eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add restricted SSH admin shell

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:49:48 +02:00
commit 59ccf6c748
9 changed files with 358 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/adr/0009-ssh-trust-and-ssh-proxy.md
View file

@ -7,8 +7,10 @@ Accepted.
## Decision
SSH keys are admin signing identities and ecosystem integration points. SSH is
not a geth transport. Future SSH proxy support will carry SSH protocol bytes over
authorized Iroh streams, and OpenSSH will still perform normal login auth.
not a geth transport. SSH proxy support carries SSH protocol bytes over
authorized Iroh streams, and OpenSSH still performs normal login auth. The
restricted geth admin shell is a separate built-in command set over protected
Iroh control requests; it does not execute host shell commands.
Geth also manages OpenSSH certificate request, renewal, approval, import, and
revocation-list metadata. Signing is explicit: an approved request yields a

8
docs/architecture.md
View file

@ -77,8 +77,12 @@ proxy <node-id>` command performs an authorized Iroh control-plane handshake:
the remote daemon validates the caller's signed peer card against the observed
Iroh EndpointID and requires `ssh_proxy.connect` on
`resource:ssh-proxy:local`. It returns connection metadata only. Carrying SSH
bytes over an Iroh stream and connecting to remote sshd or a restricted admin
shell remain future work, and will not make SSH a geth transport backend.
bytes over an Iroh stream is implemented on the dedicated `/geth/ssh-proxy/1`
ALPN and only connects to remote `127.0.0.1:22` after authorization.
`geth ssh admin-shell <node-id> <help|status|node-id>` is a separate restricted
geth admin workflow over the protected Iroh control path. It requires
`ssh_proxy.admin_shell` and executes only built-in geth commands, never host
shell commands. Neither path makes SSH a geth transport backend.
SSH certificate flows use the same split. Nodes can request new OpenSSH
certificates or renewals through geth metadata. A machine with the CA key or

4
docs/roadmap.md
View file

@ -406,7 +406,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
- `[ ]` Unsupported platforms return clear errors.
- `[x]` Tests cover a full two-node Unix socket forwarding exchange.
- `[~]` SSH proxy over Iroh.
- `[x]` SSH proxy over Iroh.
Acceptance criteria:
- `[x]` `geth ssh proxy <node>` contacts an imported peer over the dedicated
`/geth/ssh-proxy/1` Iroh ALPN.
@ -417,7 +417,7 @@ Goal: add authorized stream-oriented management workflows over Iroh.
- `[x]` The proxy opens a dedicated authorized Iroh byte stream.
- `[x]` Remote daemon connects that stream to local sshd at `127.0.0.1:22`
only after authorization.
- `[ ]` Future completion adds a restricted built-in geth admin shell option.
- `[x]` Future completion adds a restricted built-in geth admin shell option.
- `[~]` SSH certificate and revocation distribution.
Acceptance criteria: