func AgentRequested(sessSession)bool

func DefaultSessionHandler(srv *Server, conn *gossh.ServerConn, newChangossh.NewChannel, ctxContext)

func DirectTCPIPHandler(srv *Server, conn *gossh.ServerConn, newChangossh.NewChannel, ctxContext)

func ForwardAgentConnections(lnet.Listener, sSession)

func Handle(handlerHandler)

func KeysEqual(ak, bkPublicKey)bool

func ListenAndServe(addrstring, handlerHandler, options ...Option)error

func NewAgentListener() (net.Listener,error)

func Serve(lnet.Listener, handlerHandler, options ...Option)error

func SetAgentRequested(ctxContext)

type BannerHandler func(ctxContext)string

type ChannelHandler func(srv *Server, conn *gossh.ServerConn, newChangossh.NewChannel, ctxContext)

type ConnCallback func(ctxContext, connnet.Conn)net.Conn

type ConnectionFailedCallback func(connnet.Conn, errerror)

type Context interface {context.Contextsync.Locker// User returns the username used when establishing the SSH connection.User()string// SessionID returns the session hash.SessionID()string// ClientVersion returns the version reported by the client.ClientVersion()string// ServerVersion returns the version reported by the server.ServerVersion()string// RemoteAddr returns the remote address for this connection.RemoteAddr()net.Addr// LocalAddr returns the local address for this connection.LocalAddr()net.Addr// Permissions returns the Permissions object used for this connection.Permissions() *Permissions// SetValue allows you to easily write new values into the underlying context.SetValue(key, value interface{})}

type ForwardedTCPHandler struct {sync.Mutex// contains filtered or unexported fields}

func (*ForwardedTCPHandler)HandleSSHRequest¶

func (h *ForwardedTCPHandler) HandleSSHRequest(ctxContext, srv *Server, req *gossh.Request) (bool, []byte)

type Handler func(Session)

var DefaultHandlerHandler

DefaultHandler is the default Handler used by Serve.

type KeyboardInteractiveHandler func(ctxContext, challengergossh.KeyboardInteractiveChallenge)bool

type LocalPortForwardingCallback func(ctxContext, destinationHoststring, destinationPortuint32)bool

type NoClientAuthHandler func(ctxContext)error

type Option func(*Server)error

funcHostKeyFile¶

func HostKeyFile(filepathstring)Option

HostKeyFile returns a functional option that adds HostSigners to the serverfrom a PEM file at filepath.

package mainimport ("tailscale.com/tempfork/gliderlabs/ssh")func main() {ssh.ListenAndServe(":2222", nil, ssh.HostKeyFile("/path/to/host/key"))}

funcHostKeyPEM¶

func HostKeyPEM(bytes []byte)Option

HostKeyPEM returns a functional option that adds HostSigners to the serverfrom a PEM file as bytes.

funcKeyboardInteractiveAuth¶

func KeyboardInteractiveAuth(fnKeyboardInteractiveHandler)Option

funcNoPty¶

func NoPty()Option

NoPty returns a functional option that sets PtyCallback to return false,denying PTY requests.

package mainimport ("tailscale.com/tempfork/gliderlabs/ssh")func main() {ssh.ListenAndServe(":2222", nil, ssh.NoPty())}

funcPasswordAuth¶

func PasswordAuth(fnPasswordHandler)Option

PasswordAuth returns a functional option that sets PasswordHandler on the server.

package mainimport ("tailscale.com/tempfork/gliderlabs/ssh")func main() {ssh.ListenAndServe(":2222", nil,ssh.PasswordAuth(func(ctx ssh.Context, pass string) bool {return pass == "secret"}),)}

funcPublicKeyAuth¶

func PublicKeyAuth(fnPublicKeyHandler)Option

PublicKeyAuth returns a functional option that sets PublicKeyHandler on the server.

package mainimport ("errors""os""tailscale.com/tempfork/gliderlabs/ssh")func main() {ssh.ListenAndServe(":2222", nil,ssh.PublicKeyAuth(func(ctx ssh.Context, key ssh.PublicKey) error {data, err := os.ReadFile("/path/to/allowed/key.pub")if err != nil {return err}allowed, _, _, _, err := ssh.ParseAuthorizedKey(data)if err != nil {return err}if !ssh.KeysEqual(key, allowed) {return errors.New("some error")}return nil}),)}

funcWrapConn¶

func WrapConn(fnConnCallback)Option

WrapConn returns a functional option that sets ConnCallback on the server.

