Struct SSHProxyConfig

config/sshproxy.go:15–47

SSHProxyConfig is the configuration for the SSH proxy module.

// SSHProxyConfig is the configuration for the SSH proxy module.
type SSHProxyConfig struct {
	// Server is the IP address or hostname of the backing server.
	Server string `json:"server" yaml:"server"`
	// Port is the TCP port to connect to.
	Port uint16 `json:"port" yaml:"port" default:"22"`
	// UsernamePassThrough means that the username should be taken from the connecting client.
	UsernamePassThrough bool `json:"usernamePassThrough" yaml:"usernamePassThrough"`
	// Username is the username to pass to the backing SSH server for authentication.
	Username string `json:"username" yaml:"username"`
	// Password is the password to offer to the backing SSH server for authentication.
	Password string `json:"password" yaml:"password"`
	// PrivateKey is the private key to use for authenticating with the backing server.
	PrivateKey string `json:"privateKey" yaml:"privateKey"`
	// AllowedHostKeyFingerprints lists which fingerprints we accept
	AllowedHostKeyFingerprints SSHProxyAllowedHostKeyFingerprints `json:"allowedHostKeyFingerprints" yaml:"allowedHostKeyFingerprints"`
	// Ciphers are the ciphers supported for the backend connection.
	Ciphers SSHCipherList `json:"ciphers" yaml:"ciphers" default:"[\"chacha20-poly1305@openssh.com\",\"aes256-gcm@openssh.com\",\"aes128-gcm@openssh.com\",\"aes256-ctr\",\"aes192-ctr\",\"aes128-ctr\"]" comment:"Cipher suites to use"`
	// KexAlgorithms are the key exchange algorithms for the backend connection.
	KexAlgorithms SSHKexList `json:"kex" yaml:"kex" default:"[\"curve25519-sha256@libssh.org\",\"ecdh-sha2-nistp521\",\"ecdh-sha2-nistp384\",\"ecdh-sha2-nistp256\"]" comment:"Key exchange algorithms to use"`
	// MACs are the MAC algorithms for the backend connection.
	MACs SSHMACList `json:"macs" yaml:"macs" default:"[\"hmac-sha2-256-etm@openssh.com\",\"hmac-sha2-256\"]" comment:"MAC algorithms to use"`
	// HostKeyAlgorithms is a list of algorithms for host keys. The server can offer multiple host keys and this list
	// are the ones we want to accept. The fingerprints for the accepted algorithms should be added to
	// AllowedHostKeyFingerprints.
	HostKeyAlgorithms SSHKeyAlgoList `json:"hostKeyAlgos" yaml:"hostKeyAlgos" default:"[\"ssh-rsa-cert-v01@openssh.com\",\"ssh-dss-cert-v01@openssh.com\",\"ecdsa-sha2-nistp256-cert-v01@openssh.com\",\"ecdsa-sha2-nistp384-cert-v01@openssh.com\",\"ecdsa-sha2-nistp521-cert-v01@openssh.com\",\"ssh-ed25519-cert-v01@openssh.com\",\"ssh-rsa\",\"ssh-dss\",\"ssh-ed25519\"]"`
	// Timeout is the time ContainerSSH is willing to wait for the backing connection to be established.
	Timeout time.Duration `json:"timeout" yaml:"timeout" default:"60s"`
	// ClientVersion is the version sent to the server.
	//               Must be in the format of "SSH-protoversion-softwareversion SPACE comments".
	//               See https://tools.ietf.org/html/rfc4253#page-4 section 4.2. Protocol Version Exchange
	//               The trailing CR and LF characters should NOT be added to this string.
	ClientVersion SSHProxyClientVersion `json:"clientVersion" yaml:"clientVersion" default:"SSH-2.0-ContainerSSH"`
}

// Validate checks the configuration for the backing SSH server.
func (c SSHProxyConfig) Validate() error {