modal-ssh-gateway

A serverless SSH gateway backed by Modal Functions and Modal Proxy.

Curl a web endpoint and get an ephemeral SSH jumpbox.

Features

• Full Autoscaling of HTTPS router and SSH tunnel containers.
• Scale to zero.
• Short-lived certificate generated for authorized keys.
• Audit trail stored in a Modal Volume.

Get started

1. Install Modal

pip install modal && modal setup

2. Create a Modal Proxy

Then set PROXY_NAME in config.py.

3. Create a CA

python3 src/create_ca.py

This creates a Modal secret with your CA keypair.

4. Whitelist your Modal Proxy IP and allow your CA cert on desired servers.

Run modal run src/print_details.py to see your CA's public key and your Modal proxy IP. Add TrustedUserCAKeys <pubkey file> to your server's sshd_config, and whitelist this IP in your firewall.

5. Add authorized keys and usernames in config.py.

Certificates will only be issued for the public keys in AUTHORIZED_KEYS. You should also set ALLOWED_USERNAMES to set the principals of the generated certificates.

6. Start using ssh-gateway

modal deploy src/gateway.py

This will give you the HTTPS endpoint for your very own autoscaling ssh-gateway.

URL="https://....modal.run"

# Open an interactive shell on the gateway:
./connect.sh $URL

# Or jump through the gateway to another host:
./connect.sh --jump modal@10.0.0.5 $URL

TODO

• No DDoS protection (just knowing an authorized key still spins up a container). Need to add a challenge to the gateway itself.
• Modal secret creation via command line is non ideal.
• Lackluster authentication, AUTHORIZED_KEYS not sufficient.
• Same CA used in VPC and on jumpbox.