Struct SshConfig 

pub struct SshConfig { /* private fields */ }

SSH configuration for Bashkit.

Controls SSH behavior including host allowlist, authentication, timeouts, and resource limits.

Example

use bashkit::SshConfig;
use std::time::Duration;

let config = SshConfig::new()
    .allow("*.supabase.co")
    .allow("bastion.example.com")
    .allow_port(2222)
    .default_user("deploy")
    .timeout(Duration::from_secs(60));

Security

• Host allowlist is default-deny (empty blocks everything)
• Keys are read from VFS only, never from host filesystem
• All connections have timeouts to prevent hangs
• Host key verification is strict by default (TM-SSH-006)

Implementations

impl SshConfig

pub fn new() -> Self

Create a new SSH configuration with default settings.

pub fn allow(self, pattern: impl Into<String>) -> Self

Add a host pattern to the allowlist.

Patterns can be exact hosts (db.supabase.co) or wildcard subdomains (*.supabase.co).

Security (TM-SSH-001)

Only hosts matching the allowlist can be connected to.

pub fn allow_many( self, patterns: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Add multiple host patterns.

pub fn allow_port(self, port: u16) -> Self

Add an allowed port. Default: only port 22.

Security (TM-SSH-007)

pub fn allow_all(self) -> Self

Allow all hosts (dangerous — testing only).

pub fn default_user(self, user: impl Into<String>) -> Self

Set the default username for SSH connections.

Used when no user@ prefix is specified in the ssh command.

pub fn default_password(self, password: impl Into<String>) -> Self

Set the default password for SSH connections.

Used when no private key is provided. Typically set from environment variables or secret stores, not hardcoded.

pub fn default_private_key(self, key: impl Into<String>) -> Self

Set the default private key (PEM or OpenSSH format).

Used when no -i flag is specified in the ssh command. Pass the key contents, not a file path.

pub fn timeout(self, timeout: Duration) -> Self

Set the connection timeout.

Security (TM-SSH-005)

pub fn max_response_bytes(self, max: usize) -> Self

Set the maximum response size in bytes.

Security (TM-SSH-004)

pub fn max_sessions(self, max: usize) -> Self

Set the maximum concurrent SSH sessions.

Security (TM-SSH-003)

pub fn default_port(self, port: u16) -> Self

Set the default SSH port.

pub fn strict_host_key_checking(self, strict: bool) -> Self

Enable or disable strict host key checking.

When enabled (default), connections are rejected unless the server’s public key matches a trusted key added via trusted_host_key.

When disabled, all host keys are accepted with a warning log.

Security (TM-SSH-006)

Disabling this makes SSH connections vulnerable to man-in-the-middle attacks.

pub fn trusted_host_key( self, host: impl Into<String>, public_key: impl Into<String>, ) -> Self

Add a trusted host key for host key verification.

The host parameter is an exact hostname to match. The public_key is the SSH public key in OpenSSH format (e.g. "ssh-ed25519 AAAA...").

Security (TM-SSH-006)

When strict_host_key_checking is enabled (default), only connections to hosts with a matching trusted key will succeed.

Trait Implementations

impl Clone for SshConfig

fn clone(&self) -> SshConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SshConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SshConfig

fn default() -> Self

Returns the “default value” for a type.