package ssh

Import Path
	golang.org/x/crypto/ssh (on go.dev)

Dependency Relation
	imports 46 packages, and imported by 2 packages

Involved Source Files

	    buffer.go
	    certs.go
	    channel.go
	    cipher.go
	    client.go
	    client_auth.go
	    common.go
	    connection.go
	  d doc.go
		Package ssh implements an SSH client and server.
		
		SSH is a transport security protocol, an authentication protocol and a
		family of application protocols. The most typical application level
		protocol is a remote shell and this is specifically implemented.  However,
		the multiplexed nature of SSH is exposed to users that wish to support
		others.
		
		References:
		
			[PROTOCOL]: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL?rev=HEAD
			[PROTOCOL.certkeys]: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
			[SSH-PARAMETERS]:    http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xml#ssh-parameters-1
		
		This package does not fall under the stability promise of the Go language itself,
		so its API may be changed when pressing needs arise.

	    handshake.go
	    kex.go
	    keys.go
	    mac.go
	    messages.go
	    mux.go
	    server.go
	    session.go
	    ssh_gss.go
	    streamlocal.go
	    tcpip.go
	    transport.go
Code Examples

	Certificate_SignCert
		package main
		
		import (
			"crypto/rand"
			"crypto/rsa"
			"fmt"
			"log"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			// Sign a certificate with a specific algorithm.
			privateKey, err := rsa.GenerateKey(rand.Reader, 3072)
			if err != nil {
				log.Fatal("unable to generate RSA key: ", err)
			}
			publicKey, err := ssh.NewPublicKey(&privateKey.PublicKey)
			if err != nil {
				log.Fatal("unable to get RSA public key: ", err)
			}
			caKey, err := rsa.GenerateKey(rand.Reader, 3072)
			if err != nil {
				log.Fatal("unable to generate CA key: ", err)
			}
			signer, err := ssh.NewSignerFromKey(caKey)
			if err != nil {
				log.Fatal("unable to generate signer from key: ", err)
			}
			mas, err := ssh.NewSignerWithAlgorithms(signer.(ssh.AlgorithmSigner), []string{ssh.KeyAlgoRSASHA256})
			if err != nil {
				log.Fatal("unable to create signer with algoritms: ", err)
			}
			certificate := ssh.Certificate{
				Key:      publicKey,
				CertType: ssh.UserCert,
			}
			if err := certificate.SignCert(rand.Reader, mas); err != nil {
				log.Fatal("unable to sign certificate: ", err)
			}
			// Save the public key to a file and check that rsa-sha-256 is used for
			// signing:
			// ssh-keygen -L -f <path to the file>
			fmt.Println(string(ssh.MarshalAuthorizedKey(&certificate)))
		}

	ClientConfig_HostKeyCallback
		package main
		
		import (
			"bufio"
			"log"
			"os"
			"path/filepath"
			"strings"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			// Every client must provide a host key check.  Here is a
			// simple-minded parse of OpenSSH's known_hosts file
			host := "hostname"
			file, err := os.Open(filepath.Join(os.Getenv("HOME"), ".ssh", "known_hosts"))
			if err != nil {
				log.Fatal(err)
			}
			defer file.Close()
		
			scanner := bufio.NewScanner(file)
			var hostKey ssh.PublicKey
			for scanner.Scan() {
				fields := strings.Split(scanner.Text(), " ")
				if len(fields) != 3 {
					continue
				}
				if strings.Contains(fields[0], host) {
					var err error
					hostKey, _, _, _, err = ssh.ParseAuthorizedKey(scanner.Bytes())
					if err != nil {
						log.Fatalf("error parsing %q: %v", fields[2], err)
					}
					break
				}
			}
		
			if hostKey == nil {
				log.Fatalf("no hostkey for %s", host)
			}
		
			config := ssh.ClientConfig{
				User:            os.Getenv("USER"),
				HostKeyCallback: ssh.FixedHostKey(hostKey),
			}
		
			_, err = ssh.Dial("tcp", host+":22", &config)
			log.Println(err)
		}

	Client_Listen
		package main
		
		import (
			"fmt"
			"log"
			"net/http"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			var hostKey ssh.PublicKey
			config := &ssh.ClientConfig{
				User: "username",
				Auth: []ssh.AuthMethod{
					ssh.Password("password"),
				},
				HostKeyCallback: ssh.FixedHostKey(hostKey),
			}
			// Dial your ssh server.
			conn, err := ssh.Dial("tcp", "localhost:22", config)
			if err != nil {
				log.Fatal("unable to connect: ", err)
			}
			defer conn.Close()
		
			// Request the remote side to open port 8080 on all interfaces.
			l, err := conn.Listen("tcp", "0.0.0.0:8080")
			if err != nil {
				log.Fatal("unable to register tcp forward: ", err)
			}
			defer l.Close()
		
			// Serve HTTP with your SSH server acting as a reverse proxy.
			http.Serve(l, http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
				fmt.Fprintf(resp, "Hello world!\n")
			}))
		}

	Dial
		package main
		
		import (
			"bytes"
			"fmt"
			"log"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			var hostKey ssh.PublicKey
			// An SSH client is represented with a ClientConn.
			//
			// To authenticate with the remote server you must pass at least one
			// implementation of AuthMethod via the Auth field in ClientConfig,
			// and provide a HostKeyCallback.
			config := &ssh.ClientConfig{
				User: "username",
				Auth: []ssh.AuthMethod{
					ssh.Password("yourpassword"),
				},
				HostKeyCallback: ssh.FixedHostKey(hostKey),
			}
			client, err := ssh.Dial("tcp", "yourserver.com:22", config)
			if err != nil {
				log.Fatal("Failed to dial: ", err)
			}
			defer client.Close()
		
			// Each ClientConn can support multiple interactive sessions,
			// represented by a Session.
			session, err := client.NewSession()
			if err != nil {
				log.Fatal("Failed to create session: ", err)
			}
			defer session.Close()
		
			// Once a Session is created, you can execute a single command on
			// the remote side using the Run method.
			var b bytes.Buffer
			session.Stdout = &b
			if err := session.Run("/usr/bin/whoami"); err != nil {
				log.Fatal("Failed to run: " + err.Error())
			}
			fmt.Println(b.String())
		}

	NewServerConn
		package main
		
		import (
			"fmt"
			"log"
			"net"
			"os"
		
			"golang.org/x/crypto/ssh"
			"golang.org/x/crypto/ssh/terminal"
		)
		
		func main() {
			// Public key authentication is done by comparing
			// the public key of a received connection
			// with the entries in the authorized_keys file.
			authorizedKeysBytes, err := os.ReadFile("authorized_keys")
			if err != nil {
				log.Fatalf("Failed to load authorized_keys, err: %v", err)
			}
		
			authorizedKeysMap := map[string]bool{}
			for len(authorizedKeysBytes) > 0 {
				pubKey, _, _, rest, err := ssh.ParseAuthorizedKey(authorizedKeysBytes)
				if err != nil {
					log.Fatal(err)
				}
		
				authorizedKeysMap[string(pubKey.Marshal())] = true
				authorizedKeysBytes = rest
			}
		
			// An SSH server is represented by a ServerConfig, which holds
			// certificate details and handles authentication of ServerConns.
			config := &ssh.ServerConfig{
				// Remove to disable password auth.
				PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
					// Should use constant-time compare (or better, salt+hash) in
					// a production setting.
					if c.User() == "testuser" && string(pass) == "tiger" {
						return nil, nil
					}
					return nil, fmt.Errorf("password rejected for %q", c.User())
				},
		
				// Remove to disable public key auth.
				PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
					if authorizedKeysMap[string(pubKey.Marshal())] {
						return &ssh.Permissions{
							// Record the public key used for authentication.
							Extensions: map[string]string{
								"pubkey-fp": ssh.FingerprintSHA256(pubKey),
							},
						}, nil
					}
					return nil, fmt.Errorf("unknown public key for %q", c.User())
				},
			}
		
			privateBytes, err := os.ReadFile("id_rsa")
			if err != nil {
				log.Fatal("Failed to load private key: ", err)
			}
		
			private, err := ssh.ParsePrivateKey(privateBytes)
			if err != nil {
				log.Fatal("Failed to parse private key: ", err)
			}
			config.AddHostKey(private)
		
			// Once a ServerConfig has been configured, connections can be
			// accepted.
			listener, err := net.Listen("tcp", "0.0.0.0:2022")
			if err != nil {
				log.Fatal("failed to listen for connection: ", err)
			}
			nConn, err := listener.Accept()
			if err != nil {
				log.Fatal("failed to accept incoming connection: ", err)
			}
		
			// Before use, a handshake must be performed on the incoming
			// net.Conn.
			conn, chans, reqs, err := ssh.NewServerConn(nConn, config)
			if err != nil {
				log.Fatal("failed to handshake: ", err)
			}
			log.Printf("logged in with key %s", conn.Permissions.Extensions["pubkey-fp"])
		
			// The incoming Request channel must be serviced.
			go ssh.DiscardRequests(reqs)
		
			// Service the incoming Channel channel.
			for newChannel := range chans {
				// Channels have a type, depending on the application level
				// protocol intended. In the case of a shell, the type is
				// "session" and ServerShell may be used to present a simple
				// terminal interface.
				if newChannel.ChannelType() != "session" {
					newChannel.Reject(ssh.UnknownChannelType, "unknown channel type")
					continue
				}
				channel, requests, err := newChannel.Accept()
				if err != nil {
					log.Fatalf("Could not accept channel: %v", err)
				}
		
