You always know
which machine
you're on.

security

The parts that have to be right.

A review pass went through the security-relevant surface reading the library source, not assumptions about it. Most of what got checked was already fine. What wasn’t is below, and every one of these got a test that fails without its fix first, which is the only reason to believe any of it.

Algorithms

The allowlist is x/crypto’s SupportedAlgorithms, not its wider defaults. No ssh-rsa over SHA-1, no ssh-dss, no hmac-sha1-96, no diffie-hellman-group14-sha1.

There is a deny-list test, so the day upstream widens its defaults again, the build fails instead of the client quietly getting looser.

Host keys

Checked on first contact and at every hop of a jump chain. A key that changed stops the connection. A key that is new asks once, and doing nothing counts as no.

A man in the middle picks from whatever the client offers, which is why the allowlist above is the thing stopping a weak host key from getting pinned into your known_hosts through this app. OpenSSH would then honour it too.

The handshake

A watchdog closes the connection if it stalls. Not a read deadline: a jumped hop’s connection doesn’t support one, so a deadline would have worked for direct dials and silently done nothing for the jumped ones.

Before it, a peer that finished TCP and went quiet held a goroutine open with no way to reclaim it. The test hangs until the binary’s panic timeout without the fix.

Port forwards

Loopback, unless you say otherwise. It’s what OpenSSH means by GatewayPorts no. You get told the address that was actually bound, not the one you typed.

The prompt only appears when the address really is a wildcard, so the safe answer is the default and saying no still leaves you a working tunnel.

Files written

Keys created O_EXCL 0600. Host and identity stores rewritten atomically at 0600. Downloads created 0600, then chmod’d on the descriptor, because the mode argument only applies to a file that didn’t already exist.

os.Create opens 0666. Everything this app writes for you is something you would not leave at 0644.

Remote output

Capped at 4 MB, and the reader stops reading until the screen drains. Not reading is what applies backpressure across the SSH window.

Measured at 205 MB buffered in half a second before the cap. A hostile host could exhaust the client from a single cat.

Two-factor prompts

One prompt per keyboard-interactive round. An echo-off prompt is not proof that something wants your password; PAM asks for a TOTP code exactly the same way.

The test asserts on what the server saw, and before the fix it saw the password twice: once in the code field.

Deletes

Lstat first, so a recursive remove unlinks a symlink instead of walking through it. The library’s own RemoveAll resolves the path first, and a link to /etc emptied /etc.

Links in output

A hyperlink from a remote host gets parsed with URL, allowed only if it’s http or https, and handed to your browser. Nothing from the far side can navigate the webview holding the bridge.

Passphrases

Used once, to derive a signer. The signer is cached. The passphrase is kept nowhere and written nowhere.

Nothing in the negotiation, bind or write path is weaker than OpenSSH’s default, and every security claim in the documentation is one the code actually makes. Three of the findings above were the documentation being wrong, which is its own kind of bug.