graphical-ssh 0.1.1__py3-none-any.whl

gssh/data/gssh.svg

@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128">
+  <!-- Terminal background -->
+  <rect x="8" y="16" width="112" height="96" rx="8" fill="#1e1e1e" stroke="#3a3a3a" stroke-width="2"/>
+  <!-- Title bar -->
+  <rect x="8" y="16" width="112" height="20" rx="8" fill="#2d2d2d"/>
+  <rect x="8" y="28" width="112" height="8" fill="#2d2d2d"/>
+  <!-- Window dots -->
+  <circle cx="20" cy="26" r="4" fill="#e06c75"/>
+  <circle cx="34" cy="26" r="4" fill="#e5c07b"/>
+  <circle cx="48" cy="26" r="4" fill="#98c379"/>
+  <!-- Prompt > -->
+  <text x="20" y="64" font-family="monospace" font-size="16" fill="#61afef" font-weight="bold">&gt;</text>
+  <!-- ssh text -->
+  <text x="36" y="64" font-family="monospace" font-size="14" fill="#abb2bf">ssh</text>
+  <!-- Connection indicator -->
+  <line x1="20" y1="80" x2="100" y2="80" stroke="#3a3a3a" stroke-width="1"/>
+  <circle cx="28" cy="92" r="3" fill="#98c379"/>
+  <text x="38" y="96" font-family="monospace" font-size="10" fill="#5c6370">connected</text>
+  <!-- Key icon bottom-right -->
+  <g transform="translate(88, 88)">
+    <circle cx="8" cy="8" r="6" fill="none" stroke="#61afef" stroke-width="2"/>
+    <line x1="14" y1="8" x2="24" y2="8" stroke="#61afef" stroke-width="2"/>
+    <line x1="20" y1="8" x2="20" y2="12" stroke="#61afef" stroke-width="2"/>
+    <line x1="24" y1="8" x2="24" y2="14" stroke="#61afef" stroke-width="2"/>
+  </g>
+</svg>

gssh/host_editor.py

@@ -0,0 +1,174 @@
+"""Dialog for adding and editing SSH host entries."""
+
+from __future__ import annotations
+
+from PyQt6.QtWidgets import (
+    QComboBox,
+    QDialog,
+    QDialogButtonBox,
+    QFileDialog,
+    QFormLayout,
+    QHBoxLayout,
+    QLineEdit,
+    QPlainTextEdit,
+    QPushButton,
+    QVBoxLayout,
+    QWidget,
+)
+
+from .config import HostEntry
+
+
+class HostEditorDialog(QDialog):
+    """Modal dialog for editing a single HostEntry.
+
+    Pass an existing HostEntry to edit, or None to create a new one.
+    Call result() after accept to get the updated HostEntry.
+    """
+
+    def __init__(self, host: HostEntry | None = None, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self.setWindowTitle("Edit Host" if host else "Add Host")
+        self.setMinimumWidth(500)
+        self._host = host
+        self._build_ui()
+        if host:
+            self._populate(host)
+
+    def _build_ui(self) -> None:
+        layout = QVBoxLayout(self)
+
+        form = QFormLayout()
+
+        self.alias_edit = QLineEdit()
+        self.alias_edit.setPlaceholderText("myserver (or *.example.com)")
+        form.addRow("Alias / Pattern:", self.alias_edit)
+
+        self.hostname_edit = QLineEdit()
+        self.hostname_edit.setPlaceholderText("192.168.1.100")
+        form.addRow("Host Name:", self.hostname_edit)
+
+        self.user_edit = QLineEdit()
+        self.user_edit.setPlaceholderText("root")
+        form.addRow("User:", self.user_edit)
+
+        self.port_edit = QLineEdit()
+        self.port_edit.setPlaceholderText("22")
+        form.addRow("Port:", self.port_edit)
+
+        # IdentityFile with browse button
+        key_layout = QHBoxLayout()
+        self.identity_edit = QLineEdit()
+        self.identity_edit.setPlaceholderText("~/.ssh/id_ed25519")
+        browse_btn = QPushButton("Browse…")
+        browse_btn.clicked.connect(self._browse_key)
+        key_layout.addWidget(self.identity_edit)
+        key_layout.addWidget(browse_btn)
+        form.addRow("Identity File:", key_layout)
+
+        self.proxyjump_edit = QLineEdit()
+        self.proxyjump_edit.setPlaceholderText("jumpbox (optional)")
+        form.addRow("Proxy Jump:", self.proxyjump_edit)
+
+        # ForwardAgent combo
+        self.forwardagent_combo = QComboBox()
+        self.forwardagent_combo.addItems(["(default)", "yes", "no"])
+        form.addRow("Forward Agent:", self.forwardagent_combo)
+
+        layout.addLayout(form)
+
+        # Extra options text area
+        self.extra_edit = QPlainTextEdit()
