golang.org/x/crypto/ssh

https://pkg.go.dev/golang.org/x/crypto/ssh
Admin
golang.org/x/crypto/ssh implements SSH client and server protocols in Go, supporting secure...
Tokens:29,234
Snippets:416
Trust Score:9.6
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host. A Session only accepts one call to Run, Start or Shell.

```go
func (s *Session) Start(cmd string) error
```

--------------------------------

### Shell method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Starts a login shell on the remote host.

```go
func (s *Session) Shell() error
```

--------------------------------

### Run method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host. A Session only accepts one call to Run, Start, Shell, Output, or CombinedOutput.

```go
func (s *Session) Run(cmd string) error
```

--------------------------------

### func (*Session) Shell

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Starts a login shell on the remote host.

```APIDOC
## func (*Session) Shell() error

### Description
Starts a login shell on the remote host. A Session only accepts one call to Run, Start, Shell, Output, or CombinedOutput.
```

--------------------------------

### Dial function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Starts a client connection to an SSH server.

```go
func Dial(network, addr string, config *ClientConfig) (*Client, error)
```

--------------------------------

### NewServerConn function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Starts a new SSH server with the provided network connection and configuration. The returned channels must be serviced to prevent the connection from hanging.

```go
func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)
```

--------------------------------

### NewServerConn

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Starts a new SSH server connection using the provided network connection and configuration.

```APIDOC
## func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)

### Description
NewServerConn starts a new SSH server with c as the underlying transport. It performs a handshake and returns the connection, channels for new channels and requests, or an error if the handshake fails.

### Parameters
- **c** (net.Conn) - Required - The underlying network connection.
- **config** (*ServerConfig) - Required - The SSH server configuration.

### Returns
- **ServerConn** (*ServerConn) - The authenticated SSH connection.
- **NewChannel** (<-chan NewChannel) - Channel for incoming channels.
- **Request** (<-chan *Request) - Channel for incoming requests.
- **error** (error) - Error if the handshake fails.
```

--------------------------------

### NewClient function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a Client on top of the given connection.

```go
func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client
```

--------------------------------

### Client.Dial method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Initiates a connection to the addr from the remote host.

```go
func (c *Client) Dial(n, addr string) (net.Conn, error)
```

--------------------------------

### Session Output method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host and returns standard output.

```go
func (s *Session) Output(cmd string) ([]byte, error)
```

--------------------------------

### Client.ListenUnix method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Similar to ListenTCP but uses a Unix domain socket.

```go
func (c *Client) ListenUnix(socketPath string) (net.Listener, error)
```

--------------------------------

### Client.DialContext method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Initiates a connection to the addr from the remote host with context support. Added in v0.16.0.

```go
func (c *Client) DialContext(ctx context.Context, n, addr string) (net.Conn, error)
```

--------------------------------

### Client.NewSession method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Opens a new Session for this client for remote program execution.

```go
func (c *Client) NewSession() (*Session, error)
```

--------------------------------

### func Dial

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Dial starts a client connection to the given SSH server. It is a convenience function that connects to the given network address, initiates the SSH handshake, and then sets up a Client.

```APIDOC
## func Dial(network, addr string, config *ClientConfig) (*Client, error)

### Description
Dial starts a client connection to the given SSH server. It is a convenience function that connects to the given network address, initiates the SSH handshake, and then sets up a Client.

### Parameters
- **network** (string) - Required - The network type (e.g., "tcp").
- **addr** (string) - Required - The address to connect to.
- **config** (*ClientConfig) - Required - The SSH client configuration.

### Response
- **Client** (*Client) - The established SSH client.
- **error** (error) - An error if the connection or handshake fails.
```

--------------------------------

### SignWithAlgorithm interface method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

SignWithAlgorithm allows specifying a signing algorithm. Passing an empty string uses a default algorithm.

```go
SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
}
```

--------------------------------

### Client.Listen method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Requests the remote peer open a listening socket on addr. Incoming connections are available via Accept.

```go
func (c *Client) Listen(n, addr string) (net.Listener, error)
```

--------------------------------

### Session CombinedOutput method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host and returns combined standard output and error.

```go
func (s *Session) CombinedOutput(cmd string) ([]byte, error)
```

--------------------------------

### AddHostKey method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Adds a private key as a host key. If an existing host key exists with the same public key format, it is replaced. Each server config must have at least one host key.

```go
func (s *ServerConfig) AddHostKey(key Signer)
```

--------------------------------

### NewCertSigner Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a Signer that uses a certificate, verifying the private key matches the provided signer.

```go
func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
```

--------------------------------

### NewPublicKey function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a PublicKey instance from standard library public key types.

```go
func NewPublicKey(key interface{}) (PublicKey, error)
```

--------------------------------

### Client.HandleChannelOpen method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a channel on which NewChannel requests for the given type are sent.

```go
func (c *Client) HandleChannelOpen(channelType string) <-chan NewChannel
```

--------------------------------

### SupportedAlgorithms function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns algorithms implemented by the package, excluding those with security issues, in preference order.

```go
func SupportedAlgorithms() Algorithms
```

--------------------------------

### ServerConfig struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Configuration for an SSH server.

```go
type ServerConfig struct {
	// Config contains configuration shared between client and server.
	Config
```

--------------------------------

### RejectionReason type and constants

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Enumeration for channel creation rejection reasons.

```go
type RejectionReason uint32
const (
	Prohibited RejectionReason = iota + 1
	ConnectionFailed
	UnknownChannelType
	ResourceShortage
)
```

--------------------------------

### NewSignerWithAlgorithms function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a signer restricted to specific algorithms in preference order. The list must not be empty and cannot include certificate types.

```go
func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (MultiAlgorithmSigner, error)
```

--------------------------------

### MultiAlgorithmSigner Interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Interface for signers supporting multiple algorithms.

```go
type MultiAlgorithmSigner interface {
	AlgorithmSigner
```

--------------------------------

### Certificate Type method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns the certificate algorithm name.

```go
func (c *Certificate) Type() string
```

--------------------------------

### func New

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts

Creates a host key callback for SSH client configuration.

```APIDOC
## func New(files ...string) (ssh.HostKeyCallback, error)

### Description
Creates a host key callback from the given OpenSSH host key files. The returned callback is for use in ssh.ClientConfig.HostKeyCallback.

### Parameters
- **files** (...string) - Required - One or more paths to known_hosts files.
```

--------------------------------

### Session.Output

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host and returns the standard output.

```APIDOC
## func (*Session) Output(cmd string) ([]byte, error)

### Description
Output executes the specified command on the remote host and returns the standard output.

### Parameters
- **cmd** (string) - Required - The command to execute on the remote host.

### Returns
- **output** ([]byte) - The standard output of the command.
- **error** (error) - Error if the command execution fails.
```

--------------------------------

### GSSAPIWithMICConfig Struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Configuration struct for gssapi-with-mic authentication, requiring an AllowLogin callback and a GSSAPIServer implementation.

```go
type GSSAPIWithMICConfig struct {
	// AllowLogin, must be set, is called when gssapi-with-mic
	// authentication is selected (RFC 4462 section 3). The srcName is from the
	// results of the GSS-API authentication. The format is username@DOMAIN.
	// GSSAPI just guarantees to the server who the user is, but not if they can log in, and with what permissions.
	// This callback is called after the user identity is established with GSSAPI to decide if the user can login with
	// which permissions. If the user is allowed to login, it should return a nil error.
	AllowLogin func(conn ConnMetadata, srcName string) (*Permissions, error)

	// Server must be set. It's the implementation
	// of the GSSAPIServer interface. See GSSAPIServer interface for details.
	Server GSSAPIServer
}
```

--------------------------------

### NewPublicKey

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a new PublicKey instance from standard Go crypto public key types.

```APIDOC
## func NewPublicKey(key interface{}) (PublicKey, error)

### Description
Takes an *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey, or ed25519.PublicKey and returns a corresponding PublicKey instance. ECDSA keys must use P-256, P-384 or P-521.
```

--------------------------------

### New function signature

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts

Creates a host key callback from OpenSSH host key files for use in ssh.ClientConfig.HostKeyCallback.

```go
func New(files ...string) (ssh.HostKeyCallback, error)
```

--------------------------------

### NewClient

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a new SSH Client instance on top of an existing connection.

```APIDOC
## func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client

### Description
Creates a Client on top of the given connection.
```

--------------------------------

### Line function signature

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts

Returns a formatted line suitable for appending to a known_hosts file.

```go
func Line(addresses []string, key ssh.PublicKey) string
```

--------------------------------

### func (*Session) Run

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host and waits for completion.

```APIDOC
## func (*Session) Run(cmd string) error

### Description
Runs cmd on the remote host. Typically, the remote server passes cmd to the shell for interpretation. A Session only accepts one call to Run, Start, Shell, Output, or CombinedOutput.
```

--------------------------------

### Key methods

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Methods for the Key struct to satisfy the ssh.PublicKey interface and provide string representations.

```go
func (k *Key) Marshal() []byte
```

```go
func (k *Key) String() string
```

```go
func (k *Key) Type() string
```

```go
func (k *Key) Verify(data []byte, sig *ssh.Signature) error
```

