1 files changed, 52 insertions, 18 deletions
diff --git a/internal/ssh/server/hostkey.go b/internal/ssh/server/hostkey.go
index b2d4569..1315351 100644
--- a/internal/ssh/server/hostkey.go
+++ b/internal/ssh/server/hostkey.go
@@ -1,41 +1,75 @@
 package server
 
 import (
-	"os"
+	"errors"
+	iofs "io/fs"
 
 	"github.com/mimecast/dtail/internal/config"
 	"github.com/mimecast/dtail/internal/io/dlog"
+	"github.com/mimecast/dtail/internal/io/fs"
 	"github.com/mimecast/dtail/internal/ssh"
 )
 
+const (
+	defaultHostKeyBits = 4096
+	defaultHostKeyFile = "./cache/ssh_host_key"
+)
+
 // PrivateHostKey retrieves the private server RSA host key.
-func PrivateHostKey() []byte {
-	hostKeyFile := config.Server.HostKeyFile
+func PrivateHostKey(hostKeyFile string, hostKeyBits int) []byte {
+	if hostKeyFile == "" {
+		hostKeyFile = defaultHostKeyFile
+	}
+	if hostKeyBits <= 0 {
+		hostKeyBits = defaultHostKeyBits
+	}
 	if config.Env("DTAIL_INTEGRATION_TEST_RUN_MODE") {
 		hostKeyFile = "./ssh_host_key"
 	}
-	_, err := os.Stat(hostKeyFile)
-
-	if os.IsNotExist(err) {
-		dlog.Server.Info("Generating private server RSA host key")
-		privateKey, err := ssh.GeneratePrivateRSAKey(config.Server.HostKeyBits)
-
-		if err != nil {
-			dlog.Server.FatalPanic("Failed to generate private server RSA host key", err)
-		}
+	hostKeyPath, err := fs.NewRootedPath(hostKeyFile)
+	if err != nil {
+		dlog.Server.FatalPanic("Invalid private server RSA host key path", hostKeyFile, err)
+	}
 
-		pem := ssh.EncodePrivateKeyToPEM(privateKey)
-		if err := os.WriteFile(hostKeyFile, pem, 0600); err != nil {
-			dlog.Server.Error("Unable to write private server RSA host key to file",
-				hostKeyFile, err)
+	_, err = hostKeyPath.Stat()
+	if err != nil {
+		// os.IsNotExist does not unwrap fmt.Errorf chains from RootedPath.Stat; use errors.Is.
+		if errors.Is(err, iofs.ErrNotExist) {
+			dlog.Server.Info("Generating private server RSA host key")
+			pem, genErr := generatePrivateHostKey(hostKeyBits)
+			if genErr != nil {
+				dlog.Server.FatalPanic("Failed to generate private server RSA host key", genErr)
+			}
+			if storeErr := storePrivateHostKey(hostKeyPath, pem); storeErr != nil {
+				dlog.Server.Error("Unable to write private server RSA host key to file",
+					hostKeyFile, storeErr)
+			}
+			return pem
 		}
-		return pem
+		dlog.Server.FatalPanic("Cannot stat private server RSA host key path", hostKeyFile, err)
 	}
 
 	dlog.Server.Info("Reading private server RSA host key from file", hostKeyFile)
-	pem, err := os.ReadFile(hostKeyFile)
+	pem, err := readPrivateHostKey(hostKeyPath)
 	if err != nil {
 		dlog.Server.FatalPanic("Failed to load private server RSA host key", err)
 	}
 	return pem
 }
+
+func generatePrivateHostKey(hostKeyBits int) ([]byte, error) {
+	privateKey, err := ssh.GeneratePrivateRSAKey(hostKeyBits)
+	if err != nil {
+		return nil, err
+	}
+
+	return ssh.EncodePrivateKeyToPEM(privateKey), nil
+}
+
+func storePrivateHostKey(hostKeyPath fs.RootedPath, pem []byte) error {
+	return hostKeyPath.WriteFile(pem, 0o600)
+}
+
+func readPrivateHostKey(hostKeyPath fs.RootedPath) ([]byte, error) {
+	return hostKeyPath.ReadFile()
+}