Networking and SSH

Networking and SSH

XAIOS provides a native IPv4/IPv6 stack, TCP, UDP, DNS, an SSH/SFTP server, and bounded outbound SSH/SCP clients. The server is implemented in XAIOS userspace; it is not a forwarded host sshd.

Connect to QEMU

The default QEMU launcher maps 127.0.0.1:7788 to guest TCP port 22:

ssh -p 7788 admin@127.0.0.1
sftp -P 7788 admin@127.0.0.1

Images do not contain a default password. Provision public keys for routine access. Password authentication requires an explicitly generated PBKDF2 user database and development-image opt-in; release builds reject it.

Supported server behavior

• Ed25519 public-key authentication and optional development password auth.
• Persistent host identity, host-key rotation, revocation, and fail-closed RNG.
• Concurrent SSH connections and multiple channels on one transport.
• PTY shells, one-command execution, terminal resize, rekey, and reconnect.
• SFTP v3 read, write, positional I/O, stat, list, mkdir, rename, remove, and rmdir with per-process descriptor ownership.
• Stateful per-session cwd, prompt, command status, and terminal applications.
• Connection, channel, command-rate, and resource bounds with explicit errors.

Network behavior

The QEMU-tested stack includes IPv4/IPv6 fragment reassembly and source fragmentation, TCP handshake/data retransmission, out-of-order receive, duplicate-ACK/SACK handling, UDP delivery semantics, asynchronous DNS A-record resolution, socket ownership, cancellation, and cleanup. Runtime-sized CPU/queue metadata avoids a fixed small-core limit.

Outbound clients

From an XAIOS shell:

ssh [-p PORT] user@host [command]
scp [-r] [-P PORT] SOURCE DESTINATION

The clients support password authentication, Ed25519 host signatures, persistent trust-on-first-use host-key checking, IPv4 literals, and DNS A records. They do not yet support client public keys, IPv6 active open, forwarding, agents, jump hosts, or hybrid post-quantum key exchange.

Interoperability evidence

Automated suites exercise XAIOS from macOS OpenSSH, Debian 13 OpenSSH, and an official FreeBSD 15.1 VM. They cover valid/invalid authentication, four simultaneous sessions, reconnects, PTY applications, SFTP lifecycle and isolation, SCP, UDP, IPv6/TCP, malformed traffic, rekey, reboot persistence, and concurrent clients against one guest. The raw Ethernet gates additionally send maximum-size fragmented UDP requests and independently reassemble XAIOS IPv4 and IPv6 replies on AArch64 and x86_64 QEMU.

This is protocol correctness evidence under QEMU, not approval for direct Internet exposure. See Security Model, Testing XAIOS, and Current Limitations.