-
Notifications
You must be signed in to change notification settings - Fork 1
Open
Labels
enhancementNew feature or requestNew feature or request
Milestone
Description
A custom, self-built SSH server would considerably reduce complexity and maintenance overhead compared to a patched version of OpenSSH. In particular, we could drop the current implementation of remote port forwarding that relies on a SOCKS5 proxy running inside each container, accessible by the OpenSSH server through a Unix domain socket.
In particular, this would require implementing the following components (using, e.g., the russh rust crate):
- SSH Entry Server: This server accepts connections and performs authentication based on a list of public keys provided by the
webserver. If authentication succeeds, thewebserver is queried for details regarding the actual instance (SSH server running inside a Docker container) that belongs to the authenticated public key.
SSH Entry Client: Based on this information, a connection to the instance's SSH server must be established, and everything must be transparently forwarded through this connection. Thus, besides implementing an SSH server, we also need to implement an SSH client that forwards SSH channels and port-forwarding requests sent to theSSH Entry Serverto the actual target. This can probably be considered an SSH reverse proxy.
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request