Replace/remove password authentication with key based authentication

Author: RLovelett

Package.swift

@@ -27,7 +27,20 @@ let package = Package(
         ),
         .target(
             name: "SecureShell",
-            dependencies: ["Clibssh"]
+            dependencies: [
+                .target(name: "Clibssh"),
+                .product(name: "Path", package: "Path.swift"),
+            ]
+        ),
+        .testTarget(
+            name: "SecureShellTests",
+            dependencies: [
+                .target(name: "SecureShell"),
+                .product(name: "Path", package: "Path.swift"),
+            ],
+            resources: [
+                .process("Fixtures"),
+            ]
         ),
         .target(
             name: "VMwareFusion",

README.md

@@ -160,15 +160,15 @@ and `cleanup_args` should be located in the respective help of each subcommand.
     prepare_args = [
       "prepare",
       "--ssh-username", "buildbot",
-      "--ssh-key", "/Users/buildbot/Library/Application Support/me.lovelett.gitlab-fusion/id_ed25519",
+      "--ssh-identity-file", "/Users/buildbot/Library/Application Support/me.lovelett.gitlab-fusion/id_ed25519",
       "/Users/buildbot/base-macOS-10.15.7-19H2-xcode-12.0.0.vmwarevm/base-macOS-10.15.7-19H2-xcode-12.0.0.vmx"
     ]
 
     run_exec = "/Users/buildbot/gitlab-fusion/.build/release/gitlab-fusion"
     run_args = [
       "run",
       "--ssh-username", "buildbot",
-      "--ssh-key", "/Users/buildbot/Library/Application Support/me.lovelett.gitlab-fusion/id_ed25519",
+      "--ssh-identity-file", "/Users/buildbot/Library/Application Support/me.lovelett.gitlab-fusion/id_ed25519",
       "/Users/buildbot/base-macOS-10.15.7-19H2-xcode-12.0.0.vmwarevm/base-macOS-10.15.7-19H2-xcode-12.0.0.vmx"
     ]
 

Sources/SecureShell/PrivateKey.swift

@@ -0,0 +1,40 @@
+//
+//  PrivateKey.swift
+//  SecureShell
+//
+//  Created by Ryan Lovelett on 10/5/20.
+//
+
+import Clibssh
+import Path
+
+/// Private key used with the SecureShell public-key infrastructure (PKI).
+final class PrivateKey: CustomStringConvertible {
+    let key: ssh_key
+
+    /// Create an instance from a key at a path.
+    /// - Parameter path: Path to the private key.
+    /// - Throws: `SecureShellError` if the private key cannot be loaded.
+    init(contentsOfFile path: Path) throws {
+        var file: ssh_key?
+        let returnCode = path.string.withCString { body in
+            ssh_pki_import_privkey_file(body, nil, nil, nil, &file)
+        }
+        guard returnCode == SSH_OK, let privateKey = file else {
+            ssh_key_free(file)
+            throw SecureShellError("Could not import private key at \(path)")
+        }
+        self.key = privateKey
+    }
+
+    deinit {
+        ssh_key_free(key)
+    }
+
+    /// The type of the key (e.g., `ssh-rsa` or `ssh-ed25519`).
+    var description: String {
+        let type = ssh_key_type(key)
+        let name = ssh_key_type_to_char(type)
+        return name.map { String(cString: $0) } ?? "unknown"
+    }
+}

Sources/SecureShell/SecureShellError.swift

@@ -45,4 +45,12 @@ struct SecureShellError: LocalizedError {
             libsshErrorText = "Was not able to infer the error from \(session)."
         }
     }
+
+    var errorDescription: String? {
+        if libsshErrorText.isEmpty {
+            return description
+        }
+
+        return "\(description) - \(libsshErrorText)"
+    }
 }

Sources/SecureShell/Session.swift

@@ -6,6 +6,7 @@
 //
 
 import Clibssh
+import Path
 
 /// A `Session` encapsulates the entire lifetime of the connection with a remote
 /// machine. A `Session` is responsible for connecting and authenticating the
@@ -52,17 +53,17 @@ public final class Session {
         ssh_free(session)
     }
 
