ssh-proxy-agent
An SSH agent capable of proxying requests and signing keys via HashiCorp Vault.
When working with sensitive SSH keys (e.g. keys for production infrastructure) it can be desirable
to separate them from other keys. With ssh-proxy-agent
, keys can be isolated to a particular
environment will still allowing access to the outer environment's keys.
Signing keys via HashiCorp Vault is also supported and works well when combined with on-the-fly key generation.
Installation
Manual
As long as you have a proper Go environment set up you should be able to install using go get
:
$ go get -u github.com/miquella/ssh-proxy-agent
Getting Started
ssh-proxy-agent
can act as a standalone agent or can proxy requests to an upstream agent. To
get started, the basic invocation to spawn an agent is:
$ ssh-proxy-agent --shell
This will spawn an interactive shell with the new SSH agent. If you have an existing agent
configured in your SSH_AUTH_SOCK
env var the new agent will proxy requests to it and any
keys in your upstream agent will be available in the proxy agent. Any keys added to the proxy
agent will be isolated from the upstream agent and will only remain available while the shell
is active.
Take note that because ssh-proxy-agent
uses the SSH_AUTH_SOCK
env var to configure the new
agent, you will need to ensure this variable does not get overrode when opening a new shell
(e.g. through a .bashrc or similar file). If you experience problems, you may want to try
running with the --doctor
flag inside of a shell to verify if you are configured to talk to
the proxy agent correctly:
$ ssh-proxy-agent --doctor
If you wish to run the proxy agent more securely, you can disable proxying to an upstream agent via:
$ ssh-proxy-agent --shell --no-proxy
Key Signing
If you have access to a HashiCorp Vault instance that is configured for SSH key signing, you can configure the proxy agent to automatically sign all keys added to the agent:
$ ssh-proxy-agent --shell --vault-signing-url https://vault.address.com/key/signing/path
If the VAULT_ADDR
environment variable is set you can provide a relative path to the
--vault-signing-url
instead of the full address. For example:
--vault-signing-url key/signing/path
.
All keys added to the agent will be signed for a one hour duration and will be automatically renewed prior to expiration to ensure that the keys are always valid.
You must have a Vault token configured for this work, either via the VAULT_TOKEN
environment
variable or a .vault-token
file located in your home directory.
This is particularly useful when combined with --generate-key
which will generate an in-memory
key to seed the agent that can be signed on creation.
$ ssh-proxy-agent --shell --vault-signing-url https://vault.address.com/key/signing/path --generate-key
More Details
To explore the other flag options and see usage rules you can access the help menu with:
$ ssh-proxy-agent --help