+        self.extra_edit.setPlaceholderText("One option per line:\nCompression yes\nServerAliveInterval 60")
+        self.extra_edit.setMaximumHeight(120)
+        form2 = QFormLayout()
+        form2.addRow("Extra Options:", self.extra_edit)
+        layout.addLayout(form2)
+
+        # Buttons
+        buttons = QDialogButtonBox(
+            QDialogButtonBox.StandardButton.Ok | QDialogButtonBox.StandardButton.Cancel
+        )
+        buttons.accepted.connect(self._on_accept)
+        buttons.rejected.connect(self.reject)
+        layout.addWidget(buttons)
+
+    def _browse_key(self) -> None:
+        start_dir = self.identity_edit.text() or "~/.ssh"
+        path, _ = QFileDialog.getOpenFileName(
+            self, "Select SSH Key File", start_dir, "All Files (*)"
+        )
+        if path:
+            self.identity_edit.setText(path)
+
+    def _populate(self, host: HostEntry) -> None:
+        self.alias_edit.setText(host.pattern)
+        self.hostname_edit.setText(host.hostname)
+        self.user_edit.setText(host.user)
+        self.port_edit.setText(host.port)
+        self.identity_edit.setText(host.identity_file)
+        self.proxyjump_edit.setText(host.proxy_jump)
+
+        fa = host.forward_agent.lower()
+        idx = self.forwardagent_combo.findText(fa if fa in ("yes", "no") else "(default)")
+        self.forwardagent_combo.setCurrentIndex(max(0, idx))
+
+        extras = host.extra_options()
+        if extras:
+            lines = [f"{k} {v}" for k, v in extras.items()]
+            self.extra_edit.setPlainText("\n".join(lines))
+
+    def _on_accept(self) -> None:
+        alias = self.alias_edit.text().strip()
+        if not alias:
+            self.alias_edit.setFocus()
+            return
+        self.accept()
+
+    def result_host(self) -> HostEntry:
+        """Build a HostEntry from the dialog fields. Call after accept()."""
+        options: dict[str, str] = {}
+
+        hostname = self.hostname_edit.text().strip()
+        if hostname:
+            options["hostname"] = hostname
+
+        user = self.user_edit.text().strip()
+        if user:
+            options["user"] = user
+
+        port = self.port_edit.text().strip()
+        if port:
+            options["port"] = port
+
+        identity = self.identity_edit.text().strip()
+        if identity:
+            options["identityfile"] = identity
+
+        proxy = self.proxyjump_edit.text().strip()
+        if proxy:
+            options["proxyjump"] = proxy
+
+        fa = self.forwardagent_combo.currentText()
+        if fa in ("yes", "no"):
+            options["forwardagent"] = fa
+
+        # Parse extra options
+        for line in self.extra_edit.toPlainText().splitlines():
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#"):
+                continue
+            parts = stripped.split(None, 1)
+            if len(parts) == 2:
+                options[parts[0].lower()] = parts[1].strip()
+            elif len(parts) == 1:
+                options[parts[0].lower()] = ""
+
+        # Preserve raw_trailing if editing
+        trailing = self._host.raw_trailing if self._host else []
+
+        return HostEntry(
+            pattern=self.alias_edit.text().strip(),
+            options=options,
+            raw_trailing=trailing,
+        )

gssh/linter.py

@@ -0,0 +1,402 @@
+"""SSH config linter — catches errors no GUI manager checks.
+
+Validates ~/.ssh/config entries for common mistakes: unknown options,
+deprecated directives, missing or insecure identity files, port range
+issues, ProxyJump references to undefined hosts, and overlapping Host
+patterns that cause first-match-wins conflicts.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+from .config import HostEntry, SSHConfig
+
+__all__ = ["LintFinding", "lint_config", "severity_icon"]
+
+
+# Known ssh_config options — generated from `ssh -G` on OpenSSH 10.0p2
+# plus options that only work in config files (Include, Match, ControlPath,
+# LocalForward, RemoteForward, DynamicForward, ProxyJump, ProxyCommand).
