eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add SSH proxy authorization probe

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 15:51:11 +02:00
commit e145bb47cd
11 changed files with 333 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/roadmap.md
View file

@ -344,12 +344,17 @@ Goal: add authorized stream-oriented management workflows over Iroh.
- Unsupported platforms return clear errors.
- Tests skip or use cfg guards where sockets are unavailable.
- `[ ]` SSH proxy over Iroh.
- `[~]` SSH proxy over Iroh.
Acceptance criteria:
- `geth ssh proxy <node>` opens an authorized Iroh stream.
- Remote daemon checks `ssh_proxy.connect` before connecting to local sshd or
admin shell.
- Knowing an EndpointID alone cannot reach sshd.
- `[x]` `geth ssh proxy <node>` contacts an imported peer over the protected
Iroh control ALPN.
- `[x]` Remote daemon checks `ssh_proxy.connect` on
`resource:ssh-proxy:local` before returning proxy connection metadata.
- `[x]` Tests cover denied and granted SSH proxy control-plane attempts.
- `[x]` Knowing an EndpointID alone cannot reach sshd.
- `[ ]` Future completion opens a dedicated authorized Iroh byte stream.
- `[ ]` Remote daemon connects that stream to local sshd or a restricted
built-in geth admin shell only after authorization.
- `[~]` SSH certificate and revocation distribution.
Acceptance criteria: