dissect.target.plugins.apps.ssh.openssh

Module Contents

Classes

OpenSSHPlugin

OpenSSH plugin.

Functions

find_sshd_directory
parse_ssh_public_key_file
parse_ssh_key
parse_known_host

dissect.target.plugins.apps.ssh.openssh.find_sshd_directory(target: dissect.target.target.Target) → dissect.target.helpers.fsutil.TargetPath

class dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.apps.ssh.ssh.SSHPlugin

OpenSSH plugin.

__namespace__ = 'openssh'

Defines the plugin namespace.

SSHD_DIRECTORIES = ('/sysvol/ProgramData/ssh', '/etc/ssh')

sshd_directory

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

ssh_directory_globs(glob_user: str, glob_sshd: str) → collections.abc.Iterator[tuple[dissect.target.plugins.general.users.UserDetails | None, dissect.target.helpers.fsutil.TargetPath]]

authorized_keys() → collections.abc.Iterator[dissect.target.plugins.apps.ssh.ssh.AuthorizedKeysRecord]

Yields the content of the authorized_keys files on a target for each user.

known_hosts() → collections.abc.Iterator[dissect.target.plugins.apps.ssh.ssh.KnownHostRecord]

Yields the content of the known_hosts files on a target for each user.

private_keys() → collections.abc.Iterator[dissect.target.plugins.apps.ssh.ssh.PrivateKeyRecord]

Yields OpenSSH private keys on a target for each user.

public_keys() → collections.abc.Iterator[dissect.target.plugins.apps.ssh.ssh.PublicKeyRecord]

Yields all OpenSSH public keys from all user home directories and the OpenSSH daemon directory.

dissect.target.plugins.apps.ssh.openssh.parse_ssh_public_key_file(path: pathlib.Path) → tuple[str | None, str, str]

dissect.target.plugins.apps.ssh.openssh.parse_ssh_key(key_string: str) → tuple[str | None, str, str, str]

dissect.target.plugins.apps.ssh.openssh.parse_known_host(known_host_string: str) → tuple[str | None, list, str, str, str]