Crate biscuit_ssh_ca 

OpenSSH user certificate authority of biscuit-ssh.

Turns an authorized access request into a short-lived user certificate whose constraints are enforced by sshd itself:

Request	Certificate
server, user	single principal server:user (see principal)
client address	critical option source-address = that address only
command	critical option force-command
token validity	valid-before = Authorization::valid_until

Through the bastion, CertificateAuthority::sign_relayed certifies the bastion’s own key instead, with source-address pinned to the bastion.

Only permit-pty is granted: no agent, port or X11 forwarding, and no ~/.ssh/rc. Servers trust the CA with TrustedUserCAKeys and map accounts to principals with AuthorizedPrincipalsFile.

sshd checks the certificate only when a session starts: an expiring certificate does not close sessions that are already open. Servers must keep their clock synchronized, since a lagging clock extends validity.

Structs

CertificateAuthority

Signs user certificates with the CA private key.

Enums

Error

Why a certificate could not be issued.

Functions

fingerprint

The fingerprint tokens refer to in public_key(...) facts.

parse_public_key

Parses a client public key in OpenSSH format (ssh-ed25519 AAAA...).

principal

The principal a certificate carries for user on server.