				// Sessions have out-of-band requests such as "shell",
				// "pty-req" and "env".  Here we handle only the
				// "shell" request.
				go func(in <-chan *ssh.Request) {
					for req := range in {
						req.Reply(req.Type == "shell", nil)
					}
				}(requests)
		
				term := terminal.NewTerminal(channel, "> ")
		
				go func() {
					defer channel.Close()
					for {
						line, err := term.ReadLine()
						if err != nil {
							break
						}
						fmt.Println(line)
					}
				}()
			}
		}

	PublicKeys
		package main
		
		import (
			"log"
			"os"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			var hostKey ssh.PublicKey
			// A public key may be used to authenticate against the remote
			// server by using an unencrypted PEM-encoded private key file.
			//
			// If you have an encrypted private key, the crypto/x509 package
			// can be used to decrypt it.
			key, err := os.ReadFile("/home/user/.ssh/id_rsa")
			if err != nil {
				log.Fatalf("unable to read private key: %v", err)
			}
		
			// Create the Signer for this private key.
			signer, err := ssh.ParsePrivateKey(key)
			if err != nil {
				log.Fatalf("unable to parse private key: %v", err)
			}
		
			config := &ssh.ClientConfig{
				User: "user",
				Auth: []ssh.AuthMethod{
					// Use the PublicKeys method for remote authentication.
					ssh.PublicKeys(signer),
				},
				HostKeyCallback: ssh.FixedHostKey(hostKey),
			}
		
			// Connect to the remote server and perform the SSH handshake.
			client, err := ssh.Dial("tcp", "host.com:22", config)
			if err != nil {
				log.Fatalf("unable to connect: %v", err)
			}
			defer client.Close()
		}

	ServerConfig_AddHostKey
		package main
		
		import (
			"fmt"
			"log"
			"os"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			// Minimal ServerConfig supporting only password authentication.
			config := &ssh.ServerConfig{
				PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
					// Should use constant-time compare (or better, salt+hash) in
					// a production setting.
					if c.User() == "testuser" && string(pass) == "tiger" {
						return nil, nil
					}
					return nil, fmt.Errorf("password rejected for %q", c.User())
				},
			}
		
			privateBytes, err := os.ReadFile("id_rsa")
			if err != nil {
				log.Fatal("Failed to load private key: ", err)
			}
		
			private, err := ssh.ParsePrivateKey(privateBytes)
			if err != nil {
				log.Fatal("Failed to parse private key: ", err)
			}
			// Restrict host key algorithms to disable ssh-rsa.
			signer, err := ssh.NewSignerWithAlgorithms(private.(ssh.AlgorithmSigner), []string{ssh.KeyAlgoRSASHA256, ssh.KeyAlgoRSASHA512})
			if err != nil {
				log.Fatal("Failed to create private key with restricted algorithms: ", err)
			}
			config.AddHostKey(signer)
		}

	Session_RequestPty
		package main
		
		import (
			"log"
		
			"golang.org/x/crypto/ssh"
		)
		
		func main() {
			var hostKey ssh.PublicKey
			// Create client config
			config := &ssh.ClientConfig{
				User: "username",
				Auth: []ssh.AuthMethod{
					ssh.Password("password"),
				},
				HostKeyCallback: ssh.FixedHostKey(hostKey),
			}
			// Connect to ssh server
			conn, err := ssh.Dial("tcp", "localhost:22", config)
			if err != nil {
				log.Fatal("unable to connect: ", err)
			}
			defer conn.Close()
			// Create a session
			session, err := conn.NewSession()
			if err != nil {
				log.Fatal("unable to create session: ", err)
			}
			defer session.Close()
			// Set up terminal modes
			modes := ssh.TerminalModes{
				ssh.ECHO:          0,     // disable echoing
				ssh.TTY_OP_ISPEED: 14400, // input speed = 14.4kbaud
				ssh.TTY_OP_OSPEED: 14400, // output speed = 14.4kbaud
			}
			// Request pseudo terminal
			if err := session.RequestPty("xterm", 40, 80, modes); err != nil {
				log.Fatal("request for pseudo terminal failed: ", err)
			}
			// Start remote shell
			if err := session.Shell(); err != nil {
				log.Fatal("failed to start shell: ", err)
			}
		}


Package-Level Type Names (total 36)

	/* sort by: alphabet | popularity */
	 type AlgorithmSigner (interface)
		An AlgorithmSigner is a Signer that also supports specifying an algorithm to
		use for signing.
		
		An AlgorithmSigner can't advertise the algorithms it supports, unless it also
		implements MultiAlgorithmSigner, so it should be prepared to be invoked with
		every algorithm supported by the public key format.

		Methods (total 3)
			( AlgorithmSigner) PublicKey() PublicKey
				PublicKey returns the associated PublicKey.

			( AlgorithmSigner) Sign(rand io.Reader, data []byte) (*Signature, error)
				Sign returns a signature for the given data. This method will hash the
				data appropriately first. The signature algorithm is expected to match
				the key format returned by the PublicKey.Type method (and not to be any
				alternative algorithm supported by the key format).

			( AlgorithmSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
				SignWithAlgorithm is like Signer.Sign, but allows specifying a desired
				signing algorithm. Callers may pass an empty string for the algorithm in
				which case the AlgorithmSigner will use a default algorithm. This default
				doesn't currently control any behavior in this package.

		Implemented By (at least one exported)
			 MultiAlgorithmSigner (interface)
		Implements (at least one exported)
			 AlgorithmSigner : Signer
		As Inputs Of (at least one exported)
			func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (MultiAlgorithmSigner, error)

	 type AuthMethod (interface)
		An AuthMethod represents an instance of an RFC 4252 authentication method.

		Implemented By (at least one exported)
			 KeyboardInteractiveChallenge
		As Outputs Of (at least 7)
			func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod
			func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod
			func Password(secret string) AuthMethod
			func PasswordCallback(prompt func() (secret string, err error)) AuthMethod
			func PublicKeys(signers ...Signer) AuthMethod
			func PublicKeysCallback(getSigners func() (signers []Signer, err error)) AuthMethod
			func RetryableAuthMethod(auth AuthMethod, maxTries int) AuthMethod
		As Inputs Of (at least one exported)
			func RetryableAuthMethod(auth AuthMethod, maxTries int) AuthMethod

	 type BannerCallback (func)
		BannerCallback is the function type used for treat the banner sent by
		the server. A BannerCallback receives the message sent by the remote server.

		As Outputs Of (at least one exported)
			func BannerDisplayStderr() BannerCallback

	 type CertChecker (struct)
		CertChecker does the work of verifying a certificate. Its methods
		can be plugged into ClientConfig.HostKeyCallback and
		ServerConfig.PublicKeyCallback. For the CertChecker to work,
		minimally, the IsAuthority callback should be set.

		Fields (total 7)
			Clock func() time.Time
				Clock is used for verifying time stamps. If nil, time.Now
				is used.

			HostKeyFallback HostKeyCallback
				HostKeyFallback is called when CertChecker.CheckHostKey encounters a
				public key that is not a certificate. It must implement host key
				validation or else, if nil, all such keys are rejected.

			IsHostAuthority func(auth PublicKey, address string) bool
				IsHostAuthority should report whether the key is recognized as
				an authority for this host. This allows for certificates to be
				signed by other keys, and for those other keys to only be valid
				signers for particular hostnames. This must be set if this
				CertChecker will be checking host certificates.

			IsRevoked func(cert *Certificate) bool
				IsRevoked is called for each certificate so that revocation checking
				can be implemented. It should return true if the given certificate
				is revoked and false otherwise. If nil, no certificates are
				considered to have been revoked.

			IsUserAuthority func(auth PublicKey) bool
				IsUserAuthority should return true if the key is recognized as an
				authority for the given user certificate. This allows for
				certificates to be signed by other certificates. This must be set
				if this CertChecker will be checking user certificates.

			SupportedCriticalOptions []string
				SupportedCriticalOptions lists the CriticalOptions that the
				server application layer understands. These are only used
				for user certificates.

			UserKeyFallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)
				UserKeyFallback is called when CertChecker.Authenticate encounters a
				public key that is not a certificate. It must implement validation
				of user keys or else, if nil, all such keys are rejected.

		Methods (total 3)
			(*CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)
				Authenticate checks a user certificate. Authenticate can be used as
				a value for ServerConfig.PublicKeyCallback.

			(*CertChecker) CheckCert(principal string, cert *Certificate) error
				CheckCert checks CriticalOptions, ValidPrincipals, revocation, timestamp and
				the signature of the certificate.

			(*CertChecker) CheckHostKey(addr string, remote net.Addr, key PublicKey) error
				CheckHostKey checks a host key certificate. This method can be
				plugged into ClientConfig.HostKeyCallback.


	 type Certificate (struct)
		An Certificate represents an OpenSSH certificate as defined in
		[PROTOCOL.certkeys]?rev=1.8. The Certificate type implements the
		PublicKey interface, so it can be unmarshaled using
		ParsePublicKey.

		Fields (total 14)
			CertType uint32
			Key PublicKey
			KeyId string
			Nonce []byte
			Permissions Permissions
			Permissions.CriticalOptions map[string]string
				CriticalOptions indicate restrictions to the default
				permissions, and are typically used in conjunction with
				user certificates. The standard for SSH certificates
				defines "force-command" (only allow the given command to
				execute) and "source-address" (only allow connections from
				the given address). The SSH package currently only enforces
				the "source-address" critical option. It is up to server
				implementations to enforce other critical options, such as
				"force-command", by checking them after the SSH handshake
				is successful. In general, SSH servers should reject
				connections that specify critical options that are unknown
				or not supported.

			Permissions.Extensions map[string]string
				Extensions are extra functionality that the server may
				offer on authenticated connections. Lack of support for an
				extension does not preclude authenticating a user. Common
				extensions are "permit-agent-forwarding",
				"permit-X11-forwarding". The Go SSH library currently does
				not act on any extension, and it is up to server
				implementations to honor them. Extensions can be used to
				pass data from the authentication callbacks to the server
				application layer.

			Reserved []byte
			Serial uint64
			Signature *Signature
			SignatureKey PublicKey
			ValidAfter uint64
			ValidBefore uint64
			ValidPrincipals []string
		Methods (total 4)
			(*Certificate) Marshal() []byte
				Marshal serializes c into OpenSSH's wire format. It is part of the
				PublicKey interface.

			(*Certificate) SignCert(rand io.Reader, authority Signer) error
				SignCert signs the certificate with an authority, setting the Nonce,
				SignatureKey, and Signature fields. If the authority implements the
				MultiAlgorithmSigner interface the first algorithm in the list is used. This
				is useful if you want to sign with a specific algorithm.

			(*Certificate) Type() string
				Type returns the certificate algorithm name. It is part of the PublicKey interface.

			(*Certificate) Verify(data []byte, sig *Signature) error
				Verify verifies a signature against the certificate's public
				key. It is part of the PublicKey interface.

		Implements (at least one exported)
			*Certificate : PublicKey
		As Inputs Of (at least 2)
			func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
			func (*CertChecker).CheckCert(principal string, cert *Certificate) error

	 type Channel (interface)
		A Channel is an ordered, reliable, flow-controlled, duplex stream
		that is multiplexed over an SSH connection.

		Methods (total 6)
			( Channel) Close() error
				Close signals end of channel use. No data may be sent after this
				call.

			( Channel) CloseWrite() error
				CloseWrite signals the end of sending in-band
				data. Requests may still be sent, and the other side may
				still send data

			( Channel) Read(data []byte) (int, error)
				Read reads up to len(data) bytes from the channel.

			( Channel) SendRequest(name string, wantReply bool, payload []byte) (bool, error)
				SendRequest sends a channel request.  If wantReply is true,
				it will wait for a reply and return the result as a
				boolean, otherwise the return value will be false. Channel
				requests are out-of-band messages so they may be sent even
				if the data stream is closed or blocked by flow control.
				If the channel is closed before a reply is returned, io.EOF
				is returned.

			( Channel) Stderr() io.ReadWriter
				Stderr returns an io.ReadWriter that writes to this channel
				with the extended data type set to stderr. Stderr may
				safely be read and written from a different goroutine than
				Read and Write respectively.

			( Channel) Write(data []byte) (int, error)
				Write writes len(data) bytes to the channel.

		Implements (at least 8)
			 Channel : internal/bisect.Writer
			 Channel : io.Closer
			 Channel : io.ReadCloser
			 Channel : io.Reader
			 Channel : io.ReadWriteCloser
			 Channel : io.ReadWriter
			 Channel : io.WriteCloser
			 Channel : io.Writer
		As Outputs Of (at least 2)
			func Conn.OpenChannel(name string, data []byte) (Channel, <-chan *Request, error)
			func NewChannel.Accept() (Channel, <-chan *Request, error)

	 type Client (struct)
		Client implements a traditional SSH client that supports shells,
		subprocesses, TCP port/streamlocal forwarding and tunneled dialing.

		Fields (only one)
			Conn Conn
		Methods (total 17)
			( Client) ClientVersion() []byte
				ClientVersion returns the client's version string as hashed
				into the session ID.

			( Client) Close() error
				Close closes the underlying network connection

			(*Client) Dial(n, addr string) (net.Conn, error)
				Dial initiates a connection to the addr from the remote host.
				The resulting connection has a zero LocalAddr() and RemoteAddr().

			(*Client) DialTCP(n string, laddr, raddr *net.TCPAddr) (net.Conn, error)
				DialTCP connects to the remote address raddr on the network net,
				which must be "tcp", "tcp4", or "tcp6".  If laddr is not nil, it is used
				as the local address for the connection.

			(*Client) HandleChannelOpen(channelType string) <-chan NewChannel
				HandleChannelOpen returns a channel on which NewChannel requests
				for the given type are sent. If the type already is being handled,
				nil is returned. The channel is closed when the connection is closed.

			(*Client) Listen(n, addr string) (net.Listener, error)
				Listen requests the remote peer open a listening socket on
				addr. Incoming connections will be available by calling Accept on
				the returned net.Listener. The listener must be serviced, or the
				SSH connection may hang.
				N must be "tcp", "tcp4", "tcp6", or "unix".

			(*Client) ListenTCP(laddr *net.TCPAddr) (net.Listener, error)
				ListenTCP requests the remote peer open a listening socket
				on laddr. Incoming connections will be available by calling
				Accept on the returned net.Listener.

			(*Client) ListenUnix(socketPath string) (net.Listener, error)
				ListenUnix is similar to ListenTCP but uses a Unix domain socket.

			( Client) LocalAddr() net.Addr
				LocalAddr returns the local address for this connection.

			(*Client) NewSession() (*Session, error)
				NewSession opens a new Session for this client. (A session is a remote
				execution of a program.)

			( Client) OpenChannel(name string, data []byte) (Channel, <-chan *Request, error)
				OpenChannel tries to open an channel. If the request is
				rejected, it returns *OpenChannelError. On success it returns
				the SSH Channel and a Go channel for incoming, out-of-band
				requests. The Go channel must be serviced, or the
				connection will hang.

			( Client) RemoteAddr() net.Addr
				RemoteAddr returns the remote address for this connection.

			( Client) SendRequest(name string, wantReply bool, payload []byte) (bool, []byte, error)
				SendRequest sends a global request, and returns the
				reply. If wantReply is true, it returns the response status
				and payload. See also RFC 4254, section 4.

			( Client) ServerVersion() []byte
				ServerVersion returns the server's version string as hashed
				into the session ID.

			( Client) SessionID() []byte
				SessionID returns the session hash, also denoted by H.

			( Client) User() string
				User returns the user ID for this connection.

			( Client) Wait() error
				Wait blocks until the connection has shut down, and returns the
				error causing the shutdown.

		Implements (at least 3)
			 Client : Conn
			 Client : ConnMetadata
			 Client : io.Closer
		As Outputs Of (at least 4)
			func Dial(network, addr string, config *ClientConfig) (*Client, error)
			func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client
			func github.com/limanmys/render-engine/internal/bridge.InitShellWithCert(username, certificate, host, port string) (*Client, error)
			func github.com/limanmys/render-engine/internal/bridge.InitShellWithPassword(username, password, host, port string) (*Client, error)
		As Inputs Of (at least 2)
			func github.com/limanmys/render-engine/internal/bridge.OpenSFTPConnection(conn *Client) *sftp.Client
			func github.com/pkg/sftp.NewClient(conn *Client, opts ...sftp.ClientOption) (*sftp.Client, error)

	 type ClientConfig (struct)
		A ClientConfig structure is used to configure a Client. It must not be
		modified after having been passed to an SSH function.

		Fields (total 13)
			Auth []AuthMethod
				Auth contains possible authentication methods to use with the
				server. Only the first instance of a particular RFC 4252 method will
				be used during authentication.

			BannerCallback BannerCallback
				BannerCallback is called during the SSH dance to display a custom
				server's message. The client configuration can supply this callback to
				handle it as wished. The function BannerDisplayStderr can be used for
				simplistic display on Stderr.

			ClientVersion string
				ClientVersion contains the version identification string that will
				be used for the connection. If empty, a reasonable default is used.

			Config Config
				Config contains configuration that is shared between clients and
				servers.

			Config.Ciphers []string
				The allowed cipher algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			Config.KeyExchanges []string
				The allowed key exchanges algorithms. If unspecified then a default set
				of algorithms is used. Unsupported values are silently ignored.

			Config.MACs []string
				The allowed MAC algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			Config.Rand io.Reader
				Rand provides the source of entropy for cryptographic
				primitives. If Rand is nil, the cryptographic random reader
				in package crypto/rand will be used.

			Config.RekeyThreshold uint64
				The maximum number of bytes sent or received after which a
				new key is negotiated. It must be at least 256. If
				unspecified, a size suitable for the chosen cipher is used.

			HostKeyAlgorithms []string
				HostKeyAlgorithms lists the public key algorithms that the client will
				accept from the server for host key authentication, in order of
				preference. If empty, a reasonable default is used. Any
				string returned from a PublicKey.Type method may be used, or
				any of the CertAlgo and KeyAlgo constants.

			HostKeyCallback HostKeyCallback
				HostKeyCallback is called during the cryptographic
				handshake to validate the server's host key. The client
				configuration must supply this callback for the connection
				to succeed. The functions InsecureIgnoreHostKey or
				FixedHostKey can be used for simplistic host key checks.

			Timeout time.Duration
				Timeout is the maximum amount of time for the TCP connection to establish.
				
