feat: native SSH tunnel support + password env vars, prompting, and SSH passfile/agent flags - #36
Open
jdputsch wants to merge 2 commits into
Open
feat: native SSH tunnel support + password env vars, prompting, and SSH passfile/agent flags#36jdputsch wants to merge 2 commits into
jdputsch wants to merge 2 commits into
Conversation
Allows godap to transparently forward LDAP connections through an SSH jump host without requiring manual port forwarding. New packages: - pkg/debug/log.go: file-based debug logger, no-op by default, activated via debug.Init(path). Keeps SSH lifecycle logs off the TUI screen. - pkg/ssh/tunnel.go: SSH tunnel implementation supporting password, key, and agent auth. Listens on 127.0.0.1:0 and forwards to the remote LDAP host:port via bidirectional io.Copy. Unknown host keys are surfaced as HostKeyUnknownError for TUI-friendly handling. - pkg/ssh/tunnel_test.go: unit tests covering password auth, key file auth, end-to-end data forwarding, Close() behavior, and bad host error. Modified files: - godap.go: adds CLI flags --ssh-host, --ssh-port, --ssh-user, --ssh-auth, --ssh-password, --ssh-key, --ssh-key-passphrase, --ssh-ignore-host-key, and --debug-log. A non-empty --ssh-host implicitly enables the tunnel. - tui/main.go: integrates tunnel lifecycle into setupLDAPConn() and reconnectLdap(); adds showHostKeyModal() for unknown host key guidance; extends openConfigForm() with a third SSH tunnel panel section. - go.mod: promotes golang.org/x/crypto from indirect to direct dependency. Example: godap --ssh-host jumpbox.corp --ssh-user admin --ssh-auth key --ssh-key ~/.ssh/id_rsa ldap.internal
…ent flags - GODAP_PASSWD env var sets LDAP password (overridden by --password/--passfile) - GODAP_SSH_PASSWORD env var sets SSH tunnel password (overridden by --ssh-password/--ssh-passfile) - Interactive LDAP password prompt when -u is given but no password method is set - New --ssh-passfile flag reads SSH password from a file or stdin (- to prompt) - New --ssh-agent flag selects SSH agent auth; SSH auth method is now inferred from flags (--ssh-agent, --ssh-key, --ssh-password/--ssh-passfile) with conflict detection; --ssh-auth kept for backwards compat and TUI config form - TUI SSH config form adds passfile option to SSH Auth dropdown and a password file field Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Owner
|
Hello @jdputsch! This is an interesting idea, but doesn't -x work for this scenario already? Users with this sort of need can spawn a dynamic reverse SOCKS tunnel via OpenSSH in any version above 7.6 with i.e. |
Author
|
In my experience, it is much easier to not have to set up port forwarding or socks proxies in an independent ssh session. Basically this is about convenience for users.
Jeff.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Native SSH Tunnel Support
Motivation
godap is most useful against the LDAP servers you can't reach directly. This branch adds a built-in SSH tunnel so you can get there without leaving the tool:
What's new
SSH tunnel (
pkg/ssh/tunnel.go)A new self-contained
sshtunnelpackage handles establishing the SSH connection and forwarding LDAP traffic through a local listener. It supports three auth methods (password, public key, SSH agent), known-hosts verification with a helpful error when a host key is unrecognized, and a clean shutdown path.New CLI flags
--ssh-host--ssh-port--ssh-user$USER)--ssh-key--ssh-key-passphrase--ssh-password--ssh-passfile-to prompt)--ssh-agent$SSH_AUTH_SOCK)--ssh-ignore-host-keySSH auth method is inferred automatically from the flags provided —
--ssh-authis retained for backwards compatibility and the TUI config form but is no longer required.Password improvements (LDAP and SSH)
GODAP_PASSWDenvironment variable sets the LDAP password (overridden by--password/--passfile)GODAP_SSH_PASSWORDenvironment variable sets the SSH password (overridden by--ssh-password/--ssh-passfile)-uis given but no password method is specified, godap prompts interactively with hidden input--passfile -and--ssh-passfile -both support reading from stdin with a visible prompt when connected to a terminalTUI config form
The SSH tunnel section is integrated into the existing reconnect/config form — you can enable the tunnel, change the bastion host, and reconnect without restarting.
Debug logging (
pkg/debug/log.go)A lightweight debug log (enabled with
--debug-log <path>) records tunnel setup, connection events, and errors for troubleshooting without cluttering the TUI.