Documentation
¶
Overview ¶
Package sshkey wraps the parsing, validation, and fingerprinting of user-supplied SSH public keys. Every entry that takes key material from outside (the settings handlers, future imports, the AKC binary's equality checks) goes through this package so policy lives in exactly one place.
Index ¶
Constants ¶
const MaxKeysPerUser = 100
MaxKeysPerUser is the cap enforced at the handler layer. Keeps DB rows per-user bounded and limits AKC lookup amplification if an attacker registered an enormous keyring on a single account.
const MinRSABits = 2048
MinRSABits is the smallest accepted modulus length for ssh-rsa keys.
Variables ¶
var ( ErrUnsupportedAlgo = errors.New("sshkey: unsupported key algorithm") ErrRSATooShort = fmt.Errorf("sshkey: RSA keys must be at least %d bits", MinRSABits) ErrUnparseable = errors.New("sshkey: could not parse key — paste the contents of your .pub file") ErrTitleEmpty = errors.New("sshkey: title required") ErrTitleTooLong = errors.New("sshkey: title may be at most 80 characters") ErrTitleControl = errors.New("sshkey: title contains control characters") )
Errors. Keep them precise enough for the settings handler to render a useful UI string.
Functions ¶
func FingerprintOf ¶
FingerprintOf returns the canonical SHA256 fingerprint for an already-parsed key. Used by the AKC binary's equality checks.
Types ¶
type Parsed ¶
type Parsed struct {
Title string
Type string // OpenSSH algorithm name, e.g. "ssh-ed25519"
Bits int // 0 when not meaningful (e.g. ed25519)
Fingerprint string // canonical SHA256:<base64-no-padding>
// PublicKey is the canonical authorized_keys line (no comment; no
// trailing newline). It is what the AKC binary re-emits on a hit.
PublicKey string
}
Parsed is the validated, ready-to-store representation of a user-supplied SSH public key. Title is whatever name the user typed; everything else is derived from the key blob.
Source Files