Loading…
Topic
SSH
5 posts about SSH. Every summary links to the original.
- 5 posts
- 3 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux
Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known_hosts entries, and physical testing are recommended before relying on remote recovery.
VSCode’s SSH Agent Is Bananas
VSCode’s remote-editing flow over SSH is examined as a concern for running LLM-driven agent workflows on remote machines. The motivation is to keep iterative code generation and execution away from a development laptop, ideally on a clean-slate Linux instance that starts instantly and cannot damage the host. Unlike Emacs Tramp, which operates through commands on the remote connection, VSCode uses a Bash snippet stager to download an agent, including a binary Node installation. That agent communicates over port-forwarded SSH through a WebSockets connection to the VSCode front end and can browse the filesystem, edit arbitrary files, launch shell PTYs, and persist itself. The author says this raises concerns for development servers and especially production incident work, while noting a custom Fly Machine connection avoids needing this mechanism.
Our User-Mode WireGuard Year
Fly.io’s flyctl needed to let users SSH into Firecracker VMs and reach private 6PN networks without requiring root access or system-level WireGuard configuration. The solution runs wireguard-go, a userland TCP/IP stack derived from gVisor’s Go implementation, and golang.org/x/crypto/ssh inside flyctl, later coordinating sessions through a cross-platform background agent. The design initially exposed serious operational and usability problems: concurrent sessions displaced one another, agent behavior was fragile, and remote peer creation was slow, while deploys and remote builds expanded the mechanism’s role. The team improved concurrency, Windows support, DNS resolution, configuration handling, and peer-creation latency, and built an unmerged WebSocket path for networks blocking WireGuard’s UDP transport. The author concludes that the complexity was costly early in 2021 but enabled capabilities such as private DNS lookup and ping.
SSH and User-mode IP WireGuard
Fly.io’s SSH feature addresses the need to access applications running in Firecracker micro-VMs without requiring users to build containers with an SSH service or install WireGuard. The first part uses 6PN, a private IPv6-based network routed across Fly’s WireGuard mesh, and Hallpass, a small Go SSH server bound to each instance’s 6PN address. Authentication relies on an organization’s root SSH certificate published in private DNS, while the API signs short-lived user certificates. To support users without WireGuard installed, flyctl combines wireguard-go’s userland protocol with gVisor’s user-mode TCP/IP stack, allowing ordinary Go networking code and DNS resolution to operate over the private network. The resulting certificate-based SSH path is built into flyctl and reaches internal DNS names such as dogmatic-potato-342.internal, although the user-mode implementation is substantially slower than kernel TCP/IP.
Managing Google Cloud Platform Project-Wide SSH Keys
Google Cloud project-wide SSH keys can remain in project metadata indefinitely after a user connects to a VM, potentially allowing matching private-key holders to access Linux VMs with root access unless project-wide keys are blocked. Shopify developed SSH-Pruner because OS Login did not work with Google Kubernetes Engine, while deleting all keys also removed Google’s keys, disrupted scripts, and created slow metadata updates. The new Go application uses Google Cloud APIs to find organization projects with Compute Engine enabled, reads the “ssh-keys” metadata, parses entries, retains unexpired keys, writes pruned common instance metadata, and records readable logs; Google-managed “sshKeys” entries are skipped. SSH-Pruner was already running as a cron job on some projects, with a slow rollout planned to limit workflow disruption.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.