Package com.hierynomus.sshj.userauth.agent

Class AgentProxy

java.lang.Object

com.hierynomus.sshj.userauth.agent.AgentProxy

All Implemented Interfaces:

Closeable, AutoCloseable

public class AgentProxy
extends Object
implements Closeable

A client for the SSH authentication agent protocol (draft-miller-ssh-agent / OpenSSH's PROTOCOL.agent).

This is the recommended way to authenticate with a FIDO/U2F security key (an sk-ecdsa-sha2-nistp256@openssh.com or sk-ssh-ed25519@openssh.com key): load the key into your agent once with ssh-add, and the agent performs the hardware tap on every sign. The agent returns a fully formed SSH signature - including the security-key flags and counter - so sshj forwards it verbatim and never has to talk to the hardware itself.

It works for ordinary keys too (RSA, ECDSA, Ed25519), so it doubles as general ssh-agent support.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	SSH_AGENT_RSA_SHA2_256	Sign flag asking the agent for an rsa-sha2-256 signature from an RSA key.
static final int	SSH_AGENT_RSA_SHA2_512	Sign flag asking the agent for an rsa-sha2-512 signature from an RSA key.

Constructor Summary

Constructors

Constructor	Description
AgentProxy(AgentConnection connection)

Method Summary

Modifier and Type	Method	Description
void	close()
static AgentProxy	fromEnvironment()	Connect to the agent indicated by the SSH_AUTH_SOCK environment variable over a unix- domain socket.
List<AgentIdentity>	getIdentities()	List the identities the agent holds.
byte[]	sign(byte[] keyBlob, byte[] data, int flags)	Ask the agent to sign data with the key identified by keyBlob.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SSH_AGENT_RSA_SHA2_256

public static final int SSH_AGENT_RSA_SHA2_256

Sign flag asking the agent for an rsa-sha2-256 signature from an RSA key.

See Also:

• Constant Field Values

SSH_AGENT_RSA_SHA2_512

public static final int SSH_AGENT_RSA_SHA2_512

Sign flag asking the agent for an rsa-sha2-512 signature from an RSA key.

See Also:

• Constant Field Values

Constructor Details

AgentProxy

public AgentProxy(AgentConnection connection)
           throws IOException

Throws:

IOException

Method Details

fromEnvironment

public static AgentProxy fromEnvironment()
                                  throws IOException

Connect to the agent indicated by the SSH_AUTH_SOCK environment variable over a unix- domain socket. Requires a Java 16+ runtime; on older runtimes construct an AgentProxy with your own AgentConnection.

Throws:

IOException - if SSH_AUTH_SOCK is unset or the agent cannot be reached

getIdentities

public List<AgentIdentity> getIdentities()
                                  throws IOException

List the identities the agent holds. Identities whose key type sshj does not understand are skipped (logged at debug), rather than failing the whole listing.

Throws:

IOException

sign

public byte[] sign(byte[] keyBlob,
 byte[] data,
 int flags)
            throws IOException

Ask the agent to sign data with the key identified by keyBlob.

Parameters:

keyBlob - the identity's key blob, exactly as returned by getIdentities()

data - the data to sign

flags - sign flags, e.g. SSH_AGENT_RSA_SHA2_256; 0 for Ed25519 and security keys

Returns:

the SSH signature value (string signature_format || string signature_blob, with any security-key flags and counter already appended by the agent), ready to be written as a single SSH string

Throws:

IOException

close

public void close()
           throws IOException

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Throws:

IOException