--------------------------------

### Certificate SignCert method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Signs the certificate with an authority.

```go
func (c *Certificate) SignCert(rand io.Reader, authority Signer) error
```

--------------------------------

### Certificate Algorithm Constants

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Constants for certificate algorithms that can be used in ClientConfig.HostKeyAlgorithms.

```go
const (
	// CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a
	// Certificate.Type (or PublicKey.Type), but only in
	// ClientConfig.HostKeyAlgorithms.
	CertAlgoRSASHA256v01 = "rsa-sha2-256-cert-v01@openssh.com"
	CertAlgoRSASHA512v01 = "rsa-sha2-512-cert-v01@openssh.com"
)
```

--------------------------------

### StdinPipe method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a pipe connected to the remote command's standard input.

```go
func (s *Session) StdinPipe() (io.WriteCloser, error)
```

--------------------------------

### ForwardToRemote Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Routes authentication requests to the ssh-agent process serving on the specified unix socket.

```go
func ForwardToRemote(client *ssh.Client, addr string) error
```

--------------------------------

### NewClient function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Returns an Agent that communicates with an ssh-agent process over the provided connection.

```go
func NewClient(rw io.ReadWriter) ExtendedAgent
```

--------------------------------

### Password function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns an AuthMethod using the provided password string.

```go
func Password(secret string) AuthMethod
```

--------------------------------

### WindowChange method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Informs the remote host about a terminal window dimension change.

```go
func (s *Session) WindowChange(h, w int) error
```

--------------------------------

### Listen

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Requests the remote peer to open a listening socket.

```APIDOC
## func (*Client) Listen(n, addr string) (net.Listener, error)

### Description
Listen requests the remote peer open a listening socket on addr. Incoming connections will be available by calling Accept on the returned net.Listener.
```

--------------------------------

### NewKeyring

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Creates an in-memory Agent that is safe for concurrent use.

```APIDOC
## func NewKeyring()

### Description
NewKeyring returns an Agent that holds keys in memory. It is safe for concurrent use by multiple goroutines.

### Signature
func NewKeyring() Agent
```

--------------------------------

### MakeRaw function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/terminal

Puts the terminal into raw mode and returns the previous state for restoration.

```go
func MakeRaw(fd int) (*State, error)
```

--------------------------------

### NewClient

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Creates an Agent client that communicates with an ssh-agent process over an io.ReadWriter.

```APIDOC
## func NewClient(rw io.ReadWriter)

### Description
NewClient returns an Agent that talks to an ssh-agent process over the given connection. If the connection implements io.Closer, it supports pipelining concurrent requests.

### Signature
func NewClient(rw io.ReadWriter) ExtendedAgent
```

--------------------------------

### InsecureIgnoreHostKey Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a HostKeyCallback that accepts any host key. Not recommended for production use.

```go
func InsecureIgnoreHostKey() HostKeyCallback
```

--------------------------------

### PublicKey.Verify method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Verifies a signature on the given data using the public key.

```go
Verify(data []byte, sig *Signature) error
```

--------------------------------

### NewClientConn

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Establishes an authenticated SSH connection using the provided network connection and configuration.

```APIDOC
## func NewClientConn

### Description
Establishes an authenticated SSH connection using c as the underlying transport. The Request and NewChannel channels must be serviced or the connection will hang.

### Signature
func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
```

--------------------------------

### GSSAPIWithMICAuthMethod function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates an AuthMethod using 'gssapi-with-mic' authentication as defined in RFC 4462.

```go
func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod
```

--------------------------------

### func (*ServerConfig) AddHostKey

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Adds a private key as a host key to the server configuration. If a host key with the same public key format already exists, it is replaced.

```APIDOC
## func (*ServerConfig) AddHostKey

### Description
Adds a private key as a host key. If an existing host key exists with the same public key format, it is replaced. Each server config must have at least one host key.

### Signature
`func (s *ServerConfig) AddHostKey(key Signer)`

### Parameters
- **key** (Signer) - Required - The private key to be added as a host key.
```

--------------------------------

### NewSignerFromKey Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Converts various private key types into a Signer instance.

```go
func NewSignerFromKey(key interface{}) (Signer, error)
```

--------------------------------

### Client struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Implements a traditional SSH client supporting shells, subprocesses, and forwarding.

```go
type Client struct {
	Conn
	// contains filtered or unexported fields
}
```

--------------------------------

### Waitmsg Lang Method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns the language tag for the remote command.

```go
func (w Waitmsg) Lang() string
```

--------------------------------

### ServerAuthCallbacks struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Defines server-side authentication callbacks.

```go
type ServerAuthCallbacks struct {
	// PasswordCallback behaves like [ServerConfig.PasswordCallback].
	PasswordCallback func(conn ConnMetadata, password []byte) (*Permissions, error)

	// PublicKeyCallback behaves like [ServerConfig.PublicKeyCallback].
	PublicKeyCallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)

	// KeyboardInteractiveCallback behaves like [ServerConfig.KeyboardInteractiveCallback].
	KeyboardInteractiveCallback func(conn ConnMetadata, client KeyboardInteractiveChallenge) (*Permissions, error)

	// GSSAPIWithMICConfig behaves like [ServerConfig.GSSAPIWithMICConfig].
	GSSAPIWithMICConfig *GSSAPIWithMICConfig
}
```

--------------------------------

### Signal method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Sends the given signal to the remote process.

```go
func (s *Session) Signal(sig Signal) error
```

--------------------------------

### Certificate Verify method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Verifies a signature against the certificate's public key.

```go
func (c *Certificate) Verify(data []byte, sig *Signature) error
```

--------------------------------

### Key Exchange Constants

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Key exchange algorithms implemented by the library for use in Config.KeyExchanges.

```go
const (
	InsecureKeyExchangeDH1SHA1   = "diffie-hellman-group1-sha1"
	InsecureKeyExchangeDH14SHA1  = "diffie-hellman-group14-sha1"
	KeyExchangeDH14SHA256        = "diffie-hellman-group14-sha256"
	KeyExchangeDH16SHA512        = "diffie-hellman-group16-sha512"
	KeyExchangeECDHP256          = "ecdh-sha2-nistp256"
	KeyExchangeECDHP384          = "ecdh-sha2-nistp384"
	KeyExchangeECDHP521          = "ecdh-sha2-nistp521"
	KeyExchangeCurve25519        = "curve25519-sha256"
	InsecureKeyExchangeDHGEXSHA1 = "diffie-hellman-group-exchange-sha1"
	KeyExchangeDHGEXSHA256       = "diffie-hellman-group-exchange-sha256"
	// KeyExchangeMLKEM768X25519 is supported from Go 1.24.
	KeyExchangeMLKEM768X25519 = "mlkem768x25519-sha256"
)
```

--------------------------------

### NewSignerFromKey

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a Signer instance from various private key types.

```APIDOC
## func NewSignerFromKey(key interface{}) (Signer, error)

### Description
Takes an *rsa.PrivateKey, *dsa.PrivateKey, *ecdsa.PrivateKey or any other crypto.Signer and returns a corresponding Signer instance.
```

--------------------------------

### PublicKeysCallback function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns an AuthMethod that executes the provided function to retrieve a list of signers.

```go
func PublicKeysCallback(getSigners func() (signers []Signer, err error)) AuthMethod
```

--------------------------------

### RequestSubsystem method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Requests the association of a subsystem with the session on the remote host.

```go
func (s *Session) RequestSubsystem(subsystem string) error
```

--------------------------------

### func Line

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts

Generates a formatted line for a known_hosts file.

```APIDOC
## func Line(addresses []string, key ssh.PublicKey) string

### Description
Returns a line to append to the known_hosts files.

### Parameters
- **addresses** ([]string) - Required - A list of addresses for the host.
- **key** (ssh.PublicKey) - Required - The public key to include in the line.
```

--------------------------------

### Client.ListenTCP method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Requests the remote peer open a listening socket on laddr. Accepts an IP address.

```go
func (c *Client) ListenTCP(laddr *net.TCPAddr) (net.Listener, error)
```

--------------------------------

### AlgorithmsConnMetadata interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

An interface for retrieving the algorithms negotiated between client and server.

```go
type AlgorithmsConnMetadata interface {
	ConnMetadata
	Algorithms() NegotiatedAlgorithms
}
```

--------------------------------

### Config.SetDefaults Method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Sets sensible values for unset fields in config. This is exported for testing as SSH functions set defaults automatically.

```go
func (c *Config) SetDefaults()
```

--------------------------------

### CertChecker CheckCert method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Validates certificate properties including critical options, principals, revocation, and signatures.

```go
func (c *CertChecker) CheckCert(principal string, cert *Certificate) error
```

--------------------------------

### InsecureAlgorithms function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns algorithms implemented by the package that have known security issues.

```go
func InsecureAlgorithms() Algorithms
```

--------------------------------

### func MakeRaw(fd int) (*State, error)

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/terminal

Sets the terminal to raw mode and returns the previous state.

```APIDOC
## func MakeRaw(fd int) (*State, error)

### Description
Puts the terminal connected to the given file descriptor into raw mode and returns the previous state of the terminal so that it can be restored.

### Parameters
- **fd** (int) - Required - The file descriptor of the terminal.
```

