@@ -17,8 +17,8 @@ import (
1717 supervisor "github.com/gitpod-io/gitpod/supervisor/api"
1818 tracker "github.com/gitpod-io/gitpod/ws-proxy/pkg/analytics"
1919 p "github.com/gitpod-io/gitpod/ws-proxy/pkg/proxy"
20+ "github.com/gitpod-io/golang-crypto/ssh"
2021 "github.com/prometheus/client_golang/prometheus"
21- "golang.org/x/crypto/ssh"
2222 "golang.org/x/xerrors"
2323 "google.golang.org/grpc"
2424 "google.golang.org/grpc/credentials/insecure"
@@ -106,6 +106,27 @@ func New(signers []ssh.Signer, workspaceInfoProvider p.WorkspaceInfoProvider, he
106106
107107 server .sshConfig = & ssh.ServerConfig {
108108 ServerVersion : "SSH-2.0-GITPOD-GATEWAY" ,
109+ NoClientAuth : true ,
110+ NoClientAuthCallback : func (conn ssh.ConnMetadata ) (* ssh.Permissions , error ) {
111+ args := strings .Split (conn .User (), "#" )
112+ workspaceId := args [0 ]
113+ wsInfo , err := server .GetWorkspaceInfo (workspaceId )
114+ if err != nil {
115+ return nil , err
116+ }
117+ defer func () {
118+ server .TrackSSHConnection (wsInfo , "auth" , err )
119+ }()
120+ // workspaceId#ownerToken
121+ if len (args ) != 2 || wsInfo .Auth .OwnerToken != args [1 ] {
122+ return nil , ErrAuthFailed
123+ }
124+ return & ssh.Permissions {
125+ Extensions : map [string ]string {
126+ "workspaceId" : workspaceId ,
127+ },
128+ }, nil
129+ },
109130 PasswordCallback : func (conn ssh.ConnMetadata , password []byte ) (perm * ssh.Permissions , err error ) {
110131 workspaceId , ownerToken := conn .User (), string (password )
111132 wsInfo , err := server .GetWorkspaceInfo (workspaceId )
0 commit comments