Documentation
¶
Overview ¶
Package agent implements an SSH agent that uses YubiKey PIV tokens for key operations.
Index ¶
- Constants
- Variables
- func Run()
- func RunSetup(yk *piv.YubiKey) error
- func SetupSlot(yk *piv.YubiKey, slot piv.Slot, pinPolicy piv.PINPolicy, ...) error
- func UnblockPIN(yk *piv.YubiKey) error
- type Agent
- func (a *Agent) Add(key agent.AddedKey) error
- func (a *Agent) Close() error
- func (a *Agent) Extension(extensionType string, contents []byte) ([]byte, error)
- func (a *Agent) List() ([]*agent.Key, error)
- func (a *Agent) Lock(passphrase []byte) error
- func (a *Agent) Remove(key ssh.PublicKey) error
- func (a *Agent) RemoveAll() error
- func (a *Agent) Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, error)
- func (a *Agent) SignWithFlags(key ssh.PublicKey, data []byte, flags agent.SignatureFlags) (*ssh.Signature, error)
- func (a *Agent) Signers() ([]ssh.Signer, error)
- func (a *Agent) Unlock(passphrase []byte) error
- type ErrInvalidPINLength
- type Yubi
Constants ¶
const ( // TouchNotificationTimeout is how long to wait before showing a touch notification TouchNotificationTimeout = 5 * time.Second // TemporaryErrorRetryDelay is how long to wait before retrying after a temporary error TemporaryErrorRetryDelay = time.Second // SocketDirPermissions is the permission mode for the socket directory SocketDirPermissions = 0700 // SignOperationTimeout is the maximum time allowed for a sign operation // This prevents indefinite blocking waiting for YubiKey touch SignOperationTimeout = 2 * time.Minute )
const ( // RequiredPINLength is the required length for YubiKey PINs RequiredPINLength = 8 // CertificateValidityYears is how many years certificates are valid for CertificateValidityYears = 42 )
Variables ¶
var ErrOperationUnsupported = errors.New("operation unsupported")
ErrOperationUnsupported is returned for agent operations not supported by yubikey-agent. Since keys are hardware-bound, operations like Add/Remove don't apply.
var ErrPINMismatch = errors.New("PINs don't match")
ErrPINMismatch is returned when the PIN confirmation doesn't match.
var Version string
Version contains the build version of yubikey-agent, set at build time.
Functions ¶
func RunSetup ¶
RunSetup sets up all four main PIV slots on a single YubiKey, generating SSH-usable certificates in each. This function expects you've already selected your one YubiKey, e.g. via RunSetupSelected().
func SetupSlot ¶
func SetupSlot(yk *piv.YubiKey, slot piv.Slot, pinPolicy piv.PINPolicy, touchPolicy piv.TouchPolicy) error
SetupSlot configures (or re-configures) a single PIV slot with a specified PIN policy and touch policy. Demonstrates a more "incremental" approach, rather than setting up all slots at once.
If a management key is not yet stored in metadata, it will prompt for a PIN (resetting from defaults). Otherwise, it reuses the existing management key.
func UnblockPIN ¶
UnblockPIN uses the PUK to unblock a locked PIN
Types ¶
type Agent ¶
type Agent struct {
// contains filtered or unexported fields
}
Agent holds status of the current agent in use and all yubikeys associated with it
func (*Agent) Extension ¶
Extension implements the agent.ExtendedAgent interface but no extensions are supported.
func (*Agent) Remove ¶
Remove is not supported as keys cannot be removed from hardware tokens remotely.
func (*Agent) RemoveAll ¶
RemoveAll is not supported as keys cannot be removed from hardware tokens remotely.
func (*Agent) Sign ¶
Sign implements the agent.Agent interface for signing data with a key. This method delegates to SignWithFlags with no flags set.
func (*Agent) SignWithFlags ¶
func (a *Agent) SignWithFlags(key ssh.PublicKey, data []byte, flags agent.SignatureFlags) (*ssh.Signature, error)
SignWithFlags implements the agent.ExtendedAgent interface for signing with algorithm selection. This operation has a 2-minute timeout to prevent indefinite blocking on YubiKey touch.
type ErrInvalidPINLength ¶ added in v0.1.6
ErrInvalidPINLength is returned when the PIN length is incorrect.
func (ErrInvalidPINLength) Error ¶ added in v0.1.6
func (e ErrInvalidPINLength) Error() string
type Yubi ¶
Yubi contains all the information about a YubiKey
func GetSingleYubiKey ¶
GetSingleYubiKey loads YubiKeys (respecting --serial) and ensures exactly one is found. Returns the YubiKey and nil if successful, or nil and an error if failed.
func GetSingleYubiKeyContext ¶ added in v0.1.6
GetSingleYubiKeyContext loads YubiKeys with context support and ensures exactly one is found.
func LoadYubiKeys ¶
LoadYubiKeys loads all connected YubiKeys, but if a `--serial` is provided, only the matching YubiKey will be returned. This ensures we never "touch" any other YubiKeys if `serial` is set.
Source Files