Skip to content

Fix publickey-based authentication #21

Description

@brainstorm

Currrently accepts any (hardcoded) private key, as implied in the top-level README.md :-!!!!

ssh-stamp/src/serve.rs

Lines 68 to 70 in b08913f

ServEvent::PubkeyAuth(a) => {
a.allow()?;
}

ssh-stamp/src/keys.rs

Lines 2 to 10 in b08913f

pub(crate) const HOST_SECRET_KEY: &[u8; 400] = b"
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACD/HyNyMDvZkVWgMRzpbK6VgVk+/b627AamAjoO8T4uSAAAAJCzAcYdswHG
HQAAAAtzc2gtZWQyNTUxOQAAACD/HyNyMDvZkVWgMRzpbK6VgVk+/b627AamAjoO8T4uSA
AAAEAZYxnkyw7+ehro8oDJ2PBAO8OpJrBAezD3PLOw9CdLCP8fI3IwO9mRVaAxHOlsrpWB
WT79vrbsBqYCOg7xPi5IAAAAC2d1c0B0aGVzZXVzAQI=
-----END OPENSSH PRIVATE KEY-----
";

Also, there should be a mechanism to generate the private key on-device, should the user choose to do that (via #23 environment variable directive).

Metadata

Metadata

Assignees

Labels

criticalSecurity issues and/or general breakage

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions