# ADR 0009: SSH Trust And SSH Proxy

## Status

Accepted.

## Decision

SSH keys are admin signing identities and ecosystem integration points. SSH is
not a geth transport. SSH proxy support carries SSH protocol bytes over
authorized Iroh streams, and OpenSSH still performs normal login auth. The
restricted geth admin shell is a separate built-in command set over protected
Iroh control requests; it does not execute host shell commands.

Geth also manages OpenSSH certificate request, renewal, approval, import, and
revocation-list metadata. Signing is explicit: an approved request yields a
concrete `ssh-keygen -s ...` command that can be run on the machine holding the
CA key or attached YubiKey.

## Consequences

Knowing an Iroh EndpointID is insufficient to reach sshd. Geth authorization must
allow `ssh_proxy.connect` before any SSH/admin endpoint is opened.

Certificate and key revocations are durable geth metadata and should be
distributed over Iroh between authorized nodes. Discovery does not grant trust in
certificate requests, issued certificates, or revocation lists.