engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add support for using CA certs for upstream ssh connection (#210)

Browse source
This commit is contained in:
Matthew Atkinson 2023-08-25 17:32:49 -07:00 • committed by GitHub
parent 36f03e7a74
commit 13fcc8c0a8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 473 additions and 250 deletions
Download patch file Download diff file Expand all files Collapse all files

18
cmd/sshpiperd/internal/plugin/grpc.go
View file

@ -332,6 +332,24 @@ func (g *GrpcPlugin) createUpstream(conn ssh.ConnMetadata, challengeCtx ssh.Chal
if err != nil {
return nil, err
}
if caPublicKeyByte := a.GetCaPublicKey(); caPublicKeyByte != nil {
caPublicKey, _, _, _, err := ssh.ParseAuthorizedKey(caPublicKeyByte)
if err != nil {
return nil, err
}
caCertificate, ok := caPublicKey.(*ssh.Certificate)
if !ok {
return nil, fmt.Errorf("Failed to convert the caPublicKey to an ssh.Certificate")
}
private, err = ssh.NewCertSigner(caCertificate, private)
if err != nil {
return nil, err
}
}
config.Auth = append(config.Auth, ssh.PublicKeys(private))
auth = append(auth, "privatekey")
}