Networking and SSH

Networking and SSH

XAIOS provides a native IPv4/IPv6 stack, TCP, UDP, DNS, an SSH/SFTP server, and bounded outbound SSH/SCP clients. The server is implemented in XAIOS userspace; it is not a forwarded host sshd.

Connect to QEMU

The default QEMU launcher maps 127.0.0.1:7788 to guest TCP port 22:

ssh -p 7788 admin@127.0.0.1
sftp -P 7788 admin@127.0.0.1

Images do not contain a default password. Provision public keys for routine access. Password authentication requires an explicitly generated PBKDF2 user database and development-image opt-in; release builds reject it.

Supported server behavior

• Ed25519 public-key authentication and optional development password auth.
• Persistent host identity, host-key rotation, revocation, and fail-closed RNG.
• Concurrent SSH connections and multiple channels on one transport.
• PTY shells, one-command execution, terminal resize, rekey, and reconnect.
• Hybrid mlkem768x25519-sha256 key exchange with classical fallback.
• direct-tcpip forwarding for OpenSSH jump-host use and agent forwarding.
• SFTP v3 read, write, positional I/O, stat, list, mkdir, rename, remove, and rmdir with per-process descriptor ownership.
• Stateful per-session cwd, prompt, command status, and terminal applications.
• Connection, channel, command-rate, and resource bounds with explicit errors.

Network behavior

The QEMU-tested stack includes IPv4/IPv6 fragment reassembly and source fragmentation, TCP handshake/data retransmission, out-of-order receive, duplicate-ACK/SACK handling, UDP delivery semantics, asynchronous DNS A/AAAA resolution, bounded TTL caching, DNS-over-TCP fallback, socket ownership, cancellation, and cleanup. Resolver answers must carry authenticated-data status from the configured validating resolver. Runtime-sized CPU/queue metadata avoids a fixed small-core limit.

Outbound clients

From an XAIOS shell:

ssh [-A] [-i KEY] [-p PORT] user@host [command]
scp [-r] [-A] [-i KEY] [-P PORT] SOURCE DESTINATION

The dedicated /bin/ssh process supports password, Ed25519 identity-file and forwarded-agent authentication, including passphrase-protected OpenSSH private keys. It verifies Ed25519 host signatures with persistent trust-on-first-use records and connects through IPv4/IPv6 literals or DNS A/AAAA results. Recursive SCP is SFTP-backed. XAIOS does not implement the complete OpenSSH option and algorithm matrix, including a native outbound -J/ProxyCommand parser.

Interoperability evidence

Automated suites exercise XAIOS from macOS OpenSSH, Debian 13 OpenSSH, and an official FreeBSD 15.1 VM. They cover valid/invalid authentication, four simultaneous sessions, reconnects, PTY applications, SFTP lifecycle and isolation, SCP, UDP, IPv6/TCP, malformed traffic, rekey, reboot persistence, and concurrent clients against one guest. The raw Ethernet gates additionally send maximum-size fragmented UDP requests and independently reassemble XAIOS IPv4 and IPv6 replies on AArch64 and x86_64 QEMU.

make qemu-network-adversarial-gate adds sanitizer-backed coverage-guided SSH/SFTP/DNS parser campaigns, packet loss/reordering/corruption cases, connection and channel exhaustion with recovery, concurrent macOS/Debian load, and 20 fresh boots on each of ARM64 and x86_64. This remains emulated correctness evidence rather than physical deployment qualification.

This is protocol correctness evidence under QEMU, not approval for direct Internet exposure. See Security Model, Testing XAIOS, and Current Limitations.