--------------------------------

### DialContext

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Initiates a connection to the specified address from the remote host with context support.

```APIDOC
## func (*Client) DialContext(ctx context.Context, n, addr string) (net.Conn, error)

### Description
DialContext initiates a connection to the addr from the remote host. The provided Context must be non-nil. If the context expires before the connection is complete, an error is returned.
```

--------------------------------

### NewSignerFromSigner Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Wraps a crypto.Signer implementation into a Signer interface.

```go
func NewSignerFromSigner(signer crypto.Signer) (Signer, error)
```

--------------------------------

### ServeAgent Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Serves the agent protocol on the provided connection, returning when an I/O error occurs.

```go
func ServeAgent(agent Agent, c io.ReadWriter) error
```

--------------------------------

### Session.CombinedOutput

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Runs a command on the remote host and returns the combined standard output and standard error.

```APIDOC
## func (*Session) CombinedOutput(cmd string) ([]byte, error)

### Description
CombinedOutput executes the specified command on the remote host and captures both stdout and stderr.

### Parameters
- **cmd** (string) - Required - The command to execute on the remote host.

### Returns
- **output** ([]byte) - The combined output of the command.
- **error** (error) - Error if the command execution fails.
```

--------------------------------

### Algorithms configuration struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Algorithms defines the set of algorithms used for negotiation during a handshake.

```go
type Algorithms struct {
	KeyExchanges   []string
	Ciphers        []string
	MACs           []string
	HostKeys       []string
	PublicKeyAuths []string
}
```

--------------------------------

### NewSession

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Opens a new SSH session for remote program execution.

```APIDOC
## func (*Client) NewSession() (*Session, error)

### Description
NewSession opens a new Session for this client. (A session is a remote execution of a program.)
```

--------------------------------

### KeyboardInteractive function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns an AuthMethod using a prompt/response sequence controlled by the server.

```go
func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod
```

--------------------------------

### Request.Reply method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Sends a response to an SSH request if WantReply is true.

```go
func (r *Request) Reply(ok bool, payload []byte) error
```

--------------------------------

### AlgorithmSigner Interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Interface for algorithm-specific signers.

```go
type AlgorithmSigner interface {
	Signer
```

--------------------------------

### FixedHostKey Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a HostKeyCallback that accepts only the specified public key.

```go
func FixedHostKey(key PublicKey) HostKeyCallback
```

--------------------------------

### ParseKnownHosts function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Parses a single entry from a known_hosts file.

```go
func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey, comment string, rest []byte, err error)
```

--------------------------------

### Waitmsg String Method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns the string representation of the Waitmsg.

```go
func (w Waitmsg) String() string
```

--------------------------------

### Config Structure Definition

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Contains configuration data common to both ServerConfig and ClientConfig.

```go
type Config struct {
	// Rand provides the source of entropy for cryptographic
	// primitives. If Rand is nil, the cryptographic random reader
	// in package crypto/rand will be used.
	Rand io.Reader

	// The maximum number of bytes sent or received after which a
	// new key is negotiated. It must be at least 256. If
	// unspecified, a size suitable for the chosen cipher is used.
	RekeyThreshold uint64

	// The allowed key exchanges algorithms. If unspecified then a default set
	// of algorithms is used. Unsupported values are silently ignored.
	KeyExchanges []string

	// The allowed cipher algorithms. If unspecified then a sensible default is
	// used. Unsupported values are silently ignored.
	Ciphers []string

	// The allowed MAC algorithms. If unspecified then a sensible default is
	// used. Unsupported values are silently ignored.
	MACs []string
}
```

--------------------------------

### NegotiatedAlgorithms struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Defines the algorithms negotiated between the SSH client and server.

```go
type NegotiatedAlgorithms struct {
	KeyExchange string
	HostKey     string
	Read        DirectionAlgorithms
	Write       DirectionAlgorithms
}
```

--------------------------------

### GetSize function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/terminal

Returns the dimensions of the given terminal.

```go
func GetSize(fd int) (width, height int, err error)
```

--------------------------------

### NewKeyring function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Returns an Agent that holds keys in memory and is safe for concurrent use.

```go
func NewKeyring() Agent
```

--------------------------------

### Dial

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Initiates a connection to the specified address from the remote host.

```APIDOC
## func (*Client) Dial(n, addr string) (net.Conn, error)

### Description
Dial initiates a connection to the addr from the remote host. The resulting connection has a zero LocalAddr() and RemoteAddr().
```

