Skip to content

Replace the custom patched OpenSSH server with an own implementation based on, e.g., russh #30

@nbars

Description

@nbars

A custom, self-built SSH server would considerably reduce complexity and maintenance overhead compared to a patched version of OpenSSH. In particular, we could drop the current implementation of remote port forwarding that relies on a SOCKS5 proxy running inside each container, accessible by the OpenSSH server through a Unix domain socket.

In particular, this would require implementing the following components (using, e.g., the russh rust crate):

  • SSH Entry Server: This server accepts connections and performs authentication based on a list of public keys provided by the web server. If authentication succeeds, the web server is queried for details regarding the actual instance (SSH server running inside a Docker container) that belongs to the authenticated public key.
    SSH Entry Client: Based on this information, a connection to the instance's SSH server must be established, and everything must be transparently forwarded through this connection. Thus, besides implementing an SSH server, we also need to implement an SSH client that forwards SSH channels and port-forwarding requests sent to the SSH Entry Server to the actual target. This can probably be considered an SSH reverse proxy.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions