20 lines
1.1 KiB
Markdown
20 lines
1.1 KiB
Markdown
# SSH sources
|
|
|
|
SSH sources require a dedicated account confined by an OpenSSH `ChrootDirectory`
|
|
and `ForceCommand internal-sftp`. The chroot directory is root-owned; writable
|
|
content is below it. Disable passwords, keyboard-interactive authentication,
|
|
shells, PTYs, TCP/X11/agent forwarding, and tunnelling. Configure the source
|
|
root as `/` only.
|
|
|
|
Generate a dedicated unencrypted Ed25519, ECDSA, or RSA-3072+ client key and
|
|
store it through the write-only `ssh_private_key` secret endpoint. Do not put a
|
|
key, passphrase, password, command, agent path, or key file path in source
|
|
configuration. Pin the server's exact OpenSSH public host key (`algorithm
|
|
base64`) before probing. On host-key rotation, obtain the replacement through
|
|
an out-of-band administrative channel, update the source pin, then probe.
|
|
|
|
The server administrator controls mutable content inside the chroot. The client
|
|
rejects traversal names, symlinks, special files, changed files, and configured
|
|
resource-limit overflows, but cannot claim atomic no-follow behavior against a
|
|
maliciously changing filesystem inside that server-controlled boundary.
|