--------------------------------

### func SupportedAlgorithms

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns algorithms currently implemented by this package, excluding those with security issues.

```APIDOC
## func SupportedAlgorithms()

### Description
Returns algorithms currently implemented by this package, excluding those with security issues. The algorithms listed here are in preference order.

### Returns
- **Algorithms** (struct) - A set of algorithms including KeyExchanges, Ciphers, MACs, HostKeys, and PublicKeyAuths.
```

--------------------------------

### PartialSuccessError struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Indicates that authentication has partially succeeded, but further steps are required.

```go
type PartialSuccessError struct {
	// Next defines the authentication callbacks to apply to further steps. The
	// available methods communicated to the client are based on the non-nil
	// ServerAuthCallbacks fields.
	Next ServerAuthCallbacks
}
```

```go
func (p *PartialSuccessError) Error() string
```

--------------------------------

### Setenv method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Sets an environment variable that will be applied to any command executed by Shell or Run.

```go
func (s *Session) Setenv(name, value string) error
```

--------------------------------

### NewClientConn function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Establishes an authenticated SSH connection using the provided transport. The Request and NewChannel channels must be serviced to prevent the connection from hanging.

```go
func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
```

--------------------------------

### CertChecker CheckHostKey method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Checks a host key certificate, suitable for use in ClientConfig.HostKeyCallback.

```go
func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key PublicKey) error
```

--------------------------------

### ForwardToAgent Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Routes authentication requests to the provided keyring.

```go
func ForwardToAgent(client *ssh.Client, keyring Agent) error
```

--------------------------------

### PublicKeys function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns an AuthMethod that uses the provided key pairs for authentication.

```go
func PublicKeys(signers ...Signer) AuthMethod
```

--------------------------------

### RequestAgentForwarding Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Sets up agent forwarding for an SSH session. Requires a subsequent call to ForwardToAgent or ForwardToRemote to route requests.

```go
func RequestAgentForwarding(session *ssh.Session) error
```

--------------------------------

### ServerPreAuthConn interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Interface available on an incoming server connection before authentication is completed.

```go
type ServerPreAuthConn interface {
	ConnMetadata

	// SendAuthBanner sends a banner message to the client.
	// It returns an error once the authentication phase has ended.
	SendAuthBanner(string) error
	// contains filtered or unexported methods
}
```

--------------------------------

### RejectionReason.String method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Converts a RejectionReason to a human-readable string.

```go
func (r RejectionReason) String() string
```

--------------------------------

### Wait method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Waits for the remote command to exit.

```go
func (s *Session) Wait() error
```

--------------------------------

### KnownKey.String method signature

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/knownhosts

Returns the string representation of a KnownKey.

```go
func (k *KnownKey) String() string
```

--------------------------------

### Certificate Marshal method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Serializes the certificate into OpenSSH wire format.

```go
func (c *Certificate) Marshal() []byte
```

--------------------------------

### func Password

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates an AuthMethod using a password.

```APIDOC
## func Password(secret string)

### Description
Returns an AuthMethod using the given password.

### Parameters
- **secret** (string) - The password string.

### Returns
- **AuthMethod** (interface) - An authentication method instance.
```

--------------------------------

### CertChecker Authenticate method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Checks a user certificate and can be used as a value for ServerConfig.PublicKeyCallback.

```go
func (c *CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)
```

--------------------------------

### StdoutPipe method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a pipe connected to the remote command's standard output. Buffering is shared with stderr.

```go
func (s *Session) StdoutPipe() (io.Reader, error)
```

--------------------------------

### Session RequestPty method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Requests the association of a pty with the session on the remote host.

```go
func (s *Session) RequestPty(term string, h, w int, termmodes TerminalModes) error
```

--------------------------------

### Agent Interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/agent

Defines the interface for interacting with an SSH agent, including listing, signing, adding, and removing keys.

```go
type Agent interface {
	// List returns the identities known to the agent.
	List() ([]*Key, error)

	// Sign has the agent sign the data using a protocol 2 key as defined
	// in [PROTOCOL.agent] section 2.6.2.
	Sign(key ssh.PublicKey, data []byte) (*ssh.Signature, error)

	// Add adds a private key to the agent.
	Add(key AddedKey) error

	// Remove removes all identities with the given public key.
	Remove(key ssh.PublicKey) error

	// RemoveAll removes all identities.
	RemoveAll() error

	// Lock locks the agent. Sign and Remove will fail, and List will empty an empty list.
	Lock(passphrase []byte) error

	// Unlock undoes the effect of Lock
	Unlock(passphrase []byte) error
```

