add skel plugin for code sharing (#473 )

* introduce plugin skel to reuse code

* Refactor code to use libplugin.NewSkelPlugin for plugin/kubernetes/main.go
Add YAML Plugin skel.go for plugin/yaml

* Fix code scanning alert no. 6: Incorrect conversion between integer types

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix gpt

* fjx password handling in SkelPlugin and skelpipeToWrapper

* go fmt

* Refactor Docker plugin to use skelpipe wrapper

* Refactor skel.go to use container username instead of client username

* revert yaml test order

* fix public and password mess up

* Refactor working dir to use skel

* revert deleted file

* Refactor skel.go to remove unused code and simplify MatchConn function

* Refactor skel.go to read userKnownHosts file in KnownHosts function

* remove workingdirbykey from goreleaser

* Refactor workingdir.go to use libplugin.SplitHostPortForSSH for parsing host and port

* Refactor skel.go to remove unused code and simplify MatchConn function

* merge doc into workingdir

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

2024-10-24 23:15:26 -07:00

2.6 KiB

Raw Blame History

Working Directory plugin for sshpiperd

Working Dir is a /home-like directory. sshpiperd read files from workingdir/[username]/ to know upstream's configuration.

e.g.

workingdir tree

.
├── github
│   └── sshpiper_upstream
└── linode
    └── sshpiper_upstream

when ssh sshpiper_host -l github, sshpiper reads workingdir/github/sshpiper_upstream and the connect to the upstream.

Usage

sshpiperd workingdir --root /var/sshpiper

options (allow supported read from environments)

--allow-baduser-name  allow bad username (default: false) [$SSHPIPERD_WORKINGDIR_ALLOWBADUSERNAME]
--no-check-perm       disable 0400 checking (default: false) [$SSHPIPERD_WORKINGDIR_NOCHECKPERM]
--no-password-auth    disable password authentication and only use public key authentication (default: false) [$SSHPIPERD_WORKINGDIR_NOPASSWORD_AUTH]
--root value          path to root working directory (default: "/var/sshpiper") [$SSHPIPERD_WORKINGDIR_ROOT]
--strict-hostkey      upstream host public key must be in known_hosts file, otherwise drop the connection (default: false) [$SSHPIPERD_WORKINGDIR_STRICTHOSTKEY]

User files

These file MUST NOT be accessible to group or other. (chmod og-rwx filename)

sshpiper_upstream
- line starts with # are treated as comment
- only the first not comment line will be parsed
- if no port was given, 22 will be used as default
- if user@ was defined, username to upstream will be the mapped one

# comment
[user@]upstream[:22]

e.g. 

git@github.com

google.com:12345

authorized_keys

OpenSSH format authorized_keys (see ~/.ssh/authorized_keys). downstream's public key must be in this file to get verified in order to use id_rsa to login to upstream.
id_rsa

RSA key for upstream.
known_hosts

when --strict-hostkey is set, upstream server's public key must present in known_hosts

Recursive mode (--recursive-search)

--recursive-search will search all sub directories of the username directory to find the downstream key in authorized_keys file.

├── git
│   ├── bitbucket
│   │   └── sshpiper_upstream
│   ├── github
│   │   ├── authorized_keys
│   │   ├── id_rsa
│   │   └── sshpiper_upstream
│   └── gitlab
│       └── sshpiper_upstream
├── linode....

FAQ

Q: why sshpiperd still asks for password even I disabled password auth in upstream (different behavior from v0)

A: you may want --no-password-auth, see https://github.com/tg123/sshpiper/issues/97

2.6 KiB Raw Blame History