vaultssh
A small CLI wrapper for authenticating with SSH keys from Hashicorp Vault
vaultssh is a small CLI wrapper for automatically fetching and using signed SSH certificates when remoting into a host. It wraps the ssh process and is therefore compatible with all standard ssh flags.
Installation
cargo install vaultssh
Or install using brew
:
brew tap jmgilman/homebrew-apps
brew install vaultssh
Usage
$> vssh --help
vaultssh 0.1.0
A small CLI wrapper for authenticating with SSH keys from Hashicorp Vault
USAGE:
vssh [FLAGS] [OPTIONS]
[ARGS]...
ARGS:
ssh host
... additional arguments to pass to ssh
FLAGS:
-b, --basic disables terminal effects
-h, --help Print help information
-p, --persist persist acquired tokens to ~/.vault-token
-V, --version Print version information
OPTIONS:
-a, --auth-method
default authentication method to use
--auth-mount
default authentication mount to use -c, --config
config file (default: $HOME/.vssh) -i, --identity
ssh key-pair to sign and use (default: $HOME/.ssh/id_rsa) -m, --mount
mount path for ssh backend (default: ssh) -r, --role
vault role account to sign with (default: "default") -s, --server
address of vault server (default: $VAULT_ADDR) -t, --token
vault token to use for authentication (default: $VAULT_TOKEN)
Configuration
A configuration can be used by either creating it at ~/.vssh
or passing one in using the CLI option. Configuration files are in TOML format. An example one is shown below:
# Example config - place this in ~/.vssh to automatically use it
#
# The authentication names are the same as the default mount point for the
# associated engine. For example, "approle" for AppRole and "oidc" for OIDC.
# Not all engines are supported, only the ones shown below. You don't have to
# configure each one and may only configure the one you set to the default.
auth = "oidc" # default authentication method to use
auth_mount = "oidc" # default mount point for the authentication method
identity = "~/.ssh/id_rsa" # ssh key-pair to sign and use
mount = "ssh" # mount path for ssh backend
persist = true # persist acquired tokens to ~/.vault-token
role = "myrole" # vault role account to sign with
server = "https://vault:8200" # address of vault server
[approle] # name of auth method to configure
role_id = "myrole" # default values for auth method
[oidc]
role = "admin
[userpass]
username = "myuser"
Flow
The following occurs when you run vssh:
- A valid SSH certificate is searched for using the passed identity name
- If no certificate is found, or the found certificate is expired, a new certificate is requested
- A connection to Vault is initiated using any found tokens. If no token is found or the token is expired, a login prompt is given to acquire a new token.
- The public key for the passed identity is signed and the certificate is saved to the local filesystem
- The ssh program is executed and is passed the host and any additional arguments
Authentication
By default, if a new certificate is needed but no valid token has been found then vssh will initiate a login prompt for acquiring a new token. This token will only be used for the single session unless the --persist
option is given in which case the token is saved to the Vault CLI's default location of ~/.vault-token
. Future uses of vssh will use this token.
Not all authentication methods are currently supported, see the above configuration example for the ones that are. Specifying defaults for the authentication method will pre-fill the login prompt to make logging in easier. However, all other auth methods are still available if desired (i.e. setting defaults does not skip any prompts).
Contributing
Check out the issues for items neeeding attention or submit your own and then:
- Fork it (https://github.com/jmgilman/vaultssh/fork)
- Create your feature branch (git checkout -b feature/fooBar)
- Commit your changes (git commit -am 'Add some fooBar')
- Push to the branch (git push origin feature/fooBar)
- Create a new Pull Request