25 lines
957 B
Markdown
25 lines
957 B
Markdown
# ADR 0009: SSH Trust And SSH Proxy
|
|
|
|
## Status
|
|
|
|
Accepted.
|
|
|
|
## Decision
|
|
|
|
SSH keys are admin signing identities and ecosystem integration points. SSH is
|
|
not a geth transport. Future SSH proxy support will carry SSH protocol bytes over
|
|
authorized Iroh streams, and OpenSSH will still perform normal login auth.
|
|
|
|
Geth also manages OpenSSH certificate request, renewal, approval, import, and
|
|
revocation-list metadata. Signing is explicit: an approved request yields a
|
|
concrete `ssh-keygen -s ...` command that can be run on the machine holding the
|
|
CA key or attached YubiKey.
|
|
|
|
## Consequences
|
|
|
|
Knowing an Iroh EndpointID is insufficient to reach sshd. Geth authorization must
|
|
allow `ssh_proxy.connect` before any SSH/admin endpoint is opened.
|
|
|
|
Certificate and key revocations are durable geth metadata and should be
|
|
distributed over Iroh between authorized nodes. Discovery does not grant trust in
|
|
certificate requests, issued certificates, or revocation lists.
|