45 lines
1.6 KiB
Go
45 lines
1.6 KiB
Go
package keymgr
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"ssh-access-tui/internal/model"
|
|
)
|
|
|
|
// RenderClientConfig produces an OpenSSH client config (works identically on
|
|
// Windows' built-in OpenSSH client, macOS, and Linux) that gives the user a
|
|
// "jump" alias plus one alias per host they're allowed to reach.
|
|
//
|
|
// This file is convenience only, not a security boundary: nothing stops a
|
|
// user from editing it or invoking ssh by hand. The actual restriction to
|
|
// these hosts is enforced server-side via authorized_keys permitopen=
|
|
// (see internal/sysadm/authorizedkeys.go) independent of what this file says.
|
|
func RenderClientConfig(jumpHost string, jumpPort int, username, keyFileName string, hosts []model.Host) string {
|
|
var b strings.Builder
|
|
fmt.Fprintf(&b, "# ssh-access-tui client config for %s\n", username)
|
|
fmt.Fprintf(&b, "# Generated %s. Regenerated whenever your allowed host list changes.\n\n", genTimestamp())
|
|
|
|
fmt.Fprintf(&b, "Host jump\n")
|
|
fmt.Fprintf(&b, " HostName %s\n", jumpHost)
|
|
fmt.Fprintf(&b, " Port %d\n", jumpPort)
|
|
fmt.Fprintf(&b, " User %s\n", username)
|
|
fmt.Fprintf(&b, " IdentityFile ~/.ssh/%s\n", keyFileName)
|
|
fmt.Fprintf(&b, " IdentitiesOnly yes\n\n")
|
|
|
|
for _, h := range hosts {
|
|
fmt.Fprintf(&b, "Host %s\n", h.Name)
|
|
fmt.Fprintf(&b, " HostName %s\n", h.Address)
|
|
fmt.Fprintf(&b, " Port %d\n", h.Port)
|
|
fmt.Fprintf(&b, " User %s\n", username)
|
|
fmt.Fprintf(&b, " ProxyJump jump\n")
|
|
fmt.Fprintf(&b, " IdentityFile ~/.ssh/%s\n", keyFileName)
|
|
fmt.Fprintf(&b, " IdentitiesOnly yes\n")
|
|
if h.Description != "" {
|
|
fmt.Fprintf(&b, " # %s\n", h.Description)
|
|
}
|
|
b.WriteString("\n")
|
|
}
|
|
return b.String()
|
|
}
|