engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add knownhosts support

Browse source
This commit is contained in:
Boshi Lian 2019-01-07 01:44:35 -08:00
parent fc9cd704db
commit 1b9ad2dac4
2 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
sshpiperd/upstream/workingdir/config.go
View file

@ -6,5 +6,6 @@ var (
AllowBadUsername bool `long:"upstream-workingdir-allowbadusername" description:"Disable username check while search the working dir" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_ALLOWBADUSERNAME" ini-name:"upstream-workingdir-allowbadusername"`
NoCheckPerm bool `long:"upstream-workingdir-nocheckperm" description:"Disable 0400 checking when using files in the working dir" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_NOCHECKPERM" ini-name:"upstream-workingdir-nocheckperm"`
FallbackUsername string `long:"upstream-workingdir-fallbackusername" description:"Fallback to a user when user does not exists in directory" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_FALLBACKUSERNAME" ini-name:"upstream-workingdir-fallbackusername"`
StrictHostKey bool `long:"upstream-workingdir-stricthostkey" description:"upstream host public key must in known_hosts file, otherwise drop the connection" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_STRICTHOSTKEY" ini-name:"upstream-workingdir-stricthostkey"`
}{}
)

14
sshpiperd/upstream/workingdir/workingdir.go
View file

@ -10,6 +10,7 @@ import (
"bytes"
"fmt"
"github.com/tg123/sshpiper/sshpiperd/upstream"
"golang.org/x/crypto/ssh/knownhosts"
"io/ioutil"
"net"
"os"
@ -26,6 +27,7 @@ var (
userAuthorizedKeysFile userFile = "authorized_keys"
userKeyFile userFile = "id_rsa"
userUpstreamFile userFile = "sshpiper_upstream"
userKnownHosts userFile = "known_hosts"
usernameRule *regexp.Regexp
)
@ -144,6 +146,16 @@ func findUpstreamFromUserfile(conn ssh.ConnMetadata) (net.Conn, *ssh.AuthPipe, e
return nil, nil, err
}
hostKeyCallback := ssh.InsecureIgnoreHostKey()
if config.StrictHostKey {
hostKeyCallback, err = knownhosts.New(userKnownHosts.realPath(user))
if err != nil {
return nil, nil, err
}
}
return c, &ssh.AuthPipe{
User: mappedUser,
@ -158,7 +170,7 @@ func findUpstreamFromUserfile(conn ssh.ConnMetadata) (net.Conn, *ssh.AuthPipe, e
return ssh.AuthPipeTypeMap, ssh.PublicKeys(signer), nil
},
UpstreamHostKeyCallback: ssh.InsecureIgnoreHostKey(), // TODO should support by config
UpstreamHostKeyCallback: hostKeyCallback,
}, nil
}