engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add accept_any_key option to accept any SSH key and pass fingerprint

Browse source 
New YAML config option: accept_any_key: true
- Accepts any public key without verification against authorized_keys
- Still passes the client's key fingerprint in the upstream username
- Format: fp:FINGERPRINT.originaluser
- Useful for proxying to apps that identify users by SSH key fingerprint
This commit is contained in:
Russell Ballestrini 2025-12-21 09:05:05 -05:00
parent 065a7c359e
commit 56577b727e
3 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugin/yaml/skel.go
View file

@ -172,6 +172,10 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
})
}
func (s *skelpipePublicKeyWrapper) AcceptAnyKey() bool {
return s.from.AcceptAnyKey
}
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
p, err := s.config.loadFileOrDecode(s.to.PrivateKey, s.to.PrivateKeyData, map[string]string{
"DOWNSTREAM_USER": conn.User(),

3
plugin/yaml/yaml.go
View file

@ -21,10 +21,11 @@ type yamlPipeFrom struct {
AuthorizedKeysData listOrString `yaml:"authorized_keys_data,omitempty"`
TrustedUserCAKeys listOrString `yaml:"trusted_user_ca_keys,omitempty"`
TrustedUserCAKeysData listOrString `yaml:"trusted_user_ca_keys_data,omitempty"`
AcceptAnyKey bool `yaml:"accept_any_key,omitempty"`
}
func (f yamlPipeFrom) SupportPublicKey() bool {
return f.AuthorizedKeys.Any() || f.AuthorizedKeysData.Any() || f.TrustedUserCAKeys.Any() || f.TrustedUserCAKeysData.Any()
return f.AcceptAnyKey || f.AuthorizedKeys.Any() || f.AuthorizedKeysData.Any() || f.TrustedUserCAKeys.Any() || f.TrustedUserCAKeysData.Any()
}
type yamlPipeTo struct {