1.1 KiB
SSH sources
SSH sources require a dedicated account confined by an OpenSSH ChrootDirectory
and ForceCommand internal-sftp. The chroot directory is root-owned; writable
content is below it. Disable passwords, keyboard-interactive authentication,
shells, PTYs, TCP/X11/agent forwarding, and tunnelling. Configure the source
root as / only.
Generate a dedicated unencrypted Ed25519, ECDSA, or RSA-3072+ client key and
store it through the write-only ssh_private_key secret endpoint. Do not put a
key, passphrase, password, command, agent path, or key file path in source
configuration. Pin the server's exact OpenSSH public host key (algorithm base64) before probing. On host-key rotation, obtain the replacement through
an out-of-band administrative channel, update the source pin, then probe.
The server administrator controls mutable content inside the chroot. The client rejects traversal names, symlinks, special files, changed files, and configured resource-limit overflows, but cannot claim atomic no-follow behavior against a maliciously changing filesystem inside that server-controlled boundary.