OpenSSH without an agent

Airlock can proxy SSH to existing OpenSSH (sshd) servers without installing the airlock binary on the node. Servers accept dynamically issued certificates from the Airlock CA.

This is a quick way to connect legacy systems. Going forward, replacing sshd with airlock is recommended for full RBAC support, session recording without connection interruption, session sharing, and enhanced recording capabilities.

The Proxy Service verifies the user’s roles, authenticates to the OpenSSH node using an Airlock CA certificate, and maintains the audit trail.

Prerequisites

• OpenSSH 6.9+ on the client machine: ssh -V
• A Linux host running sshd 7.4+, without Airlock; the SSH port open to the Proxy Service
• airctl and airsh on the administrative machine

Step 1. Node resource in the cluster

Create openssh-node-resource.yaml:

kind: node
version: v2
sub_kind: openssh
metadata:
  name: a100fdd0-52db-4eca-a7ab-c3afa7a1564a
  labels:
    env: prod
spec:
  addr: 1.2.3.4:22
  hostname: openssh-node

• spec.addr — SSH IP and port
• spec.hostname — name shown to users in Airlock
• metadata.name — UUID (uuidgen)

airctl create -f openssh-node-resource.yaml

Step 2. Trust the Airlock CA in sshd

On the host running sshd (replace airlock.example.com):

export KEY=$(curl 'https://airlock.example.com/webapi/auth/export?type=openssh' | sed "s/cert-authority\ //")
sudo bash -c "echo \"$KEY\" > /etc/ssh/airlock_openssh_ca.pub"
sudo bash -c "echo 'TrustedUserCAKeys /etc/ssh/airlock_openssh_ca.pub' >> /etc/ssh/sshd_config"
sudo systemctl restart sshd

Step 3. Host certificate

Create a role for issuing host certificates (host-certifier.yaml):

kind: role
version: v5
metadata:
  name: host-certifier
spec:
  allow:
    rules:
      - resources: [host_cert]
        verbs: [list, create, read, update, delete]

airctl create -f host-certifier.yaml

Assign the role to your user via airctl users update.

Get the node UUID:

airctl get node/openssh-node --format=json | jq -r ".[0].metadata.name"

Issue a host certificate:

ADDR=1.2.3.4,openssh-node,a100fdd0-52db-4eca-a7ab-c3afa7a1564a
airctl auth sign --host=${ADDR} --format=openssh --out=myhost

Copy myhost and myhost-cert.pub to the server under /etc/ssh with permissions 0600, and add to sshd_config:

HostKey /etc/ssh/myhost
HostCertificate /etc/ssh/myhost-cert.pub

sudo systemctl restart sshd

Step 4. SSH client configuration

Log in to the cluster:

airsh login --proxy=airlock.example.com --user=myuser
airsh config > ssh_config_airlock

Step 5. Connect

USER=ubuntu
CLUSTER=airlock.example.com
PORT=22
ADDR_NODE=openssh-node
ssh -p ${PORT} -F ssh_config_airlock "${USER}@${ADDR_NODE}.${CLUSTER}"

Port 22 is specified explicitly: an OpenSSH node has no reverse tunnel on port 3022; the Proxy Service connects directly to spec.addr.

Next steps

For new servers, an SSH node with an agent is preferred.