New YAML config option: accept_any_key: true
- Accepts any public key without verification against authorized_keys
- Still passes the client's key fingerprint in the upstream username
- Format: fp:FINGERPRINT.originaluser
- Useful for proxying to apps that identify users by SSH key fingerprint
* fix typos in docs
* use keys in named literal
For easier grepping, and better stability.
* libplugin: regenerate with v1.36.10
592ca79999 upgraded
the dependency, but didn't actually regenerate.
* all: run gofumpt
https://github.com/mvdan/gofumpt
The main appeal for me here is that my (and many other peoples')
editors run this on save, so doing a single diff here
keeps other diffs minimal.
* .github/workflows: add gofumpt checker
* fix lint
* Bump golangci-lint action to v8 and update linting args
* fix lint errors
* fix: correct loop condition in main function to process remaining arguments
* feat: Decide upstream based on user's unix group membership
If a username is not defined, groupname is parsed. Check if the
user is part of that group and route them to the associated host
defined in the config file for the yaml plugin
* style: fix formatting with gofmt
* feat: Look up user groups only when groupname defined in yaml config
* fix: inefficient assignment because of unused var
* feat: fallback to next rule on group lookup failure
Instead of failing on group lookup errors, the matcher now skips the
groupname rule and proceeds to the next, eventually failing through to
the catchall rule.
* feat: test cases for group based routing in yaml plugin
* Revert "feat: fallback to next rule on group lookup failure"
This reverts commit 622ee9f1eb3157d04f57c068179bb74de8db3a1f.
Handles the error returned by getUserGroups instead of ignoring it,
to prevent potential runtime issues when user lookup fail
* feat: Check if a user is known to the system before group lookup
This will let the rule matching logic skip to the next pipe in the yaml
config when a user is not found on the system.
Note the variable name change from user to username to avoid ambiguity
dur to name collision with os/user package.
* feat: Avoid redundant user lookup
* feat: Improve error handling for user and group lookup failures
* feat: Use appropriate test user name for group routing
* introduce plugin skel to reuse code
* Refactor code to use libplugin.NewSkelPlugin for plugin/kubernetes/main.go
Add YAML Plugin skel.go for plugin/yaml
* Fix code scanning alert no. 6: Incorrect conversion between integer types
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* fix gpt
* fjx password handling in SkelPlugin and skelpipeToWrapper
* go fmt
* Refactor Docker plugin to use skelpipe wrapper
* Refactor skel.go to use container username instead of client username
* revert yaml test order
* fix public and password mess up
* Refactor working dir to use skel
* revert deleted file
* Refactor skel.go to remove unused code and simplify MatchConn function
* Refactor skel.go to read userKnownHosts file in KnownHosts function
* remove workingdirbykey from goreleaser
* Refactor workingdir.go to use libplugin.SplitHostPortForSSH for parsing host and port
* Refactor skel.go to remove unused code and simplify MatchConn function
* merge doc into workingdir
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* add coverage for go proxy
* Refactor CLI flag name for allowed proxy addresses
* Refactor YAML schema to support multiple authorized keys and known hosts
* add testcases
* Refactor YAML schema to support multiple authorized keys and known hosts
* go fmt
* go fmt
