tskagent

README

tskagent

(T)ailscale (S)SH (K)ey Agent, a Go implementation of an SSH agent that stores keys in setec.

Documentation

Overview

Package tskagent implements an SSH key agent backed by the setec service.

A Server implements an agent.Agent that serves SSH keys stored in the specified setec server. Each secret whose name matches a designated prefix and contains an SSH private key in OpenSSH PEM format is offered by the agent to callers on the local system.

Index

• type Config
• type Server
  • func NewServer(config Config) *Server
  • func (s *Server) Add(key agent.AddedKey) error
  • func (s *Server) List() ([]*agent.Key, error)
  • func (s *Server) Lock(passphrase []byte) error
  • func (s *Server) Remove(key ssh.PublicKey) error
  • func (s *Server) RemoveAll() error
  • func (s *Server) Serve(ctx context.Context, lst net.Listener)
  • func (s *Server) ServeOne(conn io.ReadWriter) error
  • func (s *Server) Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, error)
  • func (s *Server) Signers() ([]ssh.Signer, error)
  • func (s *Server) Unlock(passphrase []byte) error
  • func (s *Server) Update(ctx context.Context) error

Types

type Config

type Config struct {
	// Client is the client for the secrets service. It must be set.
	Client setec.Client

	// Prefix is the secret name prefix to be served.  It must be non-empty.
	Prefix string

	// Logf, if set, is used to write logs. If nil, logs are discarded.
	Logf func(string, ...any)
}

Config carries the settings for a Server.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server implements the SSH key agent server protocol. The caller must call agent.ServeAgent to expose the server to clients.

func NewServer

func NewServer(config Config) *Server

NewServer constructs a new Server that fetches SSH keys matching the specified configuration in setec.

The caller must call Server.Update at least once to initialize the list of keys available to the agent. Thereafter, the caller may call Update again as often as desired to update the list. The server does not automatically perform updates.

func (*Server) Add

func (s *Server) Add(key agent.AddedKey) error

Add implements part of the agent.Agent interface. This implementation does not support adding keys.

func (*Server) List

func (s *Server) List() ([]*agent.Key, error)

List implements part of the agent.Agent interface.

func (*Server) Lock

func (s *Server) Lock(passphrase []byte) error

Lock implements part of the agent.Agent interface.

func (*Server) Remove

func (s *Server) Remove(key ssh.PublicKey) error

Remove implements part of the agent.Agent interface.

This implementation only removes the key from the local list, it does not affect what is stored on the secrets server.

func (*Server) RemoveAll

func (s *Server) RemoveAll() error

RemoveAll implements part of the agent.Agent interface.

This implementation only removes keys from the local list, it does not affect what is stored on the secrets server.

func (*Server) Serve

func (s *Server) Serve(ctx context.Context, lst net.Listener)

Serve accepts connections from lst and serve the agent to each in its own goroutine. It runs until lst closes or ctx ends.

func (*Server) ServeOne

func (s *Server) ServeOne(conn io.ReadWriter) error

ServeOne serves the agent to the specified connection. It is safe to call ServeOne concurrently from multiple goroutines with separate connections, including while Serve is running.

func (*Server) Sign

func (s *Server) Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, error)

Sign implements part of the agent.Agent interface.

func (*Server) Signers

func (s *Server) Signers() ([]ssh.Signer, error)

Signers implements part of the agent.Agent interface.

func (*Server) Unlock

func (s *Server) Unlock(passphrase []byte) error

Unlock implements part of the agent.Agent interface.

func (*Server) Update

func (s *Server) Update(ctx context.Context) error

Update attempts to update the list of keys from the secrets service. It is safe to call Update concurrently with client access. In case of error, the existing list of keys is not modified.