leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
68 lines
1.7 KiB
Go
68 lines
1.7 KiB
Go
package discover
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"incredigo/internal/vault"
|
|
)
|
|
|
|
func init() { Register(&sshScanner{}) }
|
|
|
|
// sshScanner harvests private keys from ~/.ssh (files named id_* that aren't
|
|
// .pub). The whole key file is the secret. Read-only.
|
|
type sshScanner struct{}
|
|
|
|
func (s *sshScanner) Name() string { return "ssh" }
|
|
|
|
func (s *sshScanner) dir() string {
|
|
home, _ := os.UserHomeDir()
|
|
return filepath.Join(home, ".ssh")
|
|
}
|
|
|
|
func (s *sshScanner) Available() bool {
|
|
fi, err := os.Stat(s.dir())
|
|
return err == nil && fi.IsDir()
|
|
}
|
|
|
|
func (s *sshScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
|
|
entries, err := os.ReadDir(s.dir())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var creds []Credential
|
|
for _, e := range entries {
|
|
name := e.Name()
|
|
if !e.Type().IsRegular() || !strings.HasPrefix(name, "id_") || strings.HasSuffix(name, ".pub") {
|
|
continue
|
|
}
|
|
p := filepath.Join(s.dir(), name)
|
|
b, err := os.ReadFile(p) // read-only
|
|
if err != nil {
|
|
continue
|
|
}
|
|
if !bytes.Contains(b, []byte("PRIVATE KEY")) {
|
|
continue // not a private key file
|
|
}
|
|
fi, _ := os.Stat(p)
|
|
// Best-effort: PEM-encrypted keys carry an explicit marker. (OpenSSH-format
|
|
// encryption isn't detectable without parsing the body, so this can
|
|
// under-report; it never claims a plaintext key is encrypted.)
|
|
encrypted := bytes.Contains(b, []byte("ENCRYPTED"))
|
|
creds = append(creds, Credential{
|
|
Source: s.Name(),
|
|
Kind: KindPrivateKey,
|
|
Identity: name,
|
|
Location: p,
|
|
Modified: fi.ModTime(),
|
|
Secret: v.Store(b),
|
|
Meta: map[string]string{"encrypted": strconv.FormatBool(encrypted)},
|
|
})
|
|
}
|
|
return creds, nil
|
|
}
|