Euler Tunnel And VS Code

Windows laptop - PowerShell#

& {
    $SshDir = Join-Path $env:USERPROFILE ".ssh"
    $KnownHosts = Join-Path $SshDir "known_hosts"
    New-Item -ItemType Directory -Force $SshDir | Out-Null

    $TunnelOutput = ssh euler "euler-tunnel config"
    if ($LASTEXITCODE -ne 0) { throw "Could not obtain euler-tunnel configuration" }
    $HostKeyLines = @($TunnelOutput | Where-Object { $_ -match '^euler-tunnel\s+ssh-' })
    if ($HostKeyLines.Count -ne 1) { throw "Expected exactly one euler-tunnel host-key line" }

    if (Test-Path $KnownHosts) {
        Copy-Item $KnownHosts "$KnownHosts.backup.$(Get-Date -Format yyyyMMdd-HHmmss)"
    }
    if (-not (Test-Path $KnownHosts) -or
        -not (Select-String -Path $KnownHosts -SimpleMatch $HostKeyLines[0] -Quiet)) {
        if (Test-Path $KnownHosts) {
            $Existing = [System.IO.File]::ReadAllText($KnownHosts)
            if ($Existing.Length -gt 0 -and -not $Existing.EndsWith("`n")) {
                [System.IO.File]::AppendAllText($KnownHosts, [Environment]::NewLine)
            }
        }
        Add-Content $KnownHosts $HostKeyLines[0] -Encoding ascii
    }
    ssh-keygen -F euler-tunnel -f $KnownHosts
}

macOS or Linux laptop - zsh/Bash#

(
  set -eu
  ssh_dir="$HOME/.ssh"
  known_hosts="$ssh_dir/known_hosts"
  mkdir -p "$ssh_dir"
  chmod 700 "$ssh_dir"

  tunnel_output="$(ssh euler 'euler-tunnel config')"
  host_key_lines="$(printf '%s\n' "$tunnel_output" | \
    grep -E '^euler-tunnel[[:space:]]+ssh-')"
  if [ "$(printf '%s\n' "$host_key_lines" | sed '/^$/d' | wc -l | tr -d ' ')" -ne 1 ]; then
    printf 'STOP: expected exactly one euler-tunnel host-key line.\n' >&2
    exit 1
  fi

  if [ -f "$known_hosts" ]; then
    cp -p "$known_hosts" "$known_hosts.backup.$(date +%Y%m%d-%H%M%S)"
  fi
  touch "$known_hosts"
  if ! grep -Fqx "$host_key_lines" "$known_hosts"; then
    if [ -s "$known_hosts" ] &&
       [ "$(tail -c 1 "$known_hosts" | wc -l | tr -d ' ')" -eq 0 ]; then
      printf '\n' >> "$known_hosts"
    fi
    printf '%s\n' "$host_key_lines" >> "$known_hosts"
  fi
  chmod 600 "$known_hosts"
  ssh-keygen -F euler-tunnel -f "$known_hosts"
)

Expected result: ssh-keygen prints one euler-tunnel host-key entry.

Windows laptop - PowerShell#

& {
    $SshDir = Join-Path $env:USERPROFILE ".ssh"
    $IncludeDir = Join-Path $SshDir "passport.d"
    $BackupDir = Join-Path $SshDir "passport-backups"
    $TunnelConfig = Join-Path $IncludeDir "euler-tunnel.conf"
    $TunnelTemporary = "$TunnelConfig.passport-new"

    $Resolved = @(ssh -G euler 2>$null)
    if ($LASTEXITCODE -ne 0) { throw "STOP: the euler alias does not parse" }
    $UserMatch = $Resolved | Select-String '^user\s+' | Select-Object -First 1
    $EulerUser = if ($UserMatch) { ($UserMatch.Line -split '\s+', 2)[1] } else { "" }
    $IdentityFiles = @($Resolved | ForEach-Object { if ($_ -match '^identityfile\s+(.+)$') { $Matches[1] } })
    $IdentitiesOnlyMatch = $Resolved | Select-String '^identitiesonly\s+' | Select-Object -First 1
    $IdentitiesOnly = if ($IdentitiesOnlyMatch) { ($IdentitiesOnlyMatch.Line -split '\s+', 2)[1] } else { "" }
    if ($EulerUser -notmatch '^[A-Za-z0-9._-]+$') { throw "STOP: the euler alias has no valid short username" }
    if ($IdentityFiles.Count -eq 0 -or @($IdentityFiles | Where-Object { $_ -eq 'none' -or $_ -match '\.pub$' }).Count -gt 0) { throw "STOP: the euler alias has no safe private identity selection" }
    if ($IdentitiesOnly -notin @('yes', 'no')) { throw "STOP: the euler alias has no valid identity policy" }
    $MarkerLines = @(ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no euler "echo config-ok")
    $Marker = if ($MarkerLines.Count -gt 0) { ([string]$MarkerLines[-1]).Trim() } else { "" }
    if ($LASTEXITCODE -ne 0 -or $Marker -ne 'config-ok') { throw "STOP: the required config-ok alias test failed" }

    New-Item -ItemType Directory -Force $IncludeDir, $BackupDir | Out-Null
    if (Test-Path $TunnelConfig) {
        Copy-Item $TunnelConfig (Join-Path $BackupDir "euler-tunnel.conf.$(Get-Date -Format yyyyMMdd-HHmmss)")
    }

