diff --git a/vfs/filesystem.go b/vfs/filesystem.go
index 2e3d5f77..6825e2d2 100644
--- a/vfs/filesystem.go
+++ b/vfs/filesystem.go
@@ -26,6 +26,7 @@ func (f *Filesystem) SetEmptySecrets() {
f.CryptConfig.Passphrase = kms.NewEmptySecret()
f.SFTPConfig.Password = kms.NewEmptySecret()
f.SFTPConfig.PrivateKey = kms.NewEmptySecret()
+ f.SFTPConfig.Passphrase = kms.NewEmptySecret()
}
// SetEmptySecretsIfNil sets the secrets to empty if nil
@@ -51,6 +52,9 @@ func (f *Filesystem) SetEmptySecretsIfNil() {
if f.SFTPConfig.PrivateKey == nil {
f.SFTPConfig.PrivateKey = kms.NewEmptySecret()
}
+ if f.SFTPConfig.Passphrase == nil {
+ f.SFTPConfig.Passphrase = kms.NewEmptySecret()
+ }
}
// SetNilSecretsIfEmpty set the secrets to nil if empty.
@@ -78,6 +82,9 @@ func (f *Filesystem) SetNilSecretsIfEmpty() {
if f.SFTPConfig.PrivateKey != nil && f.SFTPConfig.PrivateKey.IsEmpty() {
f.SFTPConfig.PrivateKey = nil
}
+ if f.SFTPConfig.Passphrase != nil && f.SFTPConfig.Passphrase.IsEmpty() {
+ f.SFTPConfig.Passphrase = nil
+ }
}
// IsEqual returns true if the fs is equal to other
@@ -191,6 +198,9 @@ func (f *Filesystem) HasRedactedSecret() bool {
if f.SFTPConfig.PrivateKey.IsRedacted() {
return true
}
+ if f.SFTPConfig.Passphrase.IsRedacted() {
+ return true
+ }
}
return false
@@ -276,6 +286,7 @@ func (f *Filesystem) GetACopy() Filesystem {
},
Password: f.SFTPConfig.Password.Clone(),
PrivateKey: f.SFTPConfig.PrivateKey.Clone(),
+ Passphrase: f.SFTPConfig.Passphrase.Clone(),
},
}
if len(f.SFTPConfig.Fingerprints) > 0 {
diff --git a/vfs/folder.go b/vfs/folder.go
index b595f5ec..4ab1cb73 100644
--- a/vfs/folder.go
+++ b/vfs/folder.go
@@ -168,6 +168,9 @@ func (v *BaseVirtualFolder) HasRedactedSecret() bool {
if v.FsConfig.SFTPConfig.PrivateKey.IsRedacted() {
return true
}
+ if v.FsConfig.SFTPConfig.Passphrase.IsRedacted() {
+ return true
+ }
}
return false
}
diff --git a/vfs/sftpfs.go b/vfs/sftpfs.go
index c50788eb..1ea1f6ac 100644
--- a/vfs/sftpfs.go
+++ b/vfs/sftpfs.go
@@ -41,6 +41,7 @@ type SFTPFsConfig struct {
Password *kms.Secret `json:"password,omitempty"`
PrivateKey *kms.Secret `json:"private_key,omitempty"`
forbiddenSelfUsernames []string `json:"-"`
+ Passphrase *kms.Secret `json:"passphrase,omitempty"`
}
// HideConfidentialData hides confidential data
@@ -51,6 +52,9 @@ func (c *SFTPFsConfig) HideConfidentialData() {
if c.PrivateKey != nil {
c.PrivateKey.Hide()
}
+ if c.Passphrase != nil {
+ c.Passphrase.Hide()
+ }
}
func (c *SFTPFsConfig) isEqual(other *SFTPFsConfig) bool {
@@ -82,6 +86,9 @@ func (c *SFTPFsConfig) isEqual(other *SFTPFsConfig) bool {
if !c.Password.IsEqual(other.Password) {
return false
}
+ if !c.Passphrase.IsEqual(other.Passphrase) {
+ return false
+ }
return c.PrivateKey.IsEqual(other.PrivateKey)
}
@@ -92,6 +99,9 @@ func (c *SFTPFsConfig) setEmptyCredentialsIfNil() {
if c.PrivateKey == nil {
c.PrivateKey = kms.NewEmptySecret()
}
+ if c.Passphrase == nil {
+ c.Passphrase = kms.NewEmptySecret()
+ }
}
// validate returns an error if the configuration is not valid
@@ -157,6 +167,12 @@ func (c *SFTPFsConfig) ValidateAndEncryptCredentials(additionalData string) erro
return util.NewValidationError(fmt.Sprintf("could not encrypt SFTP fs private key: %v", err))
}
}
+ if c.Passphrase.IsPlain() {
+ c.Passphrase.SetAdditionalData(additionalData)
+ if err := c.Passphrase.Encrypt(); err != nil {
+ return err
+ }
+ }
return nil
}
@@ -195,6 +211,11 @@ func NewSFTPFs(connectionID, mountPath, localTempDir string, forbiddenSelfUserna
return nil, err
}
}
+ if !config.Passphrase.IsEmpty() {
+ if err := config.Passphrase.TryDecrypt(); err != nil {
+ return nil, err
+ }
+ }
config.forbiddenSelfUsernames = forbiddenSelfUsernames
sftpFs := &SFTPFs{
connectionID: connectionID,
@@ -778,11 +799,19 @@ func (fs *SFTPFs) createConnection() error {
ClientVersion: fmt.Sprintf("SSH-2.0-SFTPGo_%v", version.Get().Version),
}
if fs.config.PrivateKey.GetPayload() != "" {
- signer, err := ssh.ParsePrivateKey([]byte(fs.config.PrivateKey.GetPayload()))
- if err != nil {
- fsLog(fs, logger.LevelError, "unable to parse the provided private key: %v", err)
- fs.err <- err
- return err
+ var signer ssh.Signer
+ if fs.config.Passphrase.GetPayload() != "" {
+ signer, err = ssh.ParsePrivateKeyWithPassphrase([]byte(fs.config.PrivateKey.GetPayload()), []byte(fs.config.Passphrase.GetPayload()))
+ if err != nil {
+ fs.err <- err
+ return err
+ }
+ } else {
+ signer, err = ssh.ParsePrivateKey([]byte(fs.config.PrivateKey.GetPayload()))
+ if err != nil {
+ fs.err <- err
+ return err
+ }
}
clientConfig.Auth = append(clientConfig.Auth, ssh.PublicKeys(signer))
}