+_KNOWN_OPTIONS = {
+    # Core connection
+    "host", "hostname", "user", "port", "addressfamily",
+    "bindaddress", "connecttimeout", "connectionattempts",
+    # Identity and auth
+    "identityfile", "identityagent", "certificatefile",
+    "identitiesonly", "addkeystoagent",
+    "pubkeyauthentication", "pubkeyacceptedalgorithms",
+    "hostbasedauthentication", "hostbasedacceptedalgorithms",
+    "passwordauthentication", "kbdinteractiveauthentication",
+    "kbdinteractivedevices", "numberofpasswordprompts",
+    "preferredauthentications", "requiredrsasize",
+    "casignaturealgorithms", "securitykeyprovider",
+    # Proxy and jumping
+    "proxyjump", "proxycommand", "proxyusefdpass",
+    # Forwarding
+    "forwardagent", "localforward", "remoteforward",
+    "dynamicforward", "gatewayports", "exitonforwardfailure",
+    "clearallforwardings", "permitremoteopen",
+    # X11
+    "forwardx11", "forwardx11trusted", "forwardx11timeout",
+    "xauthlocation",
+    # Control master
+    "controlmaster", "controlpath", "controlpersist",
+    # Host key checking
+    "stricthostkeychecking", "userknownhostsfile",
+    "globalknownhostsfile", "checkhostip", "verifyhostkeydns",
+    "visualhostkey", "updatehostkeys", "revokedhostkeys",
+    # Keepalive and timeout
+    "serveraliveinterval", "serveralivecountmax",
+    "tcpkeepalive",
+    # Compression
+    "compression",
+    # GSSAPI
+    "gssapiauthentication", "gssapidelegatecredentials",
+    "gssapikexalgorithms", "gssapikeyexchange",
+    "gssapirenewalforcesrekey", "gssapitrustdns",
+    # Canonicalization
+    "canonicalizehostname", "canonicaldomains",
+    "canonicalizefallbacklocal", "canonicalizemaxdots",
+    # Crypto
+    "ciphers", "macs", "kexalgorithms",
+    "hostkeyalgorithms",
+    # Logging
+    "loglevel", "logverbose", "syslogfacility",
+    # Session
+    "requesttty", "sessiontype", "permitlocalcommand",
+    "localcommand", "remotecommand", "stdinnull",
+    "escapechar", "enableescapecommandline",
+    # Tunnel
+    "tunnel", "tunneldevice",
+    # Fork
+    "forkafterauthentication",
+    # Misc
+    "batchmode", "hashknownhosts", "nohostauthenticationforlocalhost",
+    "enablesshkeysign", "fingerprinthash", "ipqos",
+    "obscurekeystroketiming", "rekeylimit", "channeltimeout",
+    "sendenv", "setenv", "tag",
+    "streamlocalbindmask", "streamlocalbindunlink",
+    # Config-file-only directives (not in ssh -G output)
+    "include", "match",
+}
+
+# Deprecated options (removed or superseded in modern OpenSSH)
+_DEPRECATED_OPTIONS = {
+    "cipher": "Use 'Ciphers' instead (plural).",
+    "protocol": "Protocol option is deprecated; SSHv1 is no longer supported.",
+    "fallbacktotrusted": "Deprecated; use 'ForwardX11Trusted'.",
+    "rsaauthentication": "Deprecated; use 'PubkeyAuthentication'.",
+    "rhostsrsaauthentication": "Removed in OpenSSH 8.0.",
+    "challengeresponseauthentication": "Deprecated; use 'KbdInteractiveAuthentication'.",
+    "useprivilegedport": "Deprecated.",
+    "compressionlevel": "Deprecated; Compression is a yes/no option now.",
+}
+
+# Options where "none" is a valid value meaning "disable"
+_NONE_VALUE_OPTIONS = {"identityfile", "proxyjump", "certificatefile",
+                       "remotecommand", "localcommand"}
+
+
+@dataclass
+class LintFinding:
+    """A single lint finding for an SSH config entry."""
+    severity: str  # "error" | "warning" | "info"
+    host_alias: str
+    option: str
+    message: str
+    suggestion: str = ""
+
+
+def severity_icon(severity: str) -> str:
+    """Return a display icon for a severity level."""
+    if severity == "error":
+        return "✗"
+    if severity == "warning":
+        return "⚠"
+    return "ℹ"
+
+
+def lint_config(config: SSHConfig, config_path: Path | None = None) -> list[LintFinding]:
+    """Lint an SSHConfig and return all findings.
+
+    Runs all checks and returns a list sorted by severity (errors first).
