wmantly
a917915037
Unifies the GitHub Pages docs site: the SSO/Proxy/Jump Host pages, their
nav labels, and each component's own README now consistently say Theta
Directory / Theta Proxy / Theta Gateway, drop marketing sections ("Why this
over the alternatives", "Get it", "Related projects") that don't apply to a
suite component, remove every standalone/bare-metal install path, and link
to theta42.github.io/theta-suite/... instead of the old per-repo Pages sites.
Bumps submodules: theta-directory v2.0.2, proxy v2.0.1, jump-host v2.0.1.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
92 lines
3.8 KiB
Markdown
92 lines
3.8 KiB
Markdown
---
|
||
layout: default
|
||
title: Home
|
||
description: Theta Gateway — an SSH jump host for theta-suite, giving directory-driven access to every downstream machine you're entitled to from one public host.
|
||
---
|
||
|
||
# Theta Gateway
|
||
|
||
The SSH jump host component of [theta-suite](../). Users SSH into **one**
|
||
public host and land on any downstream host they're entitled to —
|
||
authenticated against the shared LDAP directory, authorized from
|
||
[Theta Directory](../sso/)'s inventory graph, and audited end to end.
|
||
|
||
No per-host accounts, no distributing keys, no VPN. The same people who log in
|
||
to Theta Directory are the people who can reach your machines — and only the
|
||
machines their directory groups grant.
|
||
|
||
Theta Gateway is deployed as part of theta-suite, alongside
|
||
[Theta Directory](../sso/) and [Theta Proxy](../proxy/) — it isn't installed
|
||
or run on its own. See the [Quickstart](../quickstart.html) to stand up the
|
||
whole stack with one command.
|
||
|
||
## Screenshots
|
||
|
||
<a href="images/login.png" target="_blank"><img src="images/login.png" alt="Login" width="49%"></a>
|
||
<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
|
||
<a href="images/sessions.png" target="_blank"><img src="images/sessions.png" alt="Active sessions" width="49%"></a>
|
||
<a href="images/audit.png" target="_blank"><img src="images/audit.png" alt="Audit log" width="49%"></a>
|
||
|
||
*(click any screenshot to view full size)*
|
||
|
||
## Two ways to connect
|
||
|
||
**Direct (WinSCP/SFTP-friendly):**
|
||
|
||
```bash
|
||
ssh alice_-_web01@jump.example.com
|
||
sftp -P 2222 alice_-_web01@jump.example.com
|
||
```
|
||
|
||
The username grammar is `{uid}_-_{target}` — `target` is a directory host slug
|
||
(with or without the `host_` prefix), a bare hostname, or an IP. One username
|
||
string, no interactive step, so it works cleanly in WinSCP and scripts.
|
||
|
||
**Interactive picker:**
|
||
|
||
```bash
|
||
ssh alice@jump.example.com
|
||
```
|
||
|
||
A plain login shows a TUI list of the hosts you can reach; arrow-key or type to
|
||
filter, Enter to connect.
|
||
|
||
See **[Connecting](connecting.html)** for the full usage guide.
|
||
|
||
## Why a jump host (and why this one)
|
||
|
||
A bastion/jump host is the standard way to give SSH access to internal machines
|
||
through a single audited entry point. What's usually painful is *authorization*
|
||
and *credentials*: who may reach which host, and how the bastion authenticates
|
||
onward without you copying keys everywhere.
|
||
|
||
Theta Gateway answers both from your directory:
|
||
|
||
- **Authorization is your directory graph.** The hosts you can reach are the
|
||
union of your LDAP groups × Theta Directory's inventory (the
|
||
`host_<name>_access` groups the directory already auto-creates). Add
|
||
someone to a group; they can reach the host. No bastion-side allow-list to
|
||
maintain.
|
||
- **Onward auth is automatic.** Theta Gateway holds one key and injects its
|
||
public half into your `sshPublicKey` on first use, then connects downstream
|
||
**as you**. Downstream hosts already serve keys from LDAP (via
|
||
ldap-client's `AuthorizedKeysCommand`), so nothing downstream needs
|
||
configuring.
|
||
|
||
## Features
|
||
|
||
- **Username-grammar routing** (`uid_-_target`) — straight-through to the host,
|
||
SFTP included (WinSCP works)
|
||
- **Interactive TUI host picker** on plain login, scoped to your access
|
||
- **LDAP inbound auth** — public key or password (keys-only policy recommended
|
||
for a public host)
|
||
- **Directory-driven access** — reachable hosts come from the Theta Directory
|
||
inventory, not a static list
|
||
- **Per-user key injection** — no downstream changes, no key distribution
|
||
- **Shell, exec, and SFTP** bridging
|
||
- **WireGuard mesh routing** — cross-site network access alongside SSH
|
||
- **Web UI + HTTP API** for auditing and metrics — active sessions, a searchable
|
||
audit log, per-user/per-host counters
|
||
- **Full audit trail** — who, target, method, result, bytes, duration, and the
|
||
downstream host-key fingerprint
|