type PasswordHandler func(ctxContext, passwordstring)bool

type Permissions struct {*gossh.Permissions}

type Pty struct {// Term is the TERM environment variable value.Termstring// Window is the Window sent as part of the pty-req.WindowWindow// Modes represent a mapping of Terminal Mode opcode to value as it was// requested by the client as part of the pty-req. These are outlined as// part ofhttps://datatracker.ietf.org/doc/html/rfc4254#section-8.//// The opcodes are defined as constants in golang.org/x/crypto/ssh (VINTR,VQUIT,etc.).// Boolean opcodes have values 0 or 1.Modesgossh.TerminalModes}

type PtyCallback func(ctxContext, ptyPty)bool

type PublicKey interface {gossh.PublicKey}

funcParseAuthorizedKey¶

func ParseAuthorizedKey(in []byte) (outPublicKey, commentstring, options []string, rest []byte, errerror)

ParseAuthorizedKey parses a public key from an authorized_keys file used inOpenSSH according to the sshd(8) manual page.

funcParsePublicKey¶

func ParsePublicKey(in []byte) (outPublicKey, errerror)

ParsePublicKey parses an SSH public key formatted for use inthe SSH wire protocol according toRFC 4253, section 6.6.

type PublicKeyHandler func(ctxContext, keyPublicKey)error

type RequestHandler func(ctxContext, srv *Server, req *gossh.Request) (okbool, payload []byte)

type ReversePortForwardingCallback func(ctxContext, bindHoststring, bindPortuint32)bool

type Server struct {Addrstring// TCP address to listen on, ":22" if emptyHandlerHandler// handler to invoke, ssh.DefaultHandler if nilHostSigners []Signer// private keys for the host key, must have at least oneVersionstring// server version to be sent before the initial handshakeKeyboardInteractiveHandlerKeyboardInteractiveHandler// keyboard-interactive authentication handlerPasswordHandlerPasswordHandler// password authentication handlerPublicKeyHandlerPublicKeyHandler// public key authentication handlerNoClientAuthHandlerNoClientAuthHandler// no client authentication handlerPtyCallbackPtyCallback// callback for allowing PTY sessions, allows all if nilConnCallbackConnCallback// optional callback for wrapping net.Conn before handlingLocalPortForwardingCallbackLocalPortForwardingCallback// callback for allowing local port forwarding, denies all if nilReversePortForwardingCallbackReversePortForwardingCallback// callback for allowing reverse port forwarding, denies all if nilServerConfigCallbackServerConfigCallback// callback for configuring detailed SSH optionsSessionRequestCallbackSessionRequestCallback// callback for allowing or denying SSH sessionsConnectionFailedCallbackConnectionFailedCallback// callback to report connection failuresIdleTimeouttime.Duration// connection timeout when no activity, none if emptyMaxTimeouttime.Duration// absolute connection timeout, none if empty// ChannelHandlers allow overriding the built-in session handlers or provide// extensions to the protocol, such as tcpip forwarding. By default only the// "session" handler is enabled.ChannelHandlers map[string]ChannelHandler// RequestHandlers allow overriding the server-level request handlers or// provide extensions to the protocol, such as tcpip forwarding. By default// no handlers are enabled.RequestHandlers map[string]RequestHandler// SubsystemHandlers are handlers which are similar to the usual SSH command// handlers, but handle named subsystems.SubsystemHandlers map[string]SubsystemHandler// contains filtered or unexported fields}

func (*Server)AddHostKey¶

func (srv *Server) AddHostKey(keySigner)

AddHostKey adds a private key as a host key. If an existing host key existswith the same algorithm, it is overwritten. Each server config must have atleast one host key.

func (*Server)Close¶

func (srv *Server) Close()error

Close immediately closes all active listeners and all activeconnections.

