Public Access
jaap-jan
38ab9b431b
A Spelunk route can now say that Spelunk signs the user in. Each connection makes a throwaway Ed25519 key pair in memory, sends the public half with the ticket request ({"signIn":{"publicKey":...}}), and logs in as the account Spelunk names (root when it names none) with that key, over the agent's one-connection sshd. Such a host needs no username, key, credential or typed password: the editor greys the login out and saves none, the password box and sheet stay down, and shells, file transfer and port forwards all take the key and account from the route. The flag is nested in the spelunk object at host schema version 10; hosts without it keep their version-9 bytes.
A dodossh://spelunk/connect link now connects: to the personal vault's host tagged spelunk for that server, or, when a saved host already sends an API key to that Spelunk, to a new sign-in host saved in the personal vault with that key and the spelunk tag (made if missing). Only the first link from a Spelunk opens the editor, pre-filled with sign-in ticked and the tag on, so the key credential is chosen once and never sent to an address no saved host already sends it to.
82 lines
3.4 KiB
C#
82 lines
3.4 KiB
C#
using System.Text;
|
|
using DodoSSH.Client.Ssh;
|
|
|
|
namespace DodoSSH.Client.Session;
|
|
|
|
/// <summary>
|
|
/// The throwaway key one connection signs in to a Spelunk server with.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// For a host set to sign in through Spelunk — see <c>SpelunkRoute.SignInThroughSpelunk</c> — each connection
|
|
/// makes one of these, sends <see cref="PublicKeyLine"/> with its ticket request, and authenticates with
|
|
/// <see cref="Credential"/> once the tunnel is up. Spelunk's agent runs a one-connection SSH server whose only
|
|
/// authorised key is this one, so the key is worth nothing after the connection it was made for.
|
|
/// </para>
|
|
/// <para>
|
|
/// <b>Made in memory and never kept.</b> Nothing writes it to a disk or to the vault, and nothing logs it:
|
|
/// <see cref="ToString"/> says what it is and nothing of what it holds. Ed25519, which is what
|
|
/// <see cref="SshKeyGenerator"/> makes instantly and what every OpenSSH the agent could start accepts.
|
|
/// </para>
|
|
/// </remarks>
|
|
public sealed class SpelunkSignIn
|
|
{
|
|
/// <summary>The account Spelunk signs in as when its answer does not name one.</summary>
|
|
public const string DefaultUser = "root";
|
|
|
|
/// <summary>The comment the public key carries, which is what Spelunk and the server's logs see.</summary>
|
|
internal const string KeyComment = "dodossh-spelunk-sign-in";
|
|
|
|
private SpelunkSignIn(string publicKeyLine, SshPrivateKeyCredential credential)
|
|
{
|
|
PublicKeyLine = publicKeyLine;
|
|
Credential = credential;
|
|
}
|
|
|
|
/// <summary>The public half, as one OpenSSH <c>authorized_keys</c> line: <c>ssh-ed25519 AAAA… comment</c>.</summary>
|
|
public string PublicKeyLine { get; }
|
|
|
|
/// <summary>The private half, in the form a connection authenticates with.</summary>
|
|
public SshPrivateKeyCredential Credential { get; }
|
|
|
|
/// <summary>Makes a fresh key pair for one connection.</summary>
|
|
public static SpelunkSignIn Create()
|
|
{
|
|
var key = SshKeyGenerator.Generate(SshKeyAlgorithm.Ed25519, KeyComment);
|
|
|
|
return new SpelunkSignIn(
|
|
key.PublicKeyLine.Trim(),
|
|
new SshPrivateKeyCredential(Encoding.UTF8.GetBytes(key.PrivateKeyArmour), Passphrase: null));
|
|
}
|
|
|
|
/// <inheritdoc />
|
|
/// <remarks>Says nothing of the key, so one that reaches a log by accident takes nothing with it.</remarks>
|
|
public override string ToString() => "Spelunk sign-in key";
|
|
}
|
|
|
|
/// <summary>
|
|
/// The credential of a connection that will sign in through Spelunk, before the tunnel has made its key.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// A host that signs in through Spelunk is resolved to a login before anything is opened — the same
|
|
/// resolution every host goes through — but its key does not exist until the tunnel is opened, and the
|
|
/// account is whatever Spelunk then says. This stands in for the key until the route replaces it, together
|
|
/// with the username, as the connection is made through it.
|
|
/// </para>
|
|
/// <para>
|
|
/// <b>It authenticates nothing.</b> The SSH layer knows only passwords and private keys, and refuses any other
|
|
/// credential before it dials — so a path that forgot to take the route's key fails closed rather than
|
|
/// sending something else in its place.
|
|
/// </para>
|
|
/// </remarks>
|
|
public sealed record SpelunkSignInPending : SshCredential
|
|
{
|
|
/// <summary>The one value; there is nothing in it to tell two apart.</summary>
|
|
public static SpelunkSignInPending Instance { get; } = new();
|
|
|
|
private SpelunkSignInPending()
|
|
{
|
|
}
|
|
}
|