Ethica/Termix
1
0
Fork 0
mirror of https://github.com/Termix-SSH/Termix.git synced 2026-08-29 18:31:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Step CA SSH certificates as a host authentication type (#1340)

Browse Source 
* feat: Step CA SSH certificates as a host authentication type

Issue short-lived SSH user certificates from a smallstep CA through its
OIDC provisioner, over the CA's HTTP API rather than the step binary.
Everything after issuance reuses the OPKSSH plumbing: the same encrypted
per-user/host token store, WebSocket dialog and ssh2 certificate
injection, with the connect paths branching on a shared
usesIssuedCertificate() predicate. Instance-wide CA settings live in the
admin panel, with a private-host allowlist for the SSRF guard.

* fix: harden Step CA callback flow

* style: format Step CA changes
This commit is contained in:
ZacharyZcR
2026-08-25 02:56:44 +08:00
committed by GitHub
parent 0ab7cf2ab8
commit 32d77fc6d0
38 changed files with 1791 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/readme/README-CN.md
+5 -3
View File
@@ -351,9 +351,11 @@ networks:
```
部署多个 Termix 后端实例时，请为所有实例配置相同的 `REDIS_URL`，并可选配置
`TERMIX_REDIS_PREFIX`。Redis 会同步协作房间的在线成员、控制请求、控制权和事件；
实时 SSH 与远程桌面传输仍依附于创建连接的后端实例，因此负载均衡器需要保持
WebSocket 会话亲和性。单实例部署无需 Redis。
`TERMIX_REDIS_PREFIX`。Redis 会同步协作房间的在线成员、控制请求、控制权和事件，
也会把 Step CA OAuth 回调路由回持有用户终端的实例；可通过
`TERMIX_STEP_CA_REDIS_PREFIX` 隔离这些短期加密消息。实时 SSH 与远程桌面传输仍
依附于创建连接的后端实例，因此负载均衡器需要保持 WebSocket 会话亲和性。
单实例部署无需 Redis。
### 命令行工具