				A Timeout of zero means no timeout.

			User string
				User contains the username to authenticate as.

		Methods (only one)
			(*ClientConfig) SetDefaults()
				SetDefaults sets sensible values for unset fields in config. This is
				exported for testing: Configs passed to SSH functions are copied and have
				default values set automatically.

		As Inputs Of (at least 2)
			func Dial(network, addr string, config *ClientConfig) (*Client, error)
			func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)

	 type Config (struct)
		Config contains configuration data common to both ServerConfig and
		ClientConfig.

		Fields (total 5)
			Ciphers []string
				The allowed cipher algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			KeyExchanges []string
				The allowed key exchanges algorithms. If unspecified then a default set
				of algorithms is used. Unsupported values are silently ignored.

			MACs []string
				The allowed MAC algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			Rand io.Reader
				Rand provides the source of entropy for cryptographic
				primitives. If Rand is nil, the cryptographic random reader
				in package crypto/rand will be used.

			RekeyThreshold uint64
				The maximum number of bytes sent or received after which a
				new key is negotiated. It must be at least 256. If
				unspecified, a size suitable for the chosen cipher is used.

		Methods (only one)
			(*Config) SetDefaults()
				SetDefaults sets sensible values for unset fields in config. This is
				exported for testing: Configs passed to SSH functions are copied and have
				default values set automatically.


	 type Conn (interface)
		Conn represents an SSH connection for both server and client roles.
		Conn is the basis for implementing an application layer, such
		as ClientConn, which implements the traditional shell access for
		clients.

		Methods (total 10)
			( Conn) ClientVersion() []byte
				ClientVersion returns the client's version string as hashed
				into the session ID.

			( Conn) Close() error
				Close closes the underlying network connection

			( Conn) LocalAddr() net.Addr
				LocalAddr returns the local address for this connection.

			( Conn) OpenChannel(name string, data []byte) (Channel, <-chan *Request, error)
				OpenChannel tries to open an channel. If the request is
				rejected, it returns *OpenChannelError. On success it returns
				the SSH Channel and a Go channel for incoming, out-of-band
				requests. The Go channel must be serviced, or the
				connection will hang.

			( Conn) RemoteAddr() net.Addr
				RemoteAddr returns the remote address for this connection.

			( Conn) SendRequest(name string, wantReply bool, payload []byte) (bool, []byte, error)
				SendRequest sends a global request, and returns the
				reply. If wantReply is true, it returns the response status
				and payload. See also RFC 4254, section 4.

			( Conn) ServerVersion() []byte
				ServerVersion returns the server's version string as hashed
				into the session ID.

			( Conn) SessionID() []byte
				SessionID returns the session hash, also denoted by H.

			( Conn) User() string
				User returns the user ID for this connection.

			( Conn) Wait() error
				Wait blocks until the connection has shut down, and returns the
				error causing the shutdown.

		Implemented By (at least 2)
			 Client
			 ServerConn
		Implements (at least 2)
			 Conn : ConnMetadata
			 Conn : io.Closer
		As Outputs Of (at least one exported)
			func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
		As Inputs Of (at least one exported)
			func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client

	 type ConnMetadata (interface)
		ConnMetadata holds metadata for the connection.

		Methods (total 6)
			( ConnMetadata) ClientVersion() []byte
				ClientVersion returns the client's version string as hashed
				into the session ID.

			( ConnMetadata) LocalAddr() net.Addr
				LocalAddr returns the local address for this connection.

			( ConnMetadata) RemoteAddr() net.Addr
				RemoteAddr returns the remote address for this connection.

			( ConnMetadata) ServerVersion() []byte
				ServerVersion returns the server's version string as hashed
				into the session ID.

			( ConnMetadata) SessionID() []byte
				SessionID returns the session hash, also denoted by H.

			( ConnMetadata) User() string
				User returns the user ID for this connection.

		Implemented By (at least 3)
			 Client
			 Conn (interface)
			 ServerConn
		As Inputs Of (at least one exported)
			func (*CertChecker).Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)

	 type CryptoPublicKey (interface)
		CryptoPublicKey, if implemented by a PublicKey,
		returns the underlying crypto.PublicKey form of the key.

		Methods (only one)
			( CryptoPublicKey) CryptoPublicKey() crypto.PublicKey

	 type ExitError (struct)
		An ExitError reports unsuccessful completion of a remote command.

		Fields (only one)
			Waitmsg Waitmsg
		Methods (total 6)
			(*ExitError) Error() string
			( ExitError) ExitStatus() int
				ExitStatus returns the exit status of the remote command.

			( ExitError) Lang() string
				Lang returns the language tag. See RFC 3066

			( ExitError) Msg() string
				Msg returns the exit message given by the remote command

			( ExitError) Signal() string
				Signal returns the exit signal of the remote command if
				it was terminated violently.

			( ExitError) String() string
		Implements (at least 3)
			*ExitError : error
			 ExitError : fmt.Stringer
			 ExitError : github.com/ChrisTrenkamp/goxpath/tree.Result

	 type ExitMissingError (struct)
		ExitMissingError is returned if a session is torn down cleanly, but
		the server sends no confirmation of the exit status.

		Methods (only one)
			(*ExitMissingError) Error() string
		Implements (at least one exported)
			*ExitMissingError : error

	 type GSSAPIClient (interface)
		GSSAPIClient provides the API to plug-in GSSAPI authentication for client logins.

		Methods (total 3)
			( GSSAPIClient) DeleteSecContext() error
				Whenever possible, it should be possible for
				DeleteSecContext() calls to be successfully processed even
				if other calls cannot succeed, thereby enabling context-related
				resources to be released.
				In addition to deleting established security contexts,
				gss_delete_sec_context must also be able to delete "half-built"
				security contexts resulting from an incomplete sequence of
				InitSecContext()/AcceptSecContext() calls.
				See RFC 2743 section 2.2.3.

			( GSSAPIClient) GetMIC(micFiled []byte) ([]byte, error)
				GetMIC generates a cryptographic MIC for the SSH2 message, and places
				the MIC in a token for transfer to the ssh server.
				The contents of the MIC field are obtained by calling GSS_GetMIC()
				over the following, using the GSS-API context that was just
				established:
				 string    session identifier
				 byte      SSH_MSG_USERAUTH_REQUEST
				 string    user name
				 string    service
				 string    "gssapi-with-mic"
				See RFC 2743 section 2.3.1 and RFC 4462 3.5.

			( GSSAPIClient) InitSecContext(target string, token []byte, isGSSDelegCreds bool) (outputToken []byte, needContinue bool, err error)
				InitSecContext initiates the establishment of a security context for GSS-API between the
				ssh client and ssh server. Initially the token parameter should be specified as nil.
				The routine may return a outputToken which should be transferred to
				the ssh server, where the ssh server will present it to
				AcceptSecContext. If no token need be sent, InitSecContext will indicate this by setting
				needContinue to false. To complete the context
				establishment, one or more reply tokens may be required from the ssh
				server;if so, InitSecContext will return a needContinue which is true.
				In this case, InitSecContext should be called again when the
				reply token is received from the ssh server, passing the reply
				token to InitSecContext via the token parameters.
				See RFC 2743 section 2.2.1 and RFC 4462 section 3.4.

		As Inputs Of (at least one exported)
			func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod

	 type GSSAPIServer (interface)
		GSSAPIServer provides the API to plug in GSSAPI authentication for server logins.

		Methods (total 3)
			( GSSAPIServer) AcceptSecContext(token []byte) (outputToken []byte, srcName string, needContinue bool, err error)
				AcceptSecContext allows a remotely initiated security context between the application
				and a remote peer to be established by the ssh client. The routine may return a
				outputToken which should be transferred to the ssh client,
				where the ssh client will present it to InitSecContext.
				If no token need be sent, AcceptSecContext will indicate this
				by setting the needContinue to false. To
				complete the context establishment, one or more reply tokens may be
				required from the ssh client. if so, AcceptSecContext
				will return a needContinue which is true, in which case it
				should be called again when the reply token is received from the ssh
				client, passing the token to AcceptSecContext via the
				token parameters.
				The srcName return value is the authenticated username.
				See RFC 2743 section 2.2.2 and RFC 4462 section 3.4.

			( GSSAPIServer) DeleteSecContext() error
				Whenever possible, it should be possible for
				DeleteSecContext() calls to be successfully processed even
				if other calls cannot succeed, thereby enabling context-related
				resources to be released.
				In addition to deleting established security contexts,
				gss_delete_sec_context must also be able to delete "half-built"
				security contexts resulting from an incomplete sequence of
				InitSecContext()/AcceptSecContext() calls.
				See RFC 2743 section 2.2.3.

			( GSSAPIServer) VerifyMIC(micField []byte, micToken []byte) error
				VerifyMIC verifies that a cryptographic MIC, contained in the token parameter,
				fits the supplied message is received from the ssh client.
				See RFC 2743 section 2.3.2.


	 type GSSAPIWithMICConfig (struct)

		Fields (total 2)
			AllowLogin func(conn ConnMetadata, srcName string) (*Permissions, error)
				AllowLogin, must be set, is called when gssapi-with-mic
				authentication is selected (RFC 4462 section 3). The srcName is from the
				results of the GSS-API authentication. The format is username@DOMAIN.
				GSSAPI just guarantees to the server who the user is, but not if they can log in, and with what permissions.
				This callback is called after the user identity is established with GSSAPI to decide if the user can login with
				which permissions. If the user is allowed to login, it should return a nil error.

			Server GSSAPIServer
				Server must be set. It's the implementation
				of the GSSAPIServer interface. See GSSAPIServer interface for details.


	 type HostKeyCallback (func)
		HostKeyCallback is the function type used for verifying server
		keys.  A HostKeyCallback must return nil if the host key is OK, or
		an error to reject it. It receives the hostname as passed to Dial
		or NewClientConn. The remote address is the RemoteAddr of the
		net.Conn underlying the SSH connection.

		As Outputs Of (at least 2)
			func FixedHostKey(key PublicKey) HostKeyCallback
			func InsecureIgnoreHostKey() HostKeyCallback

	 type KeyboardInteractiveChallenge (func)
		KeyboardInteractiveChallenge should print questions, optionally
		disabling echoing (e.g. for passwords), and return all the answers.
		Challenge may be called multiple times in a single session. After
		successful authentication, the server may send a challenge with no
		questions, for which the name and instruction messages should be
		printed.  RFC 4256 section 3.3 details how the UI should behave for
		both CLI and GUI environments.

		Implements (at least one exported)
			 KeyboardInteractiveChallenge : AuthMethod
		As Inputs Of (at least one exported)
			func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod

	 type MultiAlgorithmSigner (interface)
		MultiAlgorithmSigner is an AlgorithmSigner that also reports the algorithms
		supported by that signer.

		Methods (total 4)
			( MultiAlgorithmSigner) Algorithms() []string
				Algorithms returns the available algorithms in preference order. The list
				must not be empty, and it must not include certificate types.

			( MultiAlgorithmSigner) PublicKey() PublicKey
				PublicKey returns the associated PublicKey.

			( MultiAlgorithmSigner) Sign(rand io.Reader, data []byte) (*Signature, error)
				Sign returns a signature for the given data. This method will hash the
				data appropriately first. The signature algorithm is expected to match
				the key format returned by the PublicKey.Type method (and not to be any
				alternative algorithm supported by the key format).

			( MultiAlgorithmSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
				SignWithAlgorithm is like Signer.Sign, but allows specifying a desired
				signing algorithm. Callers may pass an empty string for the algorithm in
				which case the AlgorithmSigner will use a default algorithm. This default
				doesn't currently control any behavior in this package.

		Implements (at least 2)
			 MultiAlgorithmSigner : AlgorithmSigner
			 MultiAlgorithmSigner : Signer
		As Outputs Of (at least one exported)
			func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (MultiAlgorithmSigner, error)

	 type NewChannel (interface)
		NewChannel represents an incoming request to a channel. It must either be
		accepted for use by calling Accept, or rejected by calling Reject.

		Methods (total 4)
			( NewChannel) Accept() (Channel, <-chan *Request, error)
				Accept accepts the channel creation request. It returns the Channel
				and a Go channel containing SSH requests. The Go channel must be
				serviced otherwise the Channel will hang.

			( NewChannel) ChannelType() string
				ChannelType returns the type of the channel, as supplied by the
				client.

			( NewChannel) ExtraData() []byte
				ExtraData returns the arbitrary payload for this channel, as supplied
				by the client. This data is specific to the channel type.

			( NewChannel) Reject(reason RejectionReason, message string) error
				Reject rejects the channel creation request. After calling
				this, no other methods on the Channel may be called.

		As Outputs Of (at least 3)
			func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
			func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)
			func (*Client).HandleChannelOpen(channelType string) <-chan NewChannel
		As Inputs Of (at least one exported)
			func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client

	 type OpenChannelError (struct)
		OpenChannelError is returned if the other side rejects an
		OpenChannel request.

		Fields (total 2)
			Message string
			Reason RejectionReason
		Methods (only one)
			(*OpenChannelError) Error() string
		Implements (at least one exported)
			*OpenChannelError : error

	 type PassphraseMissingError (struct)
		A PassphraseMissingError indicates that parsing this private key requires a
		passphrase. Use ParsePrivateKeyWithPassphrase.

		Fields (only one)
			PublicKey PublicKey
				PublicKey will be set if the private key format includes an unencrypted
				public key along with the encrypted private key.

		Methods (only one)
			(*PassphraseMissingError) Error() string
		Implements (at least one exported)
			*PassphraseMissingError : error

	 type Permissions (struct)
		The Permissions type holds fine-grained permissions that are
		specific to a user or a specific authentication method for a user.
		The Permissions value for a successful authentication attempt is
		available in ServerConn, so it can be used to pass information from
		the user-authentication phase to the application layer.

		Fields (total 2)
			CriticalOptions map[string]string
				CriticalOptions indicate restrictions to the default
				permissions, and are typically used in conjunction with
				user certificates. The standard for SSH certificates
				defines "force-command" (only allow the given command to
				execute) and "source-address" (only allow connections from
				the given address). The SSH package currently only enforces
				the "source-address" critical option. It is up to server
				implementations to enforce other critical options, such as
				"force-command", by checking them after the SSH handshake
				is successful. In general, SSH servers should reject
				connections that specify critical options that are unknown
				or not supported.

			Extensions map[string]string
				Extensions are extra functionality that the server may
				offer on authenticated connections. Lack of support for an
				extension does not preclude authenticating a user. Common
				extensions are "permit-agent-forwarding",
				"permit-X11-forwarding". The Go SSH library currently does
				not act on any extension, and it is up to server
				implementations to honor them. Extensions can be used to
				pass data from the authentication callbacks to the server
				application layer.

		As Outputs Of (at least one exported)
			func (*CertChecker).Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)

	 type PublicKey (interface)
		PublicKey represents a public key using an unspecified algorithm.
		
		Some PublicKeys provided by this package also implement CryptoPublicKey.

		Methods (total 3)
			( PublicKey) Marshal() []byte
				Marshal returns the serialized key data in SSH wire format, with the name
				prefix. To unmarshal the returned data, use the ParsePublicKey function.

			( PublicKey) Type() string
				Type returns the key format name, e.g. "ssh-rsa".

			( PublicKey) Verify(data []byte, sig *Signature) error
				Verify that sig is a signature on the given data using this key. This
				method will hash the data appropriately first. sig.Format is allowed to
				be any signature algorithm compatible with the key type, the caller
				should check if it has more stringent requirements.

		Implemented By (at least one exported)
			*Certificate
		As Outputs Of (at least 7)
			func NewPublicKey(key interface{}) (PublicKey, error)
			func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []string, rest []byte, err error)
			func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey, comment string, rest []byte, err error)
			func ParsePublicKey(in []byte) (out PublicKey, err error)
			func AlgorithmSigner.PublicKey() PublicKey
			func MultiAlgorithmSigner.PublicKey() PublicKey
			func Signer.PublicKey() PublicKey
		As Inputs Of (at least 6)
			func FingerprintLegacyMD5(pubKey PublicKey) string
			func FingerprintSHA256(pubKey PublicKey) string
			func FixedHostKey(key PublicKey) HostKeyCallback
			func MarshalAuthorizedKey(key PublicKey) []byte
			func (*CertChecker).Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error)
			func (*CertChecker).CheckHostKey(addr string, remote net.Addr, key PublicKey) error

	 type RejectionReason uint32 (basic type)
		RejectionReason is an enumeration used when rejecting channel creation
		requests. See RFC 4254, section 5.1.

		Methods (only one)
			( RejectionReason) String() string
				String converts the rejection reason to human readable form.

		Implements (at least 2)
			 RejectionReason : fmt.Stringer
			 RejectionReason : github.com/ChrisTrenkamp/goxpath/tree.Result
		As Inputs Of (at least one exported)
			func NewChannel.Reject(reason RejectionReason, message string) error
		As Types Of (total 4)
			const ConnectionFailed
			const Prohibited
			const ResourceShortage
			const UnknownChannelType

	 type Request (struct)
		Request is a request sent outside of the normal stream of
		data. Requests can either be specific to an SSH channel, or they
		can be global.

		Fields (total 3)
			Payload []byte
			Type string
			WantReply bool
		Methods (only one)
			(*Request) Reply(ok bool, payload []byte) error
				Reply sends a response to a request. It must be called for all requests
				where WantReply is true and is a no-op otherwise. The payload argument is
				ignored for replies to channel-specific requests.

		As Outputs Of (at least 4)
			func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
			func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)
			func Conn.OpenChannel(name string, data []byte) (Channel, <-chan *Request, error)
			func NewChannel.Accept() (Channel, <-chan *Request, error)
		As Inputs Of (at least 2)
			func DiscardRequests(in <-chan *Request)
			func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client

	 type ServerAuthError (struct)
		ServerAuthError represents server authentication errors and is
		sometimes returned by NewServerConn. It appends any authentication
		errors that may occur, and is returned if all of the authentication
		methods provided by the user failed to authenticate.

		Fields (only one)
			Errors []error
				Errors contains authentication errors returned by the authentication
				callback methods. The first entry is typically ErrNoAuth.

		Methods (only one)
			( ServerAuthError) Error() string
		Implements (at least one exported)
			 ServerAuthError : error

	 type ServerConfig (struct)
		ServerConfig holds server specific configuration data.

		Fields (total 16)
			AuthLogCallback func(conn ConnMetadata, method string, err error)
				AuthLogCallback, if non-nil, is called to log all authentication
				attempts.

