Go to file

Overlord 610571fc70 Harden forced ssh flags: accept-new host keys, block multiplexing, tighten identity auth

BatchMode=yes already blocked TTY prompts, but a brand-new host with no
known_hosts entry failed outright on first connect since ssh had no way
to ask for acceptance. Add StrictHostKeyChecking=accept-new (TOFU, still
hard-fails on a changed known host) plus LogLevel=ERROR to keep the
resulting "permanently added" notice out of profile logs.

Also force ControlMaster=no/ControlPath=none and ClearAllForwardings=yes
so a user's own ~/.ssh/config can't make porthole's spawned ssh share a
multiplexed connection or apply extra forwards - the supervisor's
process-based tracking assumes one spawned ssh exclusively owns one
tunnel. ServerAliveCountMax=3 makes dead-connection detection time
deterministic against the profile's keepalive, and -T is explicit
no-pty insurance alongside the existing -N. IdentitiesOnly=yes is added
whenever a profile sets an identity file, avoiding auth-failure lockouts
from also offering agent/default keys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-13 22:42:02 +02:00

spec

Show real mapping grammar in --help, make --via repeatable, trim comments

2026-08-13 17:18:33 +02:00

src

Harden forced ssh flags: accept-new host keys, block multiplexing, tighten identity auth

2026-08-13 22:42:02 +02:00

.gitignore

Fix --via/-J grammar and --force process-group kill in spec

2026-08-13 15:43:36 +02:00

Cargo.lock

Show real mapping grammar in --help, make --via repeatable, trim comments