Linux SSH node

A server is protected by running the SSH Service on it and registering it in the Airlock cluster. RBAC controls access, and the audit log records activity.

The SSH Service opens a reverse SSH tunnel to the Proxy Service; client traffic flows through this tunnel — similar to a bastion host pattern.

Prerequisites

• A Linux host (Ubuntu 20.04, CentOS 8, Debian 10, etc.) — the future Airlock node.
• A running Airlock cluster and airctl on the administrative machine.
• Port 22 temporarily open for initial configuration.

Step 1 of 4. Install Airlock on the server

On the target host:

curl https://deckhouse.ru/downloads/airlock/install.sh | bash -s

Step 2 of 4. Add the server to the cluster

Create a join token

On your workstation, save the token to a file:

airctl tokens add --type=node --format=text > token.file

Enroll the server

Copy token.file to the server in a secure directory and generate the configuration (replace airlock.example.com):

sudo airlock node configure \
  --output=file:///etc/airlock.yaml \
  --token=/path/to/token.file \
  --proxy=airlock.example.com:443

Start the SSH Service:

sudo systemctl enable airlock
sudo systemctl start airlock
sudo systemctl status airlock

Create a user for the web interface

airctl users add myuser --roles=editor,access,reviewer --logins=root,ubuntu

Follow the link in the command output, set a password and MFA. The server will appear in the web interface under the Servers tab.

Step 3 of 4. SSH to the server

Log in to the cluster

airsh login --proxy=airlock.example.com --user=myuser

Example profile:

Profile URL:      https://airlock.example.com:443
Logged in as:     myuser
Cluster:          airlock.example.com
Roles:            access, editor, reviewer
Logins:           root, ubuntu

List nodes

airsh ls

Node Name        Address        Labels
---------------- -------------- --------------------------------------
bastion-host     ⟵ Tunnel
web-server       127.0.0.1:3022 env=prod, hostname=web-server

Connect

airsh ssh root@web-server

Equivalent using standard ssh:

airsh config > ssh_config_airlock
ssh -F ssh_config_airlock root@web-server.airlock.example.com

All commands are recorded in the audit log.

Step 4 of 4. Review cluster resources

airctl nodes ls

Filter by label:

airsh ls env=prod

Run a command on all nodes with a label:

airsh ssh root@env=prod ls

Hardening (optional)

After configuration, close port 22 on the server — access remains available via airsh ssh. Port 22 on the Proxy Service host can also be closed.