eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stream SSH proxy over Iroh

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:03:38 +02:00
commit 87d8801d71
7 changed files with 366 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/architecture.md
View file

@ -216,10 +216,14 @@ listener after the same endpoint/card and capability checks. `geth pipe recv
checking `pipe.listen` on the same resource. Long-lived stdin/stdout streams and
TCP/Unix forwarding are still future work.
`geth-ssh-proxy` currently defines proxy target and connection metadata. The
daemon can authorize a remote proxy attempt over the protected Iroh control ALPN
with `ssh_proxy.connect` on `resource:ssh-proxy:local`, but it does not yet
forward bytes or connect to sshd/admin shell.
`geth-ssh-proxy` defines proxy target and connection metadata. `geth ssh proxy
<node>` is a streaming command intended for OpenSSH `ProxyCommand`: the CLI
streams stdin/stdout through the local daemon, the local daemon dials the remote
daemon with `/geth/ssh-proxy/1`, the remote daemon validates the signed peer card
against the observed Iroh EndpointID, reduces `ssh_proxy.connect` on
`resource:ssh-proxy:local`, and only then connects the Iroh stream to
`127.0.0.1:22`. OpenSSH still performs its normal login authentication over the
resulting byte stream. SSH is not used as a geth transport backend.
`geth-ssh-identity` defines SSH trust namespaces plus certificate request,
approval, certificate import, and revocation-list data models. The bootstrap

11
docs/roadmap.md
View file

@ -386,15 +386,16 @@ Goal: add authorized stream-oriented management workflows over Iroh.
- `[~]` SSH proxy over Iroh.
Acceptance criteria:
- `[x]` `geth ssh proxy <node>` contacts an imported peer over the protected
Iroh control ALPN.
- `[x]` `geth ssh proxy <node>` contacts an imported peer over the dedicated
`/geth/ssh-proxy/1` Iroh ALPN.
- `[x]` Remote daemon checks `ssh_proxy.connect` on
`resource:ssh-proxy:local` before returning proxy connection metadata.
- `[x]` Tests cover denied and granted SSH proxy control-plane attempts.
- `[x]` Knowing an EndpointID alone cannot reach sshd.
- `[ ]` Future completion opens a dedicated authorized Iroh byte stream.
- `[ ]` Remote daemon connects that stream to local sshd or a restricted
built-in geth admin shell only after authorization.
- `[x]` The proxy opens a dedicated authorized Iroh byte stream.
- `[x]` Remote daemon connects that stream to local sshd at `127.0.0.1:22`
only after authorization.
- `[ ]` Future completion adds a restricted built-in geth admin shell option.
- `[~]` SSH certificate and revocation distribution.
Acceptance criteria: