优化部署

src/rtr/server/ssh.rs

@@ -9,6 +9,32 @@ use russh::keys::ssh_key::{self, AuthorizedKeys};
 use russh::server::Config as RusshServerConfig;
 use russh::{MethodKind, MethodSet};
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SshAuthMode {
+    Key,
+    Password,
+    Both,
+}
+
+impl SshAuthMode {
+    pub fn parse(value: &str) -> Option<Self> {
+        match value.trim().to_ascii_lowercase().as_str() {
+            "key" | "publickey" => Some(Self::Key),
+            "password" => Some(Self::Password),
+            "both" => Some(Self::Both),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Key => "key",
+            Self::Password => "password",
+            Self::Both => "both",
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct RtrSshRuntimeConfig {
     pub server_config: Arc<RusshServerConfig>,
@@ -23,6 +49,7 @@ pub fn load_rtr_ssh_runtime_config(
     authorized_keys_path: impl AsRef<Path>,
     username: &str,
     subsystem_name: &str,
+    auth_mode: SshAuthMode,
     password: Option<&str>,
     inactivity_timeout: Option<Duration>,
     keepalive_interval: Option<Duration>,
@@ -35,12 +62,21 @@ pub fn load_rtr_ssh_runtime_config(
     }
 
     let host_key = load_host_key(host_key_path.as_ref())?;
-    let authorized_keys = load_authorized_keys(authorized_keys_path.as_ref())?;
+    let authorized_keys = if matches!(auth_mode, SshAuthMode::Key | SshAuthMode::Both) {
+        load_authorized_keys(authorized_keys_path.as_ref())?
+    } else {
+        Vec::new()
+    };
     let password = password.map(str::trim).filter(|value| !value.is_empty());
+    if matches!(auth_mode, SshAuthMode::Password | SshAuthMode::Both) && password.is_none() {
+        bail!("SSH auth mode '{}' requires non-empty password", auth_mode.as_str());
+    }
 
     let mut methods = MethodSet::empty();
-    methods.push(MethodKind::PublicKey);
-    if password.is_some() {
+    if matches!(auth_mode, SshAuthMode::Key | SshAuthMode::Both) {
+        methods.push(MethodKind::PublicKey);
+    }
+    if matches!(auth_mode, SshAuthMode::Password | SshAuthMode::Both) {
         methods.push(MethodKind::Password);
     }