phirumseng/knetrahub-pam-ssh-gateway repository overview

⁠phirumseng/knetrahub-pam-ssh-gateway

Brokered SSH — the target credential never reaches the browser.

KNetraHub is a self-hosted IT operations portal: a Docker Swarm console, full-stack monitoring, work management, privileged access management, IP address management and a database workspace, behind one sign-in. This image is one of its sidecars — a job the portal deliberately does not do inside its own process.

📖 Documentation: https://sengphirum.github.io/KNetraHub/documentation⁠

⁠What this image does

Terminates browser SSH sessions against a managed target and records them, so an operator can reach a host without ever holding that host's credential.

⁠How it works

The browser opens a WebSocket to the portal, which relays it here. This service then fetches the credential from the PAM control plane SERVER-SIDE and opens the SSH connection itself, streaming the session back over that relay. Host keys are checked against a managed known-hosts file and an unknown key is refused unless trust-on-first-use is switched on. On SIGTERM it stops accepting sessions and drains the live ones before exiting.

⁠What it deliberately does not do

No credential is ever sent to the client. It mounts no Docker socket, writes nothing to its own root filesystem and runs distroless, non-root, with every capability dropped.

⁠Deploying it

Part of a stack, not a standalone container. Deploy it with the stack file that owns it:

docker stack deploy -c docker/docker-compose.pam.yml knetrahub

⁠Supported tags

• latest — the most recent release
• x.y.z (e.g. 0.1.11) — immutable release versions

Keep this image on the same version as the rest of the stack.

⁠The rest of the stack

• phirumseng/knetrahub-app⁠ — Monolith (app)
• phirumseng/knetrahub-ui⁠ — UI
• phirumseng/knetrahub-core-api⁠ — Core API
• phirumseng/knetrahub-docker-api⁠ — Docker API
• phirumseng/knetrahub-docker-worker⁠ — Docker worker
• phirumseng/knetrahub-monitoring-api⁠ — Monitoring API
• phirumseng/knetrahub-monitoring-worker⁠ — Monitoring worker
• phirumseng/knetrahub-work-api⁠ — Work API
• phirumseng/knetrahub-work-worker⁠ — Work worker
• phirumseng/knetrahub-pam-api⁠ — Privileged Access API
• phirumseng/knetrahub-pam-worker⁠ — Privileged Access worker
• phirumseng/knetrahub-ipmgt-api⁠ — IP Management API
• phirumseng/knetrahub-ipmgt-worker⁠ — IP Management worker
• phirumseng/knetrahub-dbmanager-api⁠ — Database Manager API
• phirumseng/knetrahub-agent⁠ — node agent
• phirumseng/knetrahub-pam-ssh-gateway — PAM SSH gateway ← this image
• phirumseng/knetrahub-pam-connector-runner⁠ — PAM connector runner
• phirumseng/knetrahub-dbmanager-gateway⁠ — DB Manager gateway

⁠License

Proprietary — © Seng Phirum. All rights reserved.