-    /// Attempt to authenticate the session using password.
+    /// Path to a file from which the identity (private key) for public key
+    /// authentication is read.
     ///
-    /// - Parameter password: The password to attempt authentication with.
+    /// - Parameter path: Path to identity private key.
     /// - Throws: `SecureShellError` if authentication fails.
-    public func authenticate(withPassword password: String) throws {
-        let returnCode = password.withCString {
-            ssh_auth_e(rawValue: ssh_userauth_password(session, nil, $0))
-        }
+    public func authenticate(withIdentity path: Path) throws {
+        let key = try PrivateKey(contentsOfFile: path)
+        let returnCode = ssh_auth_e(rawValue: ssh_userauth_publickey(session, nil, key.key))
 
         guard returnCode == SSH_AUTH_SUCCESS else {
-            throw SecureShellError(session, description: "Could not authenticate.")
+            throw SecureShellError(session, description: "Could not authenticate with identity \(path).")
         }
     }
 

Sources/gitlab-fusion/Stages/Prepare.swift

@@ -59,11 +59,8 @@ struct Prepare: ParsableCommand {
 
     // MARK: - Secure Shell (SSH) specific arguments
 
-    @Option(help: "User used to authenticate as over SSH to the VMware Fusion guest.")
-    var sshUsername = "buildbot"
-
-    @Option(help: "Password used to authenticate as over SSH to the VMware Fusion guest.")
-    var sshPassword = "Time2Build"
+    @OptionGroup()
+    var sshOptions: SecureShellOptions
 
     // MARK: - Validating the command-line input
 
@@ -133,8 +130,8 @@ struct Prepare: ParsableCommand {
         // Wait for ssh to become available
         for _ in 1...60 {
             // TODO: Retry if connection times out
-            let session = try Session(host: ip, username: sshUsername)
-            try session.authenticate(withPassword: sshPassword)
+            let session = try Session(host: ip, username: sshOptions.sshUsername)
+            try session.authenticate(withIdentity: sshOptions.sshIdentityFile)
             let channel = try session.openChannel()
             let exitCode = channel.execute("echo -n 2>&1")
 

Sources/gitlab-fusion/Stages/Run.swift

@@ -40,11 +40,8 @@ struct Run: ParsableCommand {
 
     // MARK: - Secure Shell (SSH) specific arguments
 
-    @Option(help: "User used to authenticate as over SSH to the VMware Fusion guest.")
-    var sshUsername = "buildbot"
-
-    @Option(help: "Password used to authenticate as over SSH to the VMware Fusion guest.")
-    var sshPassword = "Time2Build"
+    @OptionGroup()
+    var sshOptions: SecureShellOptions
 
     // MARK: - Virtual Machine runtime specific arguments
 
@@ -85,8 +82,8 @@ struct Run: ParsableCommand {
         let script = try String(contentsOf: scriptFile)
         os_log("Running script:\n%{public}@", log: log, type: .info, script)
 
-        let session = try Session(host: ip, username: sshUsername)
-        try session.authenticate(withPassword: sshPassword)
+        let session = try Session(host: ip, username: sshOptions.sshUsername)
+        try session.authenticate(withIdentity: sshOptions.sshIdentityFile)
         let channel = try session.openChannel()
         let exitCode = channel.execute(script, stdout: FileHandle.standardOutput, stderr: FileHandle.standardError)
 

Sources/gitlab-fusion/Stages/SecureShellOptions.swift

@@ -0,0 +1,20 @@
+//
+//  SecureShellOptions.swift
+//  gitlab-fusion
+//
+//  Created by Ryan Lovelett on 10/10/20.
+//
+
+import ArgumentParser
+import Environment
+import Path
+import VMwareFusion
+
+/// Common arguments used by the individual stage subcommands.
+struct SecureShellOptions: ParsableArguments {
+    @Option(help: "User used to authenticate as over SSH to the VMware Fusion guest.")
+    var sshUsername = "buildbot"
+
+    @Option(help: "Path to a file from which the identity (private key) for public key authentication is read.")
+    var sshIdentityFile = Path.applicationSupport / subsystem / "id_ed25519"
+}

Tests/SecureShellTests/Fixtures/ed25519WithoutPassword

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDuYamDhcrjukTnYHhKH9vR+4w786CBI+BTHiVi5Rx/uwAAAJianUMxmp1D
+MQAAAAtzc2gtZWQyNTUxOQAAACDuYamDhcrjukTnYHhKH9vR+4w786CBI+BTHiVi5Rx/uw
+AAAEDnc9ytgpASKJ+EjUy8fuw4GP6CpI9I/QFEQZnUmatjx+5hqYOFyuO6ROdgeEof29H7
+jDvzoIEj4FMeJWLlHH+7AAAAEFNlY3VyZVNoZWxsVGVzdHMBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----

Tests/SecureShellTests/Fixtures/ed25519WithoutPassword.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5hqYOFyuO6ROdgeEof29H7jDvzoIEj4FMeJWLlHH+7 SecureShellTests