Over the last few weeks the exp/ssh package has been bubbling away quietly.
Firstly, the Client has finally grown support for publickey authentication. In place of handing over your username and password to the ClientConfig, now you can specify a number of ClientAuth implementations that will be negotiated with the remote server.
To use publickey authentication you need to supply your own type that implements the ClientKeyring interface. Here is a simple example, but more complicated intergrations with operating system keyrings is possible.
// keyring implements the ClientKeyring interface
type keyring struct {
keys []*rsa.PrivateKey
}
func (k *keyring) Key(i int) (interface{}, error) {
if i < 0 || i >= len(k.keys) {
return nil, nil
}
return k.keys[i].PublicKey, nil
}
func (k *keyring) Sign(i int, rand io.Reader, data []byte) (sig []byte, err error) {
hashFunc := crypto.SHA1
h := hashFunc.New()
h.Write(data)
digest := h.Sum()
return rsa.SignPKCS1v15(rand, k.keys[i], hashFunc, digest)
}
func (k *keyring) loadPEM(file string) error {
buf, err := ioutil.ReadFile(file)
if err != nil {
return err
}
block, _ := pem.Decode(buf)
if block == nil {
return errors.New("ssh: no key found")
}
r, err := x509.ParsePKCS1PrivateKey(block.Bytes)
if err != nil {
return err
}
k.keys = append(k.keys, r)
return nil
}
Because of the change to ClientAuth, if you want to use password authentication you will need to pass a type that implements ClientPassword.
// password implements the ClientPassword interface
type password string
func (p password) Password(user string) (string, error) {
return string(p), nil
}
Tying it all together, Client authentication now looks like this:
func main() {
k := new(keyring)
err := k.LoadPEM("/path/to/your/privatekey")
if err != nil { ... }
config := &ssh.ClientConfig {
User: "yourusername",
Auth: []ssh.ClientAuth {
// ClientAuthPassword wraps a ClientPassword implementation
// in a type that implements ClientAuth.
ssh.ClientAuthPassword(password("yourpassword")),
// ClientAuthPublickey wraps a ClientKeyring implementation
// in a type that implements ClientAuth.
ssh.ClientAuthPublickey(k),
}
}
conn, err := ssh.Dial("tcp", "yourserver:22", config)
if err != nil { ... }
}
Secondly, John Beisley has committed the first of a series of CLs that improves cipher handling in both the Client and Server. The commit includes support for AES and ARC4 ciphers and lays the groundwork for adding additional ciphers.
No changes are needed in client code to take advantage of these cipher improvements, the zero value for CryptoConfig in the ClientConfig struct defaults to a list of secure modern ciphers.
Finally, experimental support has been added to the ClientConn type for initiating direct-tcpip connections over SSH connections. The interface matches net.Dial and returns a net.Conn implementation. This allows the SSH clients, where supported, to tunnel TCP connections via the server.
// Dial an SSH server running on yourserver.com
c1, err := ssh.Dial("tcp", "yourserver.com:22", ... )
if err != nil { ... }
// Dial news.yc via a tunnel to yourserver.com
c2, err := c1.DialTCP("tcp", "news.ycombinator.org:80")
if err != nil { ... }
All of these are available in the current Go weekly, weekly.2011-11-18. Thanks to the intrepid souls who have already begun to explore the the exp/ssh package. I look forward to hearing about your adventures on golang-nuts.
But wait, there’s more. If you’re keen to live right on the bleeding +tip, this commit has made some improvements to the way interactive Sessions work. The goal is to follow the os/exec API, making Sessions more akin the to exec.Cmds. This features is very new, so I hope to post more as it solidifies after the next weekly.