1.1 KiB
ADR 0009: SSH Trust And SSH Proxy
Status
Accepted.
Decision
SSH keys are admin signing identities and ecosystem integration points. SSH is not a geth transport. SSH proxy support carries SSH protocol bytes over authorized Iroh streams, and OpenSSH still performs normal login auth. The restricted geth admin shell is a separate built-in command set over protected Iroh control requests; it does not execute host shell commands.
Geth also manages OpenSSH certificate request, renewal, approval, import, and
revocation-list metadata. Signing is explicit: an approved request yields a
concrete ssh-keygen -s ... command that can be run on the machine holding the
CA key or attached YubiKey.
Consequences
Knowing an Iroh EndpointID is insufficient to reach sshd. Geth authorization must
allow ssh_proxy.connect before any SSH/admin endpoint is opened.
Certificate and key revocations are durable geth metadata and should be distributed over Iroh between authorized nodes. Discovery does not grant trust in certificate requests, issued certificates, or revocation lists.