Skip to main content

honey ssh-server

honey ssh-server​

Start the inbound SSH gateway (certificate-authenticated shell/exec proxy to inventory hosts)

Synopsis​

Runs an inbound SSH server. Native ssh clients authenticate with an SSH certificate signed by a configured trusted CA; the certificate maps to a honey actor, the first ssh command argument selects an inventory host, and the session is proxied to that host — recorded, policy-gated, and audited.

Examples: ssh -t -i alice-cert.pub alice@127.0.0.1 -p 12222 <resource> # interactive shell ssh alice@127.0.0.1 -p 12222 <resource> uptime # ad-hoc command echo "select 1" | ssh alice@127.0.0.1 -p 12222 <resource> psql # stdin pipe

honey ssh-server [flags]

Options​

      --cert-attr string          Certificate field used as the actor: principal or key_id (default "principal")
  -h, --help                      help for ssh-server
      --host-key string           Directory to load/create the gateway SSH host key (default: state dir)
      --listen string             Listen address (host:port) (default "localhost:12222")
      --no-auth                   Disable certificate authentication (dev only; accepts any client)
      --search-backends string    Comma-separated backend names to search when resolving a resource (default: all)
      --search-providers string   Comma-separated providers to search when resolving a resource (default: all; e.g. gcp,consul)
      --trusted-ca stringArray    Path to a trusted CA public key file (repeatable)
      --user-attr string          Identity attribute label recorded for audit (default "principal")

Options inherited from parent commands​

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default &lt;directory of config.yaml&gt;/records
      --refresh              Ignore cached entries and refresh (host discovery)

SEE ALSO​

  • honey - DevOps tool to help find an instance in sea of clouds