Are ssh passphrases supported with ssh 'secretless' support?

fultonm · April 6, 2022, 9:25pm

I didn’t see if passphrases were supported with ssh keys. I would want to be able to use them, so hoping so…

thanks, mike

szh · April 7, 2022, 5:14pm

Hi Mike,

Secretless doesn’t currently have support for SSH passphrases. However, if you’re interested in contributing a pull request it wouldn’t be hard to do.

You could modify the following code to call ParsePrivateKeyWithPassphrase instead of ParsePrivateKey if there’s a passphrase specified in the configuration.

github.com

cyberark/secretless-broker/blob/main/internal/plugin/connectors/ssh/service_connector.go#L65

      
        
            			return
            		}
            		config.ClientConfig.HostKeyCallback = ssh.FixedHostKey(hostKey)
            	} else {
            		h.logger.Warnf("No SSH hostKey specified. Secretless will accept any backend host key!")
            		config.ClientConfig.HostKeyCallback = ssh.InsecureIgnoreHostKey()
            	}
            
            
	if privateKeyStr, ok := values["privateKey"]; ok {
            		var signer ssh.Signer
            		if signer, err = ssh.ParsePrivateKey([]byte(privateKeyStr)); err != nil {
            			h.logger.Debugf("Unable to parse private key: %v", err)
            			return
            		}
            		config.ClientConfig.Auth = []ssh.AuthMethod{
            			ssh.PublicKeys(signer),
            		}
            	}
            
            
	return
            }

Thank you,
Shlomo

Topic		Replies	Views
Secretless Service Connector for MSSQL supports SSL Secretless Broker	0	521	April 14, 2020
Secretless on VM Secretless Broker	3	595	April 13, 2020
Secretless Broker Connector for Slack Secretless Broker	3	829	June 25, 2020
Secretless Service Connector for MongoDb Secretless Broker	1	569	April 6, 2020
Demo of the Secretless Broker Generic HTTP connector with the Twitter API in a dockerized Node/React application Secretless Broker opensource , howto , secretless	1	674	July 13, 2020

Are ssh passphrases supported with ssh 'secretless' support?

Related topics