+    """
+    findings: list[LintFinding] = []
+
+    all_aliases = {h.alias for h in config.hosts}
+
+    for host in config.hosts:
+        findings.extend(_check_unknown_options(host))
+        findings.extend(_check_deprecated_options(host))
+        findings.extend(_check_identity_file(host, config_path))
+        findings.extend(_check_port(host))
+        findings.extend(_check_proxyjump(host, all_aliases))
+
+    findings.extend(_check_pattern_overlaps(config))
+
+    # Sort: errors first, then warnings, then info
+    severity_order = {"error": 0, "warning": 1, "info": 2}
+    findings.sort(key=lambda f: (severity_order.get(f.severity, 3), f.host_alias))
+    return findings
+
+
+def _check_unknown_options(host: HostEntry) -> list[LintFinding]:
+    """Check for options not in the known ssh_config set."""
+    findings = []
+    for key in host.options:
+        # Skip deprecated options — they're checked separately
+        if key in _DEPRECATED_OPTIONS:
+            continue
+        if key not in _KNOWN_OPTIONS:
+            findings.append(LintFinding(
+                severity="warning",
+                host_alias=host.alias,
+                option=key,
+                message=f"Unknown option '{key}' — may be ignored by ssh.",
+                suggestion="Check ssh_config(5) for valid options.",
+            ))
+    return findings
+
+
+def _check_deprecated_options(host: HostEntry) -> list[LintFinding]:
+    """Check for deprecated options."""
+    findings = []
+    for key in host.options:
+        if key in _DEPRECATED_OPTIONS:
+            findings.append(LintFinding(
+                severity="warning",
+                host_alias=host.alias,
+                option=key,
+                message=f"Deprecated option '{key}'.",
+                suggestion=_DEPRECATED_OPTIONS[key],
+            ))
+    return findings
+
+
+def _check_identity_file(host: HostEntry, config_path: Path | None) -> list[LintFinding]:
+    """Check IdentityFile exists and has secure permissions."""
+    findings = []
+    idfile = host.identity_file
+    if not idfile:
+        return findings
+
+    # "none" is a valid value meaning "don't use an identity file"
+    if idfile.lower() == "none":
+        return findings
+
+    expanded = os.path.expanduser(idfile)
+
+    if not os.path.exists(expanded):
+        findings.append(LintFinding(
+            severity="warning",
+            host_alias=host.alias,
+            option="identityfile",
+            message=f"IdentityFile '{idfile}' does not exist.",
+            suggestion="Generate a key with ssh-keygen or fix the path.",
+        ))
+        return findings
+
+    # Check permissions — private key should not be group/world readable
+    try:
+        st = os.stat(expanded)
+        if st.st_mode & 0o077:
+            findings.append(LintFinding(
+                severity="error",
+                host_alias=host.alias,
+                option="identityfile",
+                message=f"IdentityFile '{idfile}' has insecure permissions ({oct(st.st_mode & 0o777)}).",
+                suggestion="Run: chmod 600 <keyfile>",
+            ))
+    except OSError:
+        pass
+
+    return findings
+
+
+def _check_port(host: HostEntry) -> list[LintFinding]:
+    """Check port is a valid number in range."""
+    findings = []
+    port = host.port
+    if not port:
+        return findings
+
+    try:
+        p = int(port)
+        if p < 1 or p > 65535:
+            findings.append(LintFinding(
+                severity="error",
+                host_alias=host.alias,
+                option="port",
+                message=f"Port {port} is out of range (1-65535).",
+            ))
+    except ValueError:
+        findings.append(LintFinding(
+            severity="error",
+            host_alias=host.alias,
+            option="port",
+            message=f"Port '{port}' is not a valid number.",
+        ))
+    return findings
+
+
+# IPv6 address regex (simplified — matches [2001:db8::1] or bare 2001:db8::1)
+_IPV6_RE = re.compile(r"^\[?[0-9a-fA-F:]+\]?$")
+
+
+def _check_proxyjump(host: HostEntry, all_aliases: set[str]) -> list[LintFinding]:
+    """Check ProxyJump references a defined host."""
+    findings = []
+    proxy = host.proxy_jump
+    if not proxy:
+        return findings
+
+    # "none" disables proxyjump
+    if proxy.lower() == "none":
+        return findings
+
+    # ProxyJump can be a chain: jump1,jump2,...
+    # Each can be: hostalias, user@host, host:port, user@host:port,
+    # [ipv6]:port, ssh://user@host:port
+    jumps = proxy.split(",")
+    for jump in jumps:
+        jump = jump.strip()
+        jump_host = _parse_proxyjump_host(jump)
+        if not jump_host:
+            continue
+        if jump_host in all_aliases:
+            continue
+        # It might be a real hostname (not an alias) — that's fine
+        # Only warn if it looks like it should be an alias
+        if "*" not in jump_host and not _looks_like_hostname(jump_host):
+            findings.append(LintFinding(
+                severity="info",
+                host_alias=host.alias,
+                option="proxyjump",
+                message=f"ProxyJump host '{jump_host}' is not defined in ssh_config.",
+                suggestion=f"Add a 'Host {jump_host}' entry or verify the hostname.",
+            ))
+    return findings
+
+
+def _parse_proxyjump_host(jump: str) -> str:
+    """Extract the hostname from a ProxyJump destination string.
