Repository navigation
feat(tenant): one SSH port for all tenants through sshpiper (#80) - #81
Merged
Merged
Conversation
modules.tenant.sshpiper installs a pinned, SHA-256-checked sshpiperd with the yaml and failtoban plugins as rootfiles-sshpiper.service. Each tenant user gets the route <tenant>.<user>: a key pipe checked against the user's authorized_keys synced from the container, then logged in with a host-only upstream key, and a password pipe passed to the tenant's sshd. Upstream host keys are verified from the stored tenant keys. tenant sync now runs every 2 minutes without the global lock, refreshes keys and routes, and container reads are bounded in size and time. Closes #80 Claude-Session: https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ebfbb82640
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #80.
What it adds
modules.tenant.sshpiper(enabled,portdefault 2222,address,versiondefault v1.6.1): download into/usr/local/lib/rootfiles/sshpiper/<version>, SHA-256 checked against values pinned in the code,rootfiles-sshpiper.servicerunningyaml -- failtoban, host-only upstream key, refusal when another process holds the port, removal when disabled/etc/rootfiles/sshpiper/tenants/<t>.yaml(0600): per user a key pipe (sshpiper checks the syncedauthorized_keys, then logs in with the upstream key) and a password pipe without any key (the tenant's sshd checks the password and enforces the expired-password change); upstream host keys verified viaknown_hostsbuilt from the stored tenant keyspiper.pub, init.sh trusts the upstream key throughAuthorizedKeysFiletenant sync: every 2 minutes, root-only, no global lock (anapplycan no longer make the timer fail); syncs hashes, keys and routestimeout+head -c) for shadow, passwd, group and authorized_keys, so a tenant-controlled file cannot stall a sync or importtenant status/createprint the routed commandVerification
tenant-scenario(real Docker + systemd + sshpiper): routed password login, wrong password / unknown route / other tenant's user refused, temporary password change forced through the shared port, key added inside the container logs in after sync and an unlisted key is refused, disabling removes service and routesCloses #80
🤖 Generated with Claude Code
https://claude.ai/code/session_0177Zk7to4EYohgM59v4Fcj7