sshagentca : project code review/security audit advice

[ror...@gmail.com]

I've written my second(!) go project, an ssh certificate authority for forwarded ssh connections.

https://github.com/rorycl/sshagentca

The idea for the project came from Peter Moody's posting about uber's pam module for ssh forwarded agents with certificates:

https://medium.com/uber-security-privacy/introducing-the-uber-ssh-certificate-authority-4f840839c5cc

The facebook post about using certificate principals for zones is also interesting:

https://engineering.fb.com/security/scalable-and-secure-access-with-ssh/

It's a small project, but can make a big difference to ssh-related workflows, providing time-scoped, user-specific ssh certificates.

I'd be grateful for some ideas on how to improve the code. I'm specifically interested in how one might go about auditing the project from a security standpoint.

Rory

[Brian Candler]

FWIW, I put some thoughts around the wider security context of sshagentca (as opposed to hardening of the binary itself) in an issue in my own fork:

https://github.com/candlerb/sshagentca/issues/8