is listed (the first principal when empty).
Types ¶
type CertInfo ¶
type CertInfo struct {
CertType string `json:"cert_type"` // user or host
KeyID string `json:"key_id"`
Serial uint64 `json:"serial"`
Principals []string `json:"principals"`
ValidAfter *time.Time `json:"valid_after,omitempty"`
ValidBefore *time.Time `json:"valid_before,omitempty"` // nil = forever
Status string `json:"status"` // valid, expired, not_yet_valid
CriticalOptions map[string]string `json:"critical_options"`
Extensions []string `json:"extensions"`
CAType string `json:"ca_type"`
CAFingerprint string `json:"ca_fingerprint_sha256"`
SignatureAlgo string `json:"signature_algorithm"`
KeyFingerprint string `json:"key_fingerprint_sha256"`
}
CertInfo describes an OpenSSH certificate.
func DescribeCert ¶
func DescribeCert(c *ssh.Certificate) CertInfo
DescribeCert describes c at the current time.
type CertRequest ¶
type CertRequest struct {
Key ssh.PublicKey
Host bool
KeyID string
Serial uint64 // 0 = random
Principals []string
ValidAfter time.Time
Validity time.Duration // 0 = forever
// Extensions for user certificates; nil = OpenSSH defaults.
Extensions []string
CriticalOptions map[string]string
}
CertRequest describes a certificate to sign.
type Info ¶
type Info struct {
Kind string `json:"kind"`
Format string `json:"format"`
Type string `json:"type"`
Bits int `json:"bits"`
FingerprintSHA256 string `json:"fingerprint_sha256"`
FingerprintMD5 string `json:"fingerprint_md5"`
Comment string `json:"comment,omitempty"`
Options []string `json:"options,omitempty"`
Encrypted bool `json:"encrypted"`
Strength string `json:"strength"`
Notes []string `json:"notes,omitempty"`
Certificate *CertInfo `json:"certificate,omitempty"`
PublicKey string `json:"public_key"` // authorized_keys line
}
Info is the stable description of an SSH key.
type Item ¶
type Item struct {
Kind string
Format string // openssh, pem, authorized_keys, rfc4716
Public ssh.PublicKey
Cert *ssh.Certificate
Comment string
Options []string // authorized_keys options
Encrypted bool
// Private is set only when the key was decrypted (or not encrypted).
Private crypto.PrivateKey
// Raw holds the original private key PEM so it can be stored unchanged
// (still encrypted with its passphrase).
Raw []byte
}
Item is one SSH object found in input.
Source Files