    $Lines = @("Host euler-tunnel", "  User $EulerUser")
    foreach ($Identity in $IdentityFiles) {
        if ($Identity.Contains('"')) { throw "STOP: unsupported quote in resolved identity path" }
        $Lines += '  IdentityFile "' + $Identity + '"'
    }
    $Lines += @(
        "  IdentitiesOnly $IdentitiesOnly",
        "  PreferredAuthentications publickey",
        "  PasswordAuthentication no",
        "  KbdInteractiveAuthentication no",
        "  ForwardAgent no",
        "  ServerAliveInterval 10",
        "  ServerAliveCountMax 10",
        "  ProxyCommand ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no euler euler-tunnel connect"
    )
    $Lines | Set-Content $TunnelTemporary -Encoding ascii

    ssh -F $TunnelTemporary -G euler-tunnel | Out-Null
    if ($LASTEXITCODE -ne 0) {
        Remove-Item $TunnelTemporary -ErrorAction SilentlyContinue
        throw "STOP: generated tunnel config is invalid; the existing file is unchanged"
    }
    Move-Item -Force $TunnelTemporary $TunnelConfig
    ssh -G euler-tunnel | Select-String '^(user|identityfile|identitiesonly|preferredauthentications|passwordauthentication|kbdinteractiveauthentication|forwardagent|proxycommand) '
    if ($LASTEXITCODE -ne 0) { throw "STOP: tunnel alias is invalid; restore the timestamped backup" }
}

Do not add the generated ControlMaster, ControlPath, or ControlPersist lines on Windows; they use Unix sockets.

macOS or Linux laptop - zsh/Bash#

(
set -eu
include_dir="$HOME/.ssh/passport.d"
backup_dir="$HOME/.ssh/passport-backups"
tunnel_config="$include_dir/euler-tunnel.conf"
tunnel_temporary="$tunnel_config.passport-new"

resolved="$(ssh -G euler 2>/dev/null)" || { printf 'STOP: the euler alias does not parse\n' >&2; exit 1; }
eth_user="$(printf '%s\n' "$resolved" | awk '$1 == "user" { print $2; exit }')"
case "$eth_user" in ''|*[^ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-]*) printf 'STOP: the euler alias has no valid short username\n' >&2; exit 1;; esac
identity_files="$(printf '%s\n' "$resolved" | awk '$1 == "identityfile" { $1=""; sub(/^[[:space:]]+/, ""); print }')"
[ -n "$identity_files" ] || { printf 'STOP: the euler alias has no identity selection\n' >&2; exit 1; }
if printf '%s\n' "$identity_files" | awk '$0 == "none" || $0 ~ /[.]pub$/ { bad=1 } END { exit !bad }'; then
  printf 'STOP: the euler alias has no safe private identity selection\n' >&2
  exit 1
fi
identities_only="$(printf '%s\n' "$resolved" | awk '$1 == "identitiesonly" { print $2; exit }')"
case "$identities_only" in yes|no) ;; *) printf 'STOP: the euler alias has no valid identity policy\n' >&2; exit 1;; esac
marker="$(ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no euler 'echo config-ok')" || {
  printf 'STOP: the required config-ok alias test failed\n' >&2
  exit 1
}
[ "$marker" = config-ok ] || { printf 'STOP: the required config-ok marker was not returned\n' >&2; exit 1; }

mkdir -p "$include_dir" "$backup_dir"
chmod 700 "$include_dir" "$backup_dir"
if [ -f "$tunnel_config" ]; then
  cp -p "$tunnel_config" "$backup_dir/euler-tunnel.conf.$(date +%Y%m%d-%H%M%S)"
fi
{
  printf 'Host euler-tunnel\n  User %s\n' "$eth_user"
  while IFS= read -r identity; do
    [ -n "$identity" ] || continue
    case "$identity" in *'"'*) printf 'STOP: unsupported quote in resolved identity path\n' >&2; exit 1;; esac
    printf '  IdentityFile "%s"\n' "$identity"
  done <<EOF
$identity_files
EOF
  printf '  IdentitiesOnly %s\n' "$identities_only"
  printf '  PreferredAuthentications publickey\n  PasswordAuthentication no\n  KbdInteractiveAuthentication no\n  ForwardAgent no\n'
  printf '  ServerAliveInterval 10\n  ServerAliveCountMax 10\n'
  printf '  ProxyCommand ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no euler euler-tunnel connect\n'
  printf '  ControlMaster auto\n  ControlPath ~/.ssh/cs-%%r@%%h:%%p\n  ControlPersist 15\n'
} > "$tunnel_temporary"
chmod 600 "$tunnel_temporary"
ssh -F "$tunnel_temporary" -G euler-tunnel >/dev/null || {
  rm -f "$tunnel_temporary"
  printf 'STOP: generated tunnel config is invalid; the existing file is unchanged\n' >&2
  exit 1
}
mv "$tunnel_temporary" "$tunnel_config"
ssh -G euler-tunnel | grep -E '^(user|identityfile|identitiesonly|preferredauthentications|passwordauthentication|kbdinteractiveauthentication|forwardagent|proxycommand) '
)

Expected result: the resolved user, private identity selection, and identitiesonly policy match the tested euler alias; password and keyboard-interactive authentication are no, forwarding is no, and the proxy command reaches the existing euler alias. If a tunnel configuration already existed, it was backed up and replaced only after the new file parsed successfully.