admin/my-pi
1
0
Fork 0
mirror of https://bitbucket.org/siakitem/my-pi.git synced 2026-08-28 08:35:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pi-ssh): support SSH agent authentication

Browse Source
This commit is contained in:
云服务部-叶林立
2026-08-26 20:01:45 +08:00
parent b7758b239e
commit 874d4da096
10 changed files with 98 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pi-ssh/README.md
+7 -6
View File
@@ -15,7 +15,7 @@ The extension does not override Pi's local `read`, `write`, `edit`, `find`, `gre
## Architecture
Runtime connections are pure `ssh2`; the extension does not spawn OpenSSH and does not require `sshpass`, `ControlMaster`, or passwordless login. Remote file operations use SFTP and remote shell commands use an SSH exec channel. The SSH transport persists, but commands intentionally use fresh non-interactive Bash processes rather than a hidden stateful PTY.
Runtime connections are pure `ssh2`; the extension does not spawn OpenSSH and does not require `sshpass`, `ControlMaster`, or passwordless login. Authentication can use a private-key file, a password, or an SSH agent socket such as 1Password's agent. Remote file operations use SFTP and remote shell commands use an SSH exec channel. The SSH transport persists, but commands intentionally use fresh non-interactive Bash processes rather than a hidden stateful PTY.
Hosts must be explicitly imported before use. OpenSSH remains only an import source: the configuration helper runs `ssh -G <alias>` once to resolve the selected alias, then stores the resulting endpoint and authentication data in the pi-ssh vault. Later changes to `~/.ssh/config` require re-importing the host.
@@ -35,9 +35,9 @@ From the installed bundle or this repository:
The helper:
1. lets you select concrete aliases from `~/.ssh/config`;
2. uses `ssh -G` to resolve HostName, User, Port, and IdentityFile;
3. asks whether the selected host uses a private key or password;
4. asks for a private-key passphrase when needed;
2. uses `ssh -G` to resolve HostName, User, Port, IdentityFile, and IdentityAgent;
3. asks whether the selected host uses an SSH agent, private key, or password;
4. validates the selected agent socket or asks for a private-key passphrase when needed;
5. obtains and displays the server's SHA256 host-key fingerprint;
6. connects with `ssh2` to verify authentication;
7. optionally assigns a display label and group;
@@ -68,12 +68,13 @@ On POSIX systems the directory is mode `700` and both files are mode `600`. `hos
This is deliberately a **casual-disclosure boundary**, not protection against compromise of the local account: anyone who can read both files can decrypt the vault. Encryption prevents the host configuration and passwords from being exposed by accidentally viewing or copying `hosts.enc` alone.
The encrypted payload contains host endpoints, pinned host-key fingerprints, groups, and either:
The encrypted payload contains host endpoints, pinned host-key fingerprints, groups, and one of:
- an SSH agent socket path;
- a private-key path plus optional passphrase; or
- the server password.
Private-key contents are not copied into the vault.
Private-key contents are not copied into the vault. Agent-backed private keys remain inside the agent (including 1Password); pi-ssh stores only the socket path and asks `ssh2` to authenticate through it.
## Usage