Notify Slack when an SSH connection is made with sshpiper

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"log/slog"
	"net"
	"net/http"
	"os"

	"github.com/tg123/sshpiper/libplugin"
	"github.com/urfave/cli/v2"
	"golang.org/x/crypto/ssh"
)

func main() {
	libplugin.CreateAndRunPluginTemplate(&libplugin.PluginTemplate{
		Name: "authnotify",
		Flags: []cli.Flag{
			&cli.StringFlag{Name: "authorized-keys", Value: "/etc/sshpiperd/shared/authorized_keys"},
			&cli.StringFlag{Name: "slack-webhook-url-file"},
		},
		CreateConfig: func(c *cli.Context) (*libplugin.SshPiperPluginConfig, error) {
			authorizedKeysPath := c.String("authorized-keys")

			webhookURL := ""
			if f := c.String("slack-webhook-url-file"); f != "" {
				if b, err := os.ReadFile(f); err == nil {
					webhookURL = string(bytes.TrimSpace(b))
				}
			}

			return &libplugin.SshPiperPluginConfig{

				// Runs once per key the client's SSH agent offers.
				PublicKeyCallback: func(conn libplugin.ConnMetadata, key []byte) (*libplugin.Upstream, error) {
					identity := lookupIdentity(authorizedKeysPath, key)
					slog.Info("auth attempt", "identity", identity, "remote", conn.RemoteAddr())

					if identity == "" {
						// Not our key to judge — offer the agent's next key
						// instead of rejecting (that would trip failtoban)
						// or advancing (we'd miss whichever key actually works).
						return &libplugin.Upstream{
							Auth: libplugin.CreateRetryCurrentPluginAuth(map[string]string{}),
						}, nil
					}

					// Matched: hand off to workingdir, which makes the real
					// accept/reject decision. Carry identity forward for later.
					return &libplugin.Upstream{
						Auth: libplugin.CreateNextPluginAuth(map[string]string{"identity": identity}),
					}, nil
				},

				// Runs only once a connection is actually accepted and piped.
				PipeStartCallback: func(conn libplugin.ConnMetadata) {
					identity := conn.GetMeta("identity")
					ip, _, _ := net.SplitHostPort(conn.RemoteAddr())
					postToSlack(webhookURL, identity, conn.User(), ip)
				},
			}, nil
		},
	})
}

// lookupIdentity re-reads and re-parses authorized_keys on every call. The
// real plugin caches this on file mtime (see authnotify's authorizedKeysCache)
// so the hot auth path isn't re-parsing the file per offered key — trimmed
// here for clarity.
func lookupIdentity(path string, offeredKeyBytes []byte) string {
	offeredKey, err := ssh.ParsePublicKey(offeredKeyBytes)
	if err != nil {
		return ""
	}

	data, err := os.ReadFile(path)
	if err != nil {
		return ""
	}

	rest := data
	for len(rest) > 0 {
		key, comment, _, remainder, err := ssh.ParseAuthorizedKey(rest)
		if err != nil {
			break
		}
		if key != nil && bytes.Equal(key.Marshal(), offeredKey.Marshal()) {
			return comment
		}
		rest = remainder
	}

	return ""
}

func postToSlack(webhookURL, identity, client, ip string) {
	if webhookURL == "" || identity == "" {
		return
	}
	payload, err := json.Marshal(map[string]string{
		"text": fmt.Sprintf("SSH: %s connected to *%s* from %s", identity, client, ip),
	})
	if err != nil {
		return
	}
	http.Post(webhookURL, "application/json", bytes.NewReader(payload))
}