wmantly
36e9d5b0b3
An SSH jump host that authenticates users against the shared LDAP directory, authorizes them from the SSO Manager's inventory graph, and bridges them to downstream hosts — auditing everything. - Username-grammar routing (uid_-_target@jump) + interactive TUI picker - Inbound LDAP auth (publickey / password with off|local|all policy) - Directory-driven access (LDAP groups x /api/discovery/resources?group=) - Per-user key injection into sshPublicKey, connects downstream as the user - Shell / exec / SFTP-subsystem bridging (WinSCP works) - Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated - Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose - Tests: 23 unit + 3 integration (node --test), all green Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
22 lines
611 B
Desktop File
22 lines
611 B
Desktop File
[Unit]
|
|
Description=Theta42 SSH jump host
|
|
After=network.target redis-server.service
|
|
Wants=redis-server.service
|
|
StartLimitIntervalSec=0
|
|
|
|
[Service]
|
|
Type=simple
|
|
Restart=always
|
|
RestartSec=1
|
|
User=root
|
|
WorkingDirectory=/opt/theta42/jump-host/nodejs
|
|
Environment="NODE_ENV=production"
|
|
Environment="CONF_SECRETS=/etc/jump-host/secrets.js"
|
|
ExecStart=/usr/bin/env node /opt/theta42/jump-host/nodejs/bin/www
|
|
# The default listen port is 2222 (no privilege needed). To run on 22, set
|
|
# ssh.listenPort in secrets.js AND uncomment the next line:
|
|
# AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|