eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add SSH proxy authorization probe

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:51:11 +02:00
commit e145bb47cd
11 changed files with 333 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/architecture.md
View file

@ -72,9 +72,13 @@ binding is unavailable, the daemon keeps local control running and reports the
Iroh startup error through status output.
SSH keys are not transport keys. They are admin trust anchors and signing
identities for keychain and authorization operations. SSH proxying, when added,
will carry SSH bytes over an authorized Iroh stream and will not make SSH a geth
transport backend.
identities for keychain and authorization operations. The bootstrap `geth ssh
proxy <node-id>` command performs an authorized Iroh control-plane handshake:
the remote daemon validates the caller's signed peer card against the observed
Iroh EndpointID and requires `ssh_proxy.connect` on
`resource:ssh-proxy:local`. It returns connection metadata only. Carrying SSH
bytes over an Iroh stream and connecting to remote sshd or a restricted admin
shell remain future work, and will not make SSH a geth transport backend.
SSH certificate flows use the same split. Nodes can request new OpenSSH
certificates or renewals through geth metadata. A machine with the CA key or
@ -192,7 +196,10 @@ before recording the connection attempt and reporting whether a listener exists.
This is still a control-plane scaffold for names and connection attempts only;
it does not carry bytes or forward sockets yet.
`geth-ssh-proxy` currently defines types, command shape, and roadmap stubs.
`geth-ssh-proxy` currently defines proxy target and connection metadata. The
daemon can authorize a remote proxy attempt over the protected Iroh control ALPN
with `ssh_proxy.connect` on `resource:ssh-proxy:local`, but it does not yet
forward bytes or connect to sshd/admin shell.
`geth-ssh-identity` defines SSH trust namespaces plus certificate request,
approval, certificate import, and revocation-list data models. The bootstrap