			BannerCallback func(conn ConnMetadata) string
				BannerCallback, if present, is called and the return string is sent to
				the client after key exchange completed but before authentication.

			Config Config
				Config contains configuration shared between client and server.

			Config.Ciphers []string
				The allowed cipher algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			Config.KeyExchanges []string
				The allowed key exchanges algorithms. If unspecified then a default set
				of algorithms is used. Unsupported values are silently ignored.

			Config.MACs []string
				The allowed MAC algorithms. If unspecified then a sensible default is
				used. Unsupported values are silently ignored.

			Config.Rand io.Reader
				Rand provides the source of entropy for cryptographic
				primitives. If Rand is nil, the cryptographic random reader
				in package crypto/rand will be used.

			Config.RekeyThreshold uint64
				The maximum number of bytes sent or received after which a
				new key is negotiated. It must be at least 256. If
				unspecified, a size suitable for the chosen cipher is used.

			GSSAPIWithMICConfig *GSSAPIWithMICConfig
				GSSAPIWithMICConfig includes gssapi server and callback, which if both non-nil, is used
				when gssapi-with-mic authentication is selected (RFC 4462 section 3).

			KeyboardInteractiveCallback func(conn ConnMetadata, client KeyboardInteractiveChallenge) (*Permissions, error)
				KeyboardInteractiveCallback, if non-nil, is called when
				keyboard-interactive authentication is selected (RFC
				4256). The client object's Challenge function should be
				used to query the user. The callback may offer multiple
				Challenge rounds. To avoid information leaks, the client
				should be presented a challenge even if the user is
				unknown.

			MaxAuthTries int
				MaxAuthTries specifies the maximum number of authentication attempts
				permitted per connection. If set to a negative number, the number of
				attempts are unlimited. If set to zero, the number of attempts are limited
				to 6.

			NoClientAuth bool
				NoClientAuth is true if clients are allowed to connect without
				authenticating.
				To determine NoClientAuth at runtime, set NoClientAuth to true
				and the optional NoClientAuthCallback to a non-nil value.

			NoClientAuthCallback func(ConnMetadata) (*Permissions, error)
				NoClientAuthCallback, if non-nil, is called when a user
				attempts to authenticate with auth method "none".
				NoClientAuth must also be set to true for this be used, or
				this func is unused.

			PasswordCallback func(conn ConnMetadata, password []byte) (*Permissions, error)
				PasswordCallback, if non-nil, is called when a user
				attempts to authenticate using a password.

			PublicKeyCallback func(conn ConnMetadata, key PublicKey) (*Permissions, error)
				PublicKeyCallback, if non-nil, is called when a client
				offers a public key for authentication. It must return a nil error
				if the given public key can be used to authenticate the
				given user. For example, see CertChecker.Authenticate. A
				call to this function does not guarantee that the key
				offered is in fact used to authenticate. To record any data
				depending on the public key, store it inside a
				Permissions.Extensions entry.

			ServerVersion string
				ServerVersion is the version identification string to announce in
				the public handshake.
				If empty, a reasonable default is used.
				Note that RFC 4253 section 4.2 requires that this string start with
				"SSH-2.0-".

		Methods (total 2)
			(*ServerConfig) AddHostKey(key Signer)
				AddHostKey adds a private key as a host key. If an existing host
				key exists with the same public key format, it is replaced. Each server
				config must have at least one host key.

			(*ServerConfig) SetDefaults()
				SetDefaults sets sensible values for unset fields in config. This is
				exported for testing: Configs passed to SSH functions are copied and have
				default values set automatically.

		As Inputs Of (at least one exported)
			func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)

	 type ServerConn (struct)
		ServerConn is an authenticated SSH connection, as seen from the
		server

		Fields (total 2)
			Conn Conn
			Permissions *Permissions
				If the succeeding authentication callback returned a
				non-nil Permissions pointer, it is stored here.

		Methods (total 10)
			( ServerConn) ClientVersion() []byte
				ClientVersion returns the client's version string as hashed
				into the session ID.

			( ServerConn) Close() error
				Close closes the underlying network connection

			( ServerConn) LocalAddr() net.Addr
				LocalAddr returns the local address for this connection.

			( ServerConn) OpenChannel(name string, data []byte) (Channel, <-chan *Request, error)
				OpenChannel tries to open an channel. If the request is
				rejected, it returns *OpenChannelError. On success it returns
				the SSH Channel and a Go channel for incoming, out-of-band
				requests. The Go channel must be serviced, or the
				connection will hang.

			( ServerConn) RemoteAddr() net.Addr
				RemoteAddr returns the remote address for this connection.

			( ServerConn) SendRequest(name string, wantReply bool, payload []byte) (bool, []byte, error)
				SendRequest sends a global request, and returns the
				reply. If wantReply is true, it returns the response status
				and payload. See also RFC 4254, section 4.

			( ServerConn) ServerVersion() []byte
				ServerVersion returns the server's version string as hashed
				into the session ID.

			( ServerConn) SessionID() []byte
				SessionID returns the session hash, also denoted by H.

			( ServerConn) User() string
				User returns the user ID for this connection.

			( ServerConn) Wait() error
				Wait blocks until the connection has shut down, and returns the
				error causing the shutdown.

		Implements (at least 3)
			 ServerConn : Conn
			 ServerConn : ConnMetadata
			 ServerConn : io.Closer
		As Outputs Of (at least one exported)
			func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)

	 type Session (struct)
		A Session represents a connection to a remote command or shell.

		Fields (total 3)
			Stderr io.Writer
			Stdin io.Reader
				Stdin specifies the remote process's standard input.
				If Stdin is nil, the remote process reads from an empty
				bytes.Buffer.

			Stdout io.Writer
				Stdout and Stderr specify the remote process's standard
				output and error.
				
				If either is nil, Run connects the corresponding file
				descriptor to an instance of io.Discard. There is a
				fixed amount of buffering that is shared for the two streams.
				If either blocks it may eventually cause the remote
				command to block.

		Methods (total 16)
			(*Session) Close() error
			(*Session) CombinedOutput(cmd string) ([]byte, error)
				CombinedOutput runs cmd on the remote host and returns its combined
				standard output and standard error.

			(*Session) Output(cmd string) ([]byte, error)
				Output runs cmd on the remote host and returns its standard output.

			(*Session) RequestPty(term string, h, w int, termmodes TerminalModes) error
				RequestPty requests the association of a pty with the session on the remote host.

			(*Session) RequestSubsystem(subsystem string) error
				RequestSubsystem requests the association of a subsystem with the session on the remote host.
				A subsystem is a predefined command that runs in the background when the ssh session is initiated

			(*Session) Run(cmd string) error
				Run runs cmd on the remote host. Typically, the remote
				server passes cmd to the shell for interpretation.
				A Session only accepts one call to Run, Start, Shell, Output,
				or CombinedOutput.
				
				The returned error is nil if the command runs, has no problems
				copying stdin, stdout, and stderr, and exits with a zero exit
				status.
				
				If the remote server does not send an exit status, an error of type
				*ExitMissingError is returned. If the command completes
				unsuccessfully or is interrupted by a signal, the error is of type
				*ExitError. Other error types may be returned for I/O problems.

			(*Session) SendRequest(name string, wantReply bool, payload []byte) (bool, error)
				SendRequest sends an out-of-band channel request on the SSH channel
				underlying the session.

			(*Session) Setenv(name, value string) error
				Setenv sets an environment variable that will be applied to any
				command executed by Shell or Run.

			(*Session) Shell() error
				Shell starts a login shell on the remote host. A Session only
				accepts one call to Run, Start, Shell, Output, or CombinedOutput.

			(*Session) Signal(sig Signal) error
				Signal sends the given signal to the remote process.
				sig is one of the SIG* constants.

			(*Session) Start(cmd string) error
				Start runs cmd on the remote host. Typically, the remote
				server passes cmd to the shell for interpretation.
				A Session only accepts one call to Run, Start or Shell.

			(*Session) StderrPipe() (io.Reader, error)
				StderrPipe returns a pipe that will be connected to the
				remote command's standard error when the command starts.
				There is a fixed amount of buffering that is shared between
				stdout and stderr streams. If the StderrPipe reader is
				not serviced fast enough it may eventually cause the
				remote command to block.

			(*Session) StdinPipe() (io.WriteCloser, error)
				StdinPipe returns a pipe that will be connected to the
				remote command's standard input when the command starts.

			(*Session) StdoutPipe() (io.Reader, error)
				StdoutPipe returns a pipe that will be connected to the
				remote command's standard output when the command starts.
				There is a fixed amount of buffering that is shared between
				stdout and stderr streams. If the StdoutPipe reader is
				not serviced fast enough it may eventually cause the
				remote command to block.

			(*Session) Wait() error
				Wait waits for the remote command to exit.
				
				The returned error is nil if the command runs, has no problems
				copying stdin, stdout, and stderr, and exits with a zero exit
				status.
				
				If the remote server does not send an exit status, an error of type
				*ExitMissingError is returned. If the command completes
				unsuccessfully or is interrupted by a signal, the error is of type
				*ExitError. Other error types may be returned for I/O problems.

			(*Session) WindowChange(h, w int) error
				WindowChange informs the remote host about a terminal window dimension change to h rows and w columns.

