Class Net::SSH::Authentication::KeyManager

  1. lib/net/ssh/authentication/key_manager.rb
Parent: Object

This class encapsulates all operations done by clients on a user’s private keys. In practice, the client should never need a reference to a private key; instead, they grab a list of “identities” (public keys) that are available from the KeyManager, and then use the KeyManager to do various private key operations using those identities.

The KeyManager also uses the Agent class to encapsulate the ssh-agent. Thus, from a client’s perspective it is completely hidden whether an identity comes from the ssh-agent or from a file on disk.

Methods

public class

  1. new

public instance

  1. add
  2. add_key_data
  3. agent
  4. clear!
  5. each_identity
  6. finish
  7. sign
  8. use_agent=
  9. use_agent?

Included modules

  1. Loggable

Attributes

key_data [R] The list of user key data that will be examined
key_files [R] The list of user key files that will be examined
known_identities [R] The map of loaded identities
options [R] The map of options that were passed to the key-manager

Public class methods

new (logger, options={})

Create a new KeyManager. By default, the manager will use the ssh-agent (if it is running).

[show source]
    # File lib/net/ssh/authentication/key_manager.rb, line 41
41:         def initialize(logger, options={})
42:           self.logger = logger
43:           @key_files = []
44:           @key_data = []
45:           @use_agent = true
46:           @known_identities = {}
47:           @agent = nil
48:           @options = options
49:         end

Public instance methods

add (key_file)

Add the given key_file to the list of key files that will be used.

[show source]
    # File lib/net/ssh/authentication/key_manager.rb, line 63
63:         def add(key_file)
64:           key_files.push(File.expand_path(key_file)).uniq!
65:           self
66:         end
add_key_data (key_data_)

Add the given key_file to the list of keys that will be used.

[show source]
    # File lib/net/ssh/authentication/key_manager.rb, line 69
69:         def add_key_data(key_data_)
70:           key_data.push(key_data_).uniq!
71:           self
72:         end
agent ()

Returns an Agent instance to use for communicating with an SSH agent process. Returns nil if use of an SSH agent has been disabled, or if the agent is otherwise not available.

[show source]
     # File lib/net/ssh/authentication/key_manager.rb, line 172
172:         def agent
173:           return unless use_agent?
174:           @agent ||= Agent.connect(logger)
175:         rescue AgentNotAvailable
176:           @use_agent = false
177:           nil
178:         end
clear! ()

Clear all knowledge of any loaded user keys. This also clears the list of default identity files that are to be loaded, thus making it appropriate to use if a client wishes to NOT use the default identity files.

[show source]
    # File lib/net/ssh/authentication/key_manager.rb, line 55
55:         def clear!
56:           key_files.clear
57:           key_data.clear
58:           known_identities.clear
59:           self
60:         end
each_identity () {|key| ...}

Iterates over all available identities (public keys) known to this manager. As it finds one, it will then yield it to the caller. The origin of the identities may be from files on disk or from an ssh-agent. Note that identities from an ssh-agent are always listed first in the array, with other identities coming after.

If key manager was created with :keys_only option, any identity from ssh-agent will be ignored unless it present in key_files or key_data.

[show source]
     # File lib/net/ssh/authentication/key_manager.rb, line 97
 97:         def each_identity
 98:           user_identities = load_identities_from_files + load_identities_from_data
 99: 
100:           if agent
101:             agent.identities.each do |key|
102:               corresponding_user_identity = user_identities.detect { |identity|
103:                 identity[:public_key].to_pem == key.to_pem
104:               }
105:               user_identities.delete(corresponding_user_identity) if corresponding_user_identity
106: 
107:               if !options[:keys_only] || corresponding_user_identity
108:                 known_identities[key] = { :from => :agent }
109:                 yield key
110:               end
111:             end
112:           end
113: 
114:           user_identities.each do |identity|
115:             key = identity.delete(:public_key)
116:             known_identities[key] = identity
117:             yield key
118:           end
119: 
120:           self
121:         end
finish ()

This is used as a hint to the KeyManager indicating that the agent connection is no longer needed. Any other open resources may be closed at this time.

Calling this does NOT indicate that the KeyManager will no longer be used. Identities may still be requested and operations done on loaded identities, in which case, the agent will be automatically reconnected. This method simply allows the client connection to be closed when it will not be used in the immediate future.

[show source]
    # File lib/net/ssh/authentication/key_manager.rb, line 83
83:         def finish
84:           @agent.close if @agent
85:           @agent = nil
86:         end
sign (identity, data)

Sign the given data, using the corresponding private key of the given identity. If the identity was originally obtained from an ssh-agent, then the ssh-agent will be used to sign the data, otherwise the private key for the identity will be loaded from disk (if it hasn’t been loaded already) and will then be used to sign the data.

Regardless of the identity’s origin or who does the signing, this will always return the signature in an SSH2-specified “signature blob” format.

[show source]
     # File lib/net/ssh/authentication/key_manager.rb, line 132
132:         def sign(identity, data)
133:           info = known_identities[identity] or raise KeyManagerError, "the given identity is unknown to the key manager"
134: 
135:           if info[:key].nil? && info[:from] == :file
136:             begin
137:               info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase])
138:             rescue Exception => e 
139:               raise KeyManagerError, "the given identity is known, but the private key could not be loaded: #{e.class} (#{e.message})"
140:             end
141:           end
142: 
143:           if info[:key]
144:             return Net::SSH::Buffer.from(:string, identity.ssh_type,
145:               :string, info[:key].ssh_do_sign(data.to_s)).to_s
146:           end
147: 
148:           if info[:from] == :agent
149:             raise KeyManagerError, "the agent is no longer available" unless agent
150:             return agent.sign(identity, data.to_s)
151:           end
152: 
153:           raise KeyManagerError, "[BUG] can't determine identity origin (#{info.inspect})"
154:         end
use_agent= (use_agent)

Toggles whether the ssh-agent will be used or not. If true, an attempt will be made to use the ssh-agent. If false, any existing connection to an agent is closed and the agent will not be used.

[show source]
     # File lib/net/ssh/authentication/key_manager.rb, line 164
164:         def use_agent=(use_agent)
165:           finish if !use_agent
166:           @use_agent = use_agent
167:         end
use_agent? ()

Identifies whether the ssh-agent will be used or not.

[show source]
     # File lib/net/ssh/authentication/key_manager.rb, line 157
157:         def use_agent?
158:           @use_agent
159:         end