2026-05-15 15:08:20 +02:00
|
|
|
# ADR 0009: SSH Trust And SSH Proxy
|
|
|
|
|
|
|
|
|
|
## Status
|
|
|
|
|
|
|
|
|
|
Accepted.
|
|
|
|
|
|
|
|
|
|
## Decision
|
|
|
|
|
|
|
|
|
|
SSH keys are admin signing identities and ecosystem integration points. SSH is
|
2026-05-21 01:49:48 +02:00
|
|
|
not a geth transport. SSH proxy support carries SSH protocol bytes over
|
|
|
|
|
authorized Iroh streams, and OpenSSH still performs normal login auth. The
|
|
|
|
|
restricted geth admin shell is a separate built-in command set over protected
|
|
|
|
|
Iroh control requests; it does not execute host shell commands.
|
2026-05-15 15:08:20 +02:00
|
|
|
|
2026-05-16 00:17:08 +02:00
|
|
|
Geth also manages OpenSSH certificate request, renewal, approval, import, and
|
|
|
|
|
revocation-list metadata. Signing is explicit: an approved request yields a
|
|
|
|
|
concrete `ssh-keygen -s ...` command that can be run on the machine holding the
|
|
|
|
|
CA key or attached YubiKey.
|
|
|
|
|
|
2026-05-15 15:08:20 +02:00
|
|
|
## Consequences
|
|
|
|
|
|
|
|
|
|
Knowing an Iroh EndpointID is insufficient to reach sshd. Geth authorization must
|
|
|
|
|
allow `ssh_proxy.connect` before any SSH/admin endpoint is opened.
|
2026-05-16 00:17:08 +02:00
|
|
|
|
|
|
|
|
Certificate and key revocations are durable geth metadata and should be
|
|
|
|
|
distributed over Iroh between authorized nodes. Discovery does not grant trust in
|
|
|
|
|
certificate requests, issued certificates, or revocation lists.
|