+
+    Handles: hostalias, user@host, host:port, user@host:port,
+    [ipv6]:port, user@[ipv6]:port, ssh://user@host:port
+    """
+    # Strip ssh:// prefix
+    if jump.startswith("ssh://"):
+        jump = jump[6:]
+    # Strip user@
+    if "@" in jump:
+        jump = jump.split("@", 1)[1]
+    # Handle bracketed IPv6: [2001:db8::1] or [2001:db8::1]:2222
+    if jump.startswith("["):
+        end = jump.find("]")
+        if end != -1:
+            return jump[1:end]
+        return jump[1:]  # malformed, but extract what we can
+    # Handle IPv6 without brackets (no dots, multiple colons)
+    if jump.count(":") >= 2:
+        return jump
+    # Handle host:port
+    if ":" in jump:
+        return jump.split(":")[0]
+    return jump
+
+
+def _looks_like_hostname(name: str) -> bool:
+    """Heuristic: does this look like a real hostname rather than an alias?"""
+    if "." in name:
+        return True  # FQDN or IP
+    # IPv6
+    if ":" in name:
+        return True
+    # Check if it's a numeric IP (4 octets)
+    parts = name.split(".")
+    if len(parts) == 4:
+        try:
+            for p in parts:
+                if 0 <= int(p) <= 255:
+                    continue
+                return False
+            return True
+        except ValueError:
+            pass
+    return False
+
+
+def _check_pattern_overlaps(config: SSHConfig) -> list[LintFinding]:
+    """Check for overlapping Host patterns that cause first-match-wins conflicts.
+
+    Only warns when a *less specific* pattern appears *before* a *more specific*
+    one with conflicting options — this is the actual first-match-wins trap.
+    The standard idiom (specific hosts first, `Host *` catch-all last) is
+    correctly ordered and will NOT produce a warning.
+    """
+    findings = []
+    hosts = config.hosts
+
+    for i, h1 in enumerate(hosts):
+        for j, h2 in enumerate(hosts):
+            if i >= j:
+                continue
+            # h1 is earlier in the file than h2.
+            # Only warn if h1 is *less specific* than h2 (h1's pattern
+            # is a superset of h2's). This catches the real trap:
+            # `Host *` before `Host server` means server's options are
+            # shadowed. The reverse (specific first, wildcard last) is
+            # the correct idiom and should not warn.
+            patterns1 = h1.pattern.split()
+            patterns2 = h2.pattern.split()
+            for p1 in patterns1:
+                for p2 in patterns2:
+                    if p1.startswith("!"):
+                        continue
+                    if p2.startswith("!"):
+                        continue
+                    # Only warn if p1 is broader than p2
+                    if not _is_broader_pattern(p1, p2):
+                        continue
+                    # Check if they have conflicting options
+                    shared_keys = set(h1.options.keys()) & set(h2.options.keys())
+                    conflicts = [k for k in shared_keys if h1.options[k] != h2.options[k]]
+                    if conflicts:
+                        findings.append(LintFinding(
+                            severity="info",
+                            host_alias=h1.alias,
+                            option="host",
+                            message=(
+                                f"Host pattern '{p1}' (earlier) is broader than "
+                                f"'{p2}' (in '{h2.alias}') with conflicting options: "
+                                f"{', '.join(conflicts)}. ssh uses first-match-wins."
+                            ),
+                            suggestion="Reorder: put specific hosts before wildcards.",
+                        ))
+    return findings
+
+
+def _is_broader_pattern(broad: str, specific: str) -> bool:
+    """Check if *broad* is a superset pattern of *specific*.
+
+    `*` is broader than everything. `*.example.com` is broader than
+    `server.example.com`. `server` is not broader than `server`.
+    """
+    if broad == "*":
+        return broad != specific
+    if broad == specific:
+        return False
+    if "*" in broad:
+        # broad is a wildcard — does specific match it?
+        if fnmatch.fnmatch(specific, broad):
+            return True
+        # Try a test name from the wildcard
+        test_name = broad.replace("*", "test")
+        if fnmatch.fnmatch(test_name, specific):
+            return True
+    return False