--------------------------------

### GSSAPIServer Interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Defines the API for GSSAPI server-side authentication, including context establishment and MIC verification.

```go
type GSSAPIServer interface {
	// AcceptSecContext allows a remotely initiated security context between the application
	// and a remote peer to be established by the ssh client. The routine may return a
	// outputToken which should be transferred to the ssh client,
	// where the ssh client will present it to InitSecContext.
	// If no token need be sent, AcceptSecContext will indicate this
	// by setting the needContinue to false. To
	// complete the context establishment, one or more reply tokens may be
	// required from the ssh client. if so, AcceptSecContext
	// will return a needContinue which is true, in which case it
	// should be called again when the reply token is received from the ssh
	// client, passing the token to AcceptSecContext via the
	// token parameters.
	// The srcName return value is the authenticated username.
	// See RFC 2743 section 2.2.2 and RFC 4462 section 3.4.
	AcceptSecContext(token []byte) (outputToken []byte, srcName string, needContinue bool, err error)
	// VerifyMIC verifies that a cryptographic MIC, contained in the token parameter,
	// fits the supplied message is received from the ssh client.
	// See RFC 2743 section 2.3.2.
	VerifyMIC(micField []byte, micToken []byte) error
	// Whenever possible, it should be possible for
	// DeleteSecContext() calls to be successfully processed even
	// if other calls cannot succeed, thereby enabling context-related
	// resources to be released.
	// In addition to deleting established security contexts,
	// gss_delete_sec_context must also be able to delete "half-built"
	// security contexts resulting from an incomplete sequence of
	// InitSecContext()/AcceptSecContext() calls.
	// See RFC 2743 section 2.2.3.
	DeleteSecContext() error
}
```

--------------------------------

### ServerAuthError.Error method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns the string representation of the authentication error.

```go
func (l ServerAuthError) Error() string
```

--------------------------------

### Signer interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Interface for cryptographic signers.

```go
type Signer interface {
	// PublicKey returns the associated PublicKey.
	PublicKey() PublicKey
```

--------------------------------

### NewControlClientConn

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Establishes an SSH connection over an OpenSSH ControlMaster socket in proxy mode.

```APIDOC
## func NewControlClientConn

### Description
Establishes an SSH connection over an OpenSSH ControlMaster socket c in proxy mode. Note that this package only implements the client side of the multiplexing protocol. The provided net.Conn must be a local, secure connection (such as a Unix domain socket) connected to an already-running OpenSSH process acting as the ControlMaster.

### Signature
func NewControlClientConn(c net.Conn) (Conn, <-chan NewChannel, <-chan *Request, error)
```

--------------------------------

### PasswordCallback function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns an AuthMethod that uses a callback function to fetch a password.

```go
func PasswordCallback(prompt func() (secret string, err error)) AuthMethod
```

--------------------------------

### func Restore(fd int, oldState *State) error

Source: https://pkg.go.dev/golang.org/x/crypto/ssh/terminal

Restores the terminal to a previously saved state.

```APIDOC
## func Restore(fd int, oldState *State) error

### Description
Restores the terminal connected to the given file descriptor to a previous state.

### Parameters
- **fd** (int) - Required - The file descriptor of the terminal.
- **oldState** (*State) - Required - The state to restore to.
```

--------------------------------

### AuthMethod interface

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Represents an instance of an RFC 4252 authentication method.

```go
type AuthMethod interface {
	// contains filtered or unexported methods
}
```

--------------------------------

### ClientAuthContext struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Context provided to ClientAuthCallback containing connection metadata and negotiated algorithms. Added in v0.53.0.

```go
type ClientAuthContext struct {
	// Metadata contains the connection metadata.
	Metadata ConnMetadata

	// Algorithms contains the negotiated algorithms.
	Algorithms NegotiatedAlgorithms

	// AllowedMethods lists the authentication methods currently accepted
	// by the server. These are the protocol-level names defined in RFC 4252
	// such as "publickey", "password".
	AllowedMethods []string
```

--------------------------------

### MarshalPrivateKey Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a PEM block with the private key serialized in the OpenSSH format.

```go
func MarshalPrivateKey(key crypto.PrivateKey, comment string) (*pem.Block, error)
```

--------------------------------

### Client.DialTCP method

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Connects to the remote address raddr on the network net, which must be "tcp", "tcp4", or "tcp6".

```go
func (c *Client) DialTCP(n string, laddr, raddr *net.TCPAddr) (net.Conn, error)
```

--------------------------------

### MarshalPrivateKeyWithPassphrase Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Returns a PEM block holding the encrypted private key serialized in the OpenSSH format.

```go
func MarshalPrivateKeyWithPassphrase(key crypto.PrivateKey, comment string, passphrase []byte) (*pem.Block, error)
```