		Implements (at least one exported)
			*Session : io.Closer
		As Outputs Of (at least one exported)
			func (*Client).NewSession() (*Session, error)

	 type Signal string (basic type)

		As Inputs Of (at least one exported)
			func (*Session).Signal(sig Signal) error
		As Types Of (total 13)
			const SIGABRT
			const SIGALRM
			const SIGFPE
			const SIGHUP
			const SIGILL
			const SIGINT
			const SIGKILL
			const SIGPIPE
			const SIGQUIT
			const SIGSEGV
			const SIGTERM
			const SIGUSR1
			const SIGUSR2

	 type Signature (struct)
		Signature represents a cryptographic signature.

		Fields (total 3)
			Blob []byte
			Format string
			Rest []byte
		As Outputs Of (at least 5)
			func AlgorithmSigner.Sign(rand io.Reader, data []byte) (*Signature, error)
			func AlgorithmSigner.SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
			func MultiAlgorithmSigner.Sign(rand io.Reader, data []byte) (*Signature, error)
			func MultiAlgorithmSigner.SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
			func Signer.Sign(rand io.Reader, data []byte) (*Signature, error)
		As Inputs Of (at least 2)
			func (*Certificate).Verify(data []byte, sig *Signature) error
			func PublicKey.Verify(data []byte, sig *Signature) error

	 type Signer (interface)
		A Signer can create signatures that verify against a public key.
		
		Some Signers provided by this package also implement MultiAlgorithmSigner.

		Methods (total 2)
			( Signer) PublicKey() PublicKey
				PublicKey returns the associated PublicKey.

			( Signer) Sign(rand io.Reader, data []byte) (*Signature, error)
				Sign returns a signature for the given data. This method will hash the
				data appropriately first. The signature algorithm is expected to match
				the key format returned by the PublicKey.Type method (and not to be any
				alternative algorithm supported by the key format).

		Implemented By (at least 2)
			 AlgorithmSigner (interface)
			 MultiAlgorithmSigner (interface)
		As Outputs Of (at least 5)
			func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
			func NewSignerFromKey(key interface{}) (Signer, error)
			func NewSignerFromSigner(signer crypto.Signer) (Signer, error)
			func ParsePrivateKey(pemBytes []byte) (Signer, error)
			func ParsePrivateKeyWithPassphrase(pemBytes, passphrase []byte) (Signer, error)
		As Inputs Of (at least 4)
			func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
			func PublicKeys(signers ...Signer) AuthMethod
			func (*Certificate).SignCert(rand io.Reader, authority Signer) error
			func (*ServerConfig).AddHostKey(key Signer)

	 type TerminalModes (map)

		As Inputs Of (at least one exported)
			func (*Session).RequestPty(term string, h, w int, termmodes TerminalModes) error

	 type Waitmsg (struct)
		Waitmsg stores the information about an exited remote command
		as reported by Wait.

		Methods (total 5)
			( Waitmsg) ExitStatus() int
				ExitStatus returns the exit status of the remote command.

			( Waitmsg) Lang() string
				Lang returns the language tag. See RFC 3066

			( Waitmsg) Msg() string
				Msg returns the exit message given by the remote command

			( Waitmsg) Signal() string
				Signal returns the exit signal of the remote command if
				it was terminated violently.

			( Waitmsg) String() string
		Implements (at least 2)
			 Waitmsg : fmt.Stringer
			 Waitmsg : github.com/ChrisTrenkamp/goxpath/tree.Result


Package-Level Functions (total 35)

	 func BannerDisplayStderr() BannerCallback
		BannerDisplayStderr returns a function that can be used for
		ClientConfig.BannerCallback to display banners on os.Stderr.

	 func Dial(network, addr string, config *ClientConfig) (*Client, error)
		Dial starts a client connection to the given SSH server. It is a
		convenience function that connects to the given network address,
		initiates the SSH handshake, and then sets up a Client.  For access
		to incoming channels and requests, use net.Dial with NewClientConn
		instead.

	 func DiscardRequests(in <-chan *Request)
		DiscardRequests consumes and rejects all requests from the
		passed-in channel.

	 func FingerprintLegacyMD5(pubKey PublicKey) string
		FingerprintLegacyMD5 returns the user presentation of the key's
		fingerprint as described by RFC 4716 section 4.

	 func FingerprintSHA256(pubKey PublicKey) string
		FingerprintSHA256 returns the user presentation of the key's
		fingerprint as unpadded base64 encoded sha256 hash.
		This format was introduced from OpenSSH 6.8.
		https://www.openssh.com/txt/release-6.8
		https://tools.ietf.org/html/rfc4648#section-3.2 (unpadded base64 encoding)

	 func FixedHostKey(key PublicKey) HostKeyCallback
		FixedHostKey returns a function for use in
		ClientConfig.HostKeyCallback to accept only a specific host key.

	 func GSSAPIWithMICAuthMethod(gssAPIClient GSSAPIClient, target string) AuthMethod
		GSSAPIWithMICAuthMethod is an AuthMethod with "gssapi-with-mic" authentication.
		See RFC 4462 section 3
		gssAPIClient is implementation of the GSSAPIClient interface, see the definition of the interface for details.
		target is the server host you want to log in to.

	 func InsecureIgnoreHostKey() HostKeyCallback
		InsecureIgnoreHostKey returns a function that can be used for
		ClientConfig.HostKeyCallback to accept any host key. It should
		not be used for production code.

	 func KeyboardInteractive(challenge KeyboardInteractiveChallenge) AuthMethod
		KeyboardInteractive returns an AuthMethod using a prompt/response
		sequence controlled by the server.

	 func Marshal(msg interface{}) []byte
		Marshal serializes the message in msg to SSH wire format.  The msg
		argument should be a struct or pointer to struct. If the first
		member has the "sshtype" tag set to a number in decimal, that
		number is prepended to the result. If the last of member has the
		"ssh" tag set to "rest", its contents are appended to the output.

	 func MarshalAuthorizedKey(key PublicKey) []byte
		MarshalAuthorizedKey serializes key for inclusion in an OpenSSH
		authorized_keys file. The return value ends with newline.

	 func MarshalPrivateKey(key crypto.PrivateKey, comment string) (*pem.Block, error)
		MarshalPrivateKey returns a PEM block with the private key serialized in the
		OpenSSH format.

	 func MarshalPrivateKeyWithPassphrase(key crypto.PrivateKey, comment string, passphrase []byte) (*pem.Block, error)
		MarshalPrivateKeyWithPassphrase returns a PEM block holding the encrypted
		private key serialized in the OpenSSH format.

	 func NewCertSigner(cert *Certificate, signer Signer) (Signer, error)
		NewCertSigner returns a Signer that signs with the given Certificate, whose
		private key is held by signer. It returns an error if the public key in cert
		doesn't match the key used by signer.

	 func NewClient(c Conn, chans <-chan NewChannel, reqs <-chan *Request) *Client
		NewClient creates a Client on top of the given connection.

	 func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan NewChannel, <-chan *Request, error)
		NewClientConn establishes an authenticated SSH connection using c
		as the underlying transport.  The Request and NewChannel channels
		must be serviced or the connection will hang.

	 func NewPublicKey(key interface{}) (PublicKey, error)
		NewPublicKey takes an *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey,
		or ed25519.PublicKey returns a corresponding PublicKey instance.
		ECDSA keys must use P-256, P-384 or P-521.

	 func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewChannel, <-chan *Request, error)
		NewServerConn starts a new SSH server with c as the underlying
		transport.  It starts with a handshake and, if the handshake is
		unsuccessful, it closes the connection and returns an error.  The
		Request and NewChannel channels must be serviced, or the connection
		will hang.
		
		The returned error may be of type *ServerAuthError for
		authentication errors.

	 func NewSignerFromKey(key interface{}) (Signer, error)
		NewSignerFromKey takes an *rsa.PrivateKey, *dsa.PrivateKey,
		*ecdsa.PrivateKey or any other crypto.Signer and returns a
		corresponding Signer instance. ECDSA keys must use P-256, P-384 or
		P-521. DSA keys must use parameter size L1024N160.

	 func NewSignerFromSigner(signer crypto.Signer) (Signer, error)
		NewSignerFromSigner takes any crypto.Signer implementation and
		returns a corresponding Signer interface. This can be used, for
		example, with keys kept in hardware modules.

	 func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (MultiAlgorithmSigner, error)
		NewSignerWithAlgorithms returns a signer restricted to the specified
		algorithms. The algorithms must be set in preference order. The list must not
		be empty, and it must not include certificate types. An error is returned if
		the specified algorithms are incompatible with the public key type.

	 func ParseAuthorizedKey(in []byte) (out PublicKey, comment string, options []string, rest []byte, err error)
		ParseAuthorizedKey parses a public key from an authorized_keys
		file used in OpenSSH according to the sshd(8) manual page.

	 func ParseDSAPrivateKey(der []byte) (*dsa.PrivateKey, error)
		ParseDSAPrivateKey returns a DSA private key from its ASN.1 DER encoding, as
		specified by the OpenSSL DSA man page.

	 func ParseKnownHosts(in []byte) (marker string, hosts []string, pubKey PublicKey, comment string, rest []byte, err error)
		ParseKnownHosts parses an entry in the format of the known_hosts file.
		
		The known_hosts format is documented in the sshd(8) manual page. This
		function will parse a single entry from in. On successful return, marker
		will contain the optional marker value (i.e. "cert-authority" or "revoked")
		or else be empty, hosts will contain the hosts that this entry matches,
		pubKey will contain the public key and comment will contain any trailing
		comment at the end of the line. See the sshd(8) manual page for the various
		forms that a host string can take.
		
		The unparsed remainder of the input will be returned in rest. This function
		can be called repeatedly to parse multiple entries.
		
		If no entries were found in the input then err will be io.EOF. Otherwise a
		non-nil err value indicates a parse error.

	 func ParsePrivateKey(pemBytes []byte) (Signer, error)
		ParsePrivateKey returns a Signer from a PEM encoded private key. It supports
		the same keys as ParseRawPrivateKey. If the private key is encrypted, it
		will return a PassphraseMissingError.

	 func ParsePrivateKeyWithPassphrase(pemBytes, passphrase []byte) (Signer, error)
		ParsePrivateKeyWithPassphrase returns a Signer from a PEM encoded private
		key and passphrase. It supports the same keys as
		ParseRawPrivateKeyWithPassphrase.

	 func ParsePublicKey(in []byte) (out PublicKey, err error)
		ParsePublicKey parses an SSH public key formatted for use in
		the SSH wire protocol according to RFC 4253, section 6.6.

	 func ParseRawPrivateKey(pemBytes []byte) (interface{}, error)
		ParseRawPrivateKey returns a private key from a PEM encoded private key. It supports
		RSA, DSA, ECDSA, and Ed25519 private keys in PKCS#1, PKCS#8, OpenSSL, and OpenSSH
		formats. If the private key is encrypted, it will return a PassphraseMissingError.

	 func ParseRawPrivateKeyWithPassphrase(pemBytes, passphrase []byte) (interface{}, error)
		ParseRawPrivateKeyWithPassphrase returns a private key decrypted with
		passphrase from a PEM encoded private key. If the passphrase is wrong, it
		will return x509.IncorrectPasswordError.

	 func Password(secret string) AuthMethod
		Password returns an AuthMethod using the given password.

	 func PasswordCallback(prompt func() (secret string, err error)) AuthMethod
		PasswordCallback returns an AuthMethod that uses a callback for
		fetching a password.

	 func PublicKeys(signers ...Signer) AuthMethod
		PublicKeys returns an AuthMethod that uses the given key
		pairs.

	 func PublicKeysCallback(getSigners func() (signers []Signer, err error)) AuthMethod
		PublicKeysCallback returns an AuthMethod that runs the given
		function to obtain a list of key pairs.

	 func RetryableAuthMethod(auth AuthMethod, maxTries int) AuthMethod
		RetryableAuthMethod is a decorator for other auth methods enabling them to
		be retried up to maxTries before considering that AuthMethod itself failed.
		If maxTries is <= 0, will retry indefinitely
		
		This is useful for interactive clients using challenge/response type
		authentication (e.g. Keyboard-Interactive, Password, etc) where the user
		could mistype their response resulting in the server issuing a
		SSH_MSG_USERAUTH_FAILURE (rfc4252 #8 [password] and rfc4256 #3.4
		[keyboard-interactive]); Without this decorator, the non-retryable
		AuthMethod would be removed from future consideration, and never tried again
		(and so the user would never be able to retry their entry).

	 func Unmarshal(data []byte, out interface{}) error
		Unmarshal parses data in SSH wire format into a structure. The out
		argument should be a pointer to struct. If the first member of the
		struct has the "sshtype" tag set to a '|'-separated set of numbers
		in decimal, the packet must start with one of those numbers. In
		case of error, Unmarshal returns a ParseError or
		UnexpectedMessageError.


Package-Level Variables (only one)

	  var ErrNoAuth error
		ErrNoAuth is the error value returned if no
		authentication method has been passed yet. This happens as a normal
		part of the authentication loop, since the client first tries
		'none' authentication to discover available methods.
		It is returned in ServerAuthError.Errors from NewServerConn.


Package-Level Constants (total 102)

	const CertAlgoDSAv01 = "ssh-dss-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoECDSA256v01 = "ecdsa-sha2-nistp256-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoECDSA384v01 = "ecdsa-sha2-nistp384-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoECDSA521v01 = "ecdsa-sha2-nistp521-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoED25519v01 = "ssh-ed25519-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoRSASHA256v01 = "rsa-sha2-256-cert-v01@openssh.com"
		CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a
		Certificate.Type (or PublicKey.Type), but only in
		ClientConfig.HostKeyAlgorithms.

	const CertAlgoRSASHA512v01 = "rsa-sha2-512-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoRSAv01 = "ssh-rsa-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoSKECDSA256v01 = "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertAlgoSKED25519v01 = "sk-ssh-ed25519-cert-v01@openssh.com"
		Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
		in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
		Unlike key algorithm names, these are not passed to AlgorithmSigner nor
		returned by MultiAlgorithmSigner and don't appear in the Signature.Format
		field.

	const CertSigAlgoRSASHA2256v01 = "rsa-sha2-256-cert-v01@openssh.com"
		Deprecated: use CertAlgoRSASHA256v01.

	const CertSigAlgoRSASHA2512v01 = "rsa-sha2-512-cert-v01@openssh.com"
		Deprecated: use CertAlgoRSASHA512v01.

	const CertSigAlgoRSAv01 = "ssh-rsa-cert-v01@openssh.com"
		Deprecated: use CertAlgoRSAv01.

	const CertTimeInfinity = 18446744073709551615
		CertTimeInfinity can be used for OpenSSHCertV01.ValidBefore to indicate that
		a certificate does not expire.

	const ConnectionFailed RejectionReason = 2
	const CS7 = 90
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const CS8 = 91
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHO = 53
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHOCTL = 60
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHOE = 54
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHOK = 55
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHOKE = 61
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ECHONL = 56
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const HostCert = 2
		Certificate types distinguish between host and user
		certificates. The values can be set in the CertType field of
		Certificate.

	const ICANON = 51
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ICRNL = 36
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IEXTEN = 59
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IGNCR = 35
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IGNPAR = 30
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IMAXBEL = 41
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const INLCR = 34
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const INPCK = 32
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ISIG = 50
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ISTRIP = 33
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IUCLC = 37
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IUTF8 = 42 // RFC 8160
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IXANY = 39
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IXOFF = 40
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const IXON = 38
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const KeyAlgoDSA = "ssh-dss"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoECDSA256 = "ecdsa-sha2-nistp256"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoECDSA384 = "ecdsa-sha2-nistp384"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoECDSA521 = "ecdsa-sha2-nistp521"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoED25519 = "ssh-ed25519"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoRSA = "ssh-rsa"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoRSASHA256 = "rsa-sha2-256"
		KeyAlgoRSASHA256 and KeyAlgoRSASHA512 are only public key algorithms, not
		public key formats, so they can't appear as a PublicKey.Type. The
		corresponding PublicKey.Type is KeyAlgoRSA. See RFC 8332, Section 2.

	const KeyAlgoRSASHA512 = "rsa-sha2-512"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoSKECDSA256 = "sk-ecdsa-sha2-nistp256@openssh.com"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const KeyAlgoSKED25519 = "sk-ssh-ed25519@openssh.com"
		Public key algorithms names. These values can appear in PublicKey.Type,
		ClientConfig.HostKeyAlgorithms, Signature.Format, or as AlgorithmSigner
		arguments.

	const NOFLSH = 57
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const OCRNL = 73
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const OLCUC = 71
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ONLCR = 72
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ONLRET = 75
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const ONOCR = 74
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const OPOST = 70
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const PARENB = 92
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const PARMRK = 31
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const PARODD = 93
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const PENDIN = 62
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const Prohibited RejectionReason = 1
	const ResourceShortage RejectionReason = 4
	const SIGABRT Signal = "ABRT"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SigAlgoRSA = "ssh-rsa"
		Deprecated: use KeyAlgoRSA.

	const SigAlgoRSASHA2256 = "rsa-sha2-256"
		Deprecated: use KeyAlgoRSASHA256.

	const SigAlgoRSASHA2512 = "rsa-sha2-512"
		Deprecated: use KeyAlgoRSASHA512.

	const SIGALRM Signal = "ALRM"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGFPE Signal = "FPE"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGHUP Signal = "HUP"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGILL Signal = "ILL"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGINT Signal = "INT"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGKILL Signal = "KILL"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGPIPE Signal = "PIPE"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGQUIT Signal = "QUIT"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGSEGV Signal = "SEGV"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGTERM Signal = "TERM"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGUSR1 Signal = "USR1"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const SIGUSR2 Signal = "USR2"
		POSIX signals as listed in RFC 4254 Section 6.10.

	const TOSTOP = 58
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const TTY_OP_ISPEED = 128
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const TTY_OP_OSPEED = 129
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const UnknownChannelType RejectionReason = 3
	const UserCert = 1
		Certificate types distinguish between host and user
		certificates. The values can be set in the CertType field of
		Certificate.

	const VDISCARD = 18
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VDSUSP = 11
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VEOF = 5
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VEOL = 6
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VEOL2 = 7
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VERASE = 3
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VFLUSH = 15
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VINTR = 1
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VKILL = 4
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VLNEXT = 14
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VQUIT = 2
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VREPRINT = 12
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VSTART = 8
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VSTATUS = 17
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VSTOP = 9
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VSUSP = 10
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VSWTCH = 16
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const VWERASE = 13
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

	const XCASE = 52
		POSIX terminal mode flags as listed in RFC 4254 Section 8.

The pages are generated with Golds v0.6.7. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.