The SSH proxy backend

The SSH proxy backend does not launch containers, instead it connects to a second SSH server and forwards the connections to that backend. This allows for using the audit log to inspect SSH traffic, or to dynamically forwarding connections using the configuration webhook.

The base configuration structure¶

The minimum configuration is the following:

backend: sshproxy
sshproxy:
  # Add the backend server here
  server: 127.0.0.1
  # Set the following option to true to reuse the connecting user's username.
  usernamePassThrough: true
  # Or specify a username manually
  username: root
  # Specify the password
  password: changeme
  # Or the private key. This can reference a file or be added directly.
  privateKey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
  # Provide all fingerprints of the backing SSH server's host keys:
  allowedHostKeyFingerprints:
    - SHA256:...

Tip

You can obtain the fingerprints of OpenSSH host keys by running the following script:

for i in /etc/ssh/ssh_host_*.pub; do ssh-keygen -l -f $i; done | cut -d ' ' -f 2

Warning

ContainerSSH does not support passing through passwords or public key authentication to the backing server. We recommend setting up private-public key authentication with the backing server.

Configuration options¶

Option	Type	Description
`server`	`string`	Host name or IP address of the backing SSH server. Required.
`port`	`uint16`	Port number of the backing SSH service. Defaults to 22.
`usernamePassThrough`	`bool`	Take username from the connecting client.
`username`	`string`	Explicitly set the username to use for the backing connection. Required if `usernamePassThrough` is `false`.
`password`	`string`	Password to use to authenticate with the backing SSH server.
`privateKey`	`string`	Private key to use to authenticate with the backing SSH server. Can be a reference to a file or the private key in PEM or OpenSSH format.
`allowedHostKeyFingerprints`	`[]string`	List of SHA256 fingerprints of the backing SSH server.
`ciphers`	`[]string`	List of SSH ciphers to use. See Ciphers below.
`kex`	`[]string`	List of key exchange algorithms to use. See Key exchange algorithms below.
`macs`	`[]string`	List of MAC algorithms to use. See MAC algorithms below.
`hostKeyAlgorithms`	`[]string`	List of host key algorithms to request from the backing server. See Host key algorithms below.
`timeout`	`string`	Timeout for connecting / retrying the SSH connection.
`clientVersion`	`string`	Client version string to send to the backing server. Must be in the format of `SSH-protoversion-softwareversion SPACE comments`. See RFC 4235 section 4.2. Protocol Version Exchange for details. The trailing CR and LF characters should not be added to this string.

Ciphers¶

ContainerSSH supports the following ciphers for contacting the backing server. The defaults are configured based on Mozilla Modern suite.

Algorithm	Default
chacha20-poly1305@openssh.com
aes256-gcm@openssh.com
aes128-gcm@openssh.com
aes256-ctr
aes192-ctr
aes128-ctr
aes128-cbc
arcfour256
arcfour128
arcfour
tripledescbcID

Key exchange algorithms¶

ContainerSSH supports the following key exchange algorithms for contacting the backing server. The defaults are configured based on Mozilla Modern suite.

Algorithm	Default
curve25519-sha256@libssh.org
ecdh-sha2-nistp521
ecdh-sha2-nistp384
ecdh-sha2-nistp256
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

MAC algorithms¶

ContainerSSH supports the following MAC algorithms for contacting the backing server. The defaults are configured based on Mozilla Modern suite.

Algorithm	Default
hmac-sha2-256-etm@openssh.com
hmac-sha2-256
hmac-sha1
hmac-sha1-96

Host key algorithms¶

ContainerSSH supports the following host key algorithms for verifying the backing server identity.

Algorithm	Default
ssh-rsa-cert-v01@openssh.com
ssh-dss-cert-v01@openssh.com
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521-cert-v01@openssh.com
ssh-ed25519-cert-v01@openssh.com
ssh-rsa
ssh-dss
ssh-ed25519