--------------------------------

### Permissions struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Defines permissions and critical options for an SSH connection, such as source-address validation.

```go
type Permissions struct {
	// CriticalOptions indicate restrictions to the default
	// permissions, and are typically used in conjunction with
	// user certificates. The standard for SSH certificates
	// defines "force-command" (only allow the given command to
	// execute) and "source-address" (only allow connections from
	// the given address). The SSH package currently only enforces
	// the "source-address" critical option: it is validated against
	// the client's remote address whenever it is present in the
	// Permissions returned by any authentication callback. Its value
	// is a comma-separated list of IP addresses and CIDR blocks;
	// consistently with OpenSSH, a connection whose remote address is
	// not an IP address, such as a Unix domain socket, never matches
	// the list and is rejected when the option is present. It is up
	// to server implementations to enforce other critical options,
	// such as "force-command", by checking them after the SSH
	// handshake is successful. In general, SSH servers should reject
	// connections that specify critical options that are unknown
	// or not supported.
	CriticalOptions map[string]string
```

--------------------------------

### Public Key Algorithm Constants

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Public key algorithm names for use in various SSH configuration fields.

```go
const (
	KeyAlgoRSA = "ssh-rsa"
	// Deprecated: DSA is only supported at insecure key sizes, and was removed
	// from major implementations.
	KeyAlgoDSA = InsecureKeyAlgoDSA
	// Deprecated: DSA is only supported at insecure key sizes, and was removed
	// from major implementations.
	InsecureKeyAlgoDSA = "ssh-dss"
	KeyAlgoECDSA256    = "ecdsa-sha2-nistp256"
	KeyAlgoSKECDSA256  = "sk-ecdsa-sha2-nistp256@openssh.com"
	KeyAlgoECDSA384    = "ecdsa-sha2-nistp384"
	KeyAlgoECDSA521    = "ecdsa-sha2-nistp521"
	KeyAlgoED25519     = "ssh-ed25519"
	KeyAlgoSKED25519   = "sk-ssh-ed25519@openssh.com"

	// KeyAlgoRSASHA256 and KeyAlgoRSASHA512 are only public key algorithms, not
	// public key formats, so they can't appear as a PublicKey.Type. The
	// corresponding PublicKey.Type is KeyAlgoRSA. See RFC 8332, Section 2.
	KeyAlgoRSASHA256 = "rsa-sha2-256"
	KeyAlgoRSASHA512 = "rsa-sha2-512"
)
```

--------------------------------

### CertChecker struct

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Defines the configuration for verifying SSH certificates, including authority checks, clock synchronization, and fallback mechanisms for non-certificate keys.

```go
type CertChecker struct {
	// SupportedCriticalOptions lists the CriticalOptions that the
	// application layer understands. A certificate carrying a critical
	// option that is not listed here is rejected.
	// CertChecker.Authenticate additionally accepts the source-address
	// option, which the server enforces on the Permissions that
	// Authenticate returns.
	SupportedCriticalOptions []string

	// IsUserAuthority should return true if the key is recognized as an
	// authority for user certificate. This must be set if this CertChecker
	// will be checking user certificates.
	IsUserAuthority func(auth PublicKey) bool

	// IsHostAuthority should report whether the key is recognized as
	// an authority for this host. This must be set if this CertChecker
	// will be checking host certificates.
	IsHostAuthority func(auth PublicKey, address string) bool

	// Clock is used for verifying time stamps. If nil, time.Now
	// is used.
	Clock func() time.Time

	// UserKeyFallback is called when CertChecker.Authenticate encounters a
	// public key that is not a certificate. It must implement validation
	// of user keys or else, if nil, all such keys are rejected.
	UserKeyFallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)

	// HostKeyFallback is called when CertChecker.CheckHostKey encounters a
	// public key that is not a certificate. It must implement host key
	// validation or else, if nil, all such keys are rejected.
	HostKeyFallback HostKeyCallback
}
```

--------------------------------

### MAC Constants

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Message authentication code (MAC) algorithms for use in Config.MACs.

```go
const (
	HMACSHA256ETM      = "hmac-sha2-256-etm@openssh.com"
	HMACSHA512ETM      = "hmac-sha2-512-etm@openssh.com"
	HMACSHA256         = "hmac-sha2-256"
	HMACSHA512         = "hmac-sha2-512"
	HMACSHA1           = "hmac-sha1"
	InsecureHMACSHA196 = "hmac-sha1-96"
)
```

--------------------------------

### ParsePrivateKeyWithPassphrase Function

Source: https://pkg.go.dev/golang.org/x/crypto/ssh

Creates a Signer from a PEM encoded private key using a passphrase.

```go
func ParsePrivateKeyWithPassphrase(pemBytes, passphrase []byte) (Signer, error)
```
Tokens:
Raw