shellaccess

Documentation

Overview

Package shellaccess provides an API for accessing shellbar. Shellaccess is aware of the roles of hosts and clients in establishing ssh connections, and will allocate unique connections to new clients. It requires shellbar to trigger the SSH host to connect AFTER the client has connected, because SSH is a server-speaks-first protocol. Hence shellaccess does not need to transmit the URI of the unique connection to the host because shellbar will do this when the client makes its websocket connection. There is no guarantee a host is connected at any given time, and if it drops its management channel which is connected to the base session_id, then it cannot be reached. As shellbar puts a websocket wrapper around the already-encrypted TCP/IP, the communication remains encrypted end-to-end. For more details on SSH security properties, see https://docstore.mik.ua/orelly/networking_2ndEd/ssh/ch03_01.htm

Index

• func API(closed <-chan struct{}, wg *sync.WaitGroup, port int, ...)
• func Token(audience, ct, topic, secret string, scopes []string, iat, nbf, exp int64) (string, error)

Functions

func API

func API(closed <-chan struct{}, wg *sync.WaitGroup, port int, host, secret, target string, cs *ttlcode.CodeStore)

API starts the API Inputs @closed - channel will be closed when server shutsdown @wg - waitgroup, we must wg.Done() when we are shutdown @port - where to listen locally @host - external FQDN of the host (for checking against tokens) e.g. https://relay-access.practable.io @target - FQDN of the relay instance e.g. wss://relay.practable.io @secret- HMAC shared secret which incoming tokens will be signed with @cs - pointer to the CodeStore this API shares with the shellbar websocket relay @options - for future backwards compatibility (no options currently available)

func Token

func Token(audience, ct, topic, secret string, scopes []string, iat, nbf, exp int64) (string, error)

Token returns a signed token