Close returns any error returned from closing the Server'sunderlying Listener(s).

func (*Server)Handle¶

func (srv *Server) Handle(fnHandler)

Handle sets the Handler for the server.

func (*Server)HandleConn¶

func (srv *Server) HandleConn(newConnnet.Conn)

func (*Server)ListenAndServe¶

func (srv *Server) ListenAndServe()error

ListenAndServe listens on the TCP network address srv.Addr and then callsServe to handle incoming connections. If srv.Addr is blank, ":22" is used.ListenAndServe always returns a non-nil error.

func (*Server)Serve¶

func (srv *Server) Serve(lnet.Listener)error

Serve accepts incoming connections on the Listener l, creating a newconnection goroutine for each. The connection goroutines read requests and thencalls srv.Handler to handle sessions.

Serve always returns a non-nil error.

func (*Server)SetOption¶

func (srv *Server) SetOption(optionOption)error

SetOption runs a functional option against the server.

func (*Server)Shutdown¶

func (srv *Server) Shutdown(ctxcontext.Context)error

Shutdown gracefully shuts down the server without interrupting anyactive connections. Shutdown works by first closing all openlisteners, and then waiting indefinitely for connections to close.If the provided context expires before the shutdown is complete,then the context's error is returned.

type ServerConfigCallback func(ctxContext) *gossh.ServerConfig

type Session interface {gossh.Channel// User returns the username used when establishing the SSH connection.User()string// RemoteAddr returns the net.Addr of the client side of the connection.RemoteAddr()net.Addr// LocalAddr returns the net.Addr of the server side of the connection.LocalAddr()net.Addr// Environ returns a copy of strings representing the environment set by the// user for this session, in the form "key=value".Environ() []string// Exit sends an exit status and then closes the session.Exit(codeint)error// Command returns a shell parsed slice of arguments that were provided by the// user. Shell parsing splits the command string according to POSIX shell rules,// which considers quoting not just whitespace.Command() []string// RawCommand returns the exact command that was provided by the user.RawCommand()string// Subsystem returns the subsystem requested by the user.Subsystem()string// PublicKey returns the PublicKey used to authenticate. If a public key was not// used it will return nil.PublicKey()PublicKey// Context returns the connection's context. The returned context is always// non-nil and holds the same data as the Context passed into auth// handlers and callbacks.//// The context is canceled when the client's connection closes or I/O// operation fails.Context()context.Context// Permissions returns a copy of the Permissions object that was available for// setup in the auth handlers via the Context.Permissions()Permissions// Pty returns PTY information, a channel of window size changes, and a boolean// of whether or not a PTY was accepted for this session.Pty() (Pty, <-chanWindow,bool)// Signals registers a channel to receive signals sent from the client. The// channel must handle signal sends or it will block the SSH request loop.// Registering nil will unregister the channel from signal sends. During the// time no channel is registered signals are buffered up to a reasonable amount.// If there are buffered signals when a channel is registered, they will be// sent in order on the channel immediately after registering.Signals(c chan<-Signal)// Break regisers a channel to receive notifications of break requests sent// from the client. The channel must handle break requests, or it will block// the request handling loop. Registering nil will unregister the channel.// During the time that no channel is registered, breaks are ignored.Break(c chan<-bool)// DisablePTYEmulation disables the session's default minimal PTY emulation.// If you're setting the pty's termios settings from the Pty request, use// this method to avoid corruption.// Currently (2022-03-12) the only emulation implemented is NL-to-CRNL translation (`\n`=>`\r\n`).// A call of DisablePTYEmulation must precede any call to Write.DisablePTYEmulation()}

type SessionRequestCallback func(sessSession, requestTypestring)bool

type Signalstring

const (SIGABRTSignal = "ABRT"SIGALRMSignal = "ALRM"SIGFPESignal = "FPE"SIGHUPSignal = "HUP"SIGILLSignal = "ILL"SIGINTSignal = "INT"SIGKILLSignal = "KILL"SIGPIPESignal = "PIPE"SIGQUITSignal = "QUIT"SIGSEGVSignal = "SEGV"SIGTERMSignal = "TERM"SIGUSR1Signal = "USR1"SIGUSR2Signal = "USR2")

POSIX signals as listed inRFC 4254 Section 6.10.

type Signer interface {gossh.Signer}

type SubsystemHandler func(sSession)

type Window struct {// Width is the number of columns.// It overrides WidthPixels.Widthint// Height is the number of rows.// It overrides HeightPixels.Heightint// WidthPixels is the drawable width of the window, in pixels.WidthPixelsint// HeightPixels is the drawable height of the window, in pixels.HeightPixelsint}