FarSSH 1.0.0: harden image/IAM and move to a v1 image tag - #2
Merged
Conversation
Ed25519 is the only host key now. The host private key still goes to the task as an environment override; the README caveat records that this is visible via the ECS API and only useful with an active MITM of the one SSH handshake. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Append PasswordAuthentication no so sshd does not offer password auth even if Alpine defaults change. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
The default task role no longer has the SSM managed policy. --execute-command enables Exec and overrides the task role to FarSshExecTaskRole; the flag is applied after SSM so a parameter cannot turn Exec on. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
--execute-command on a stack that has not been updated still enables Exec and uses the existing task role, which already has the SSM policy. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Only public_subnets, security_group, ssh_port, force_public_ipv4, and exec_task_role_arn are copied from Parameter Store. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
CloudFormation now uses :v0 so one-shot stacks pick up rebuilt images (including sshd patches) on the next task. CI publishes :v0 alongside the version tag, weekly plus workflow_dispatch. Dependabot watches the Dockerfile. The S3 template no longer substitutes a frozen version. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Existing stacks that pull :latest should still receive rebuilt images. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Dependabot already watches github-actions (security updates only) and will refresh these pins. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
publish-pypi.yaml builds the client package and uploads via OIDC when a v* tag is pushed. No environment, matching the PyPI publisher setup. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
The entrypoint only supports FARSSH_SSH_HOST_ED25519_KEY_BASE64 now that RSA host keys are gone. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Replace AmazonECSTaskExecutionRolePolicy with logs on
/ecs/farssh/${suffix} only. Trust policies require aws:SourceArn on
cluster/farssh as well as SourceAccount.
Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
apk add --no-cache so the image does not keep the package index. hatchling is pinned to >=1.24,<1.32 because 1.32 rejects a readme path outside the project directory (this package uses ../README.md). Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
hatchling 1.32 rejects a readme path outside the project directory, so the PEP 517 backend copies ../README.md into client/ before delegating to hatchling. That lets the hatchling pin stay at >=1.24,<2. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Both services have dual-stack endpoints now. Fargate in a dual-stack subnet still uses IPv4 for registry and awslogs calls, with no task-definition switch, so Docker Hub and disabling awslogs remain the no-public-IPv4 path. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
The compatible image line is :v1 (weekly sshd rebuilds). CloudFormation AllowedValues are only the v1 ECR Public and Docker Hub URIs. Co-authored-by: apparentorder-bot <apparentorder-bot@users.noreply.github.com>
cursor
Bot
changed the title
apparentorder-bot
marked this pull request as ready for review
September 3, 2026 21:22
apparentorder
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Harden the FarSSH image, IAM, and client packaging after the security review of
v0.6.1. Version 1.0.0; the moving image tag is:v1.Image and SSH
RunTaskoverride (only useful with an active MITM of that handshake).PasswordAuthentication noapk add --no-cache opensshprintf | base64 -dinstead ofevalIAM and ECS Exec
FarSshTaskRole;FarSshExecTaskRoleholds the SSM policy and is used only with--execute-commandsetattrallowlist:public_subnets,security_group,ssh_port,force_public_ipv4,exec_task_role_arn/ecs/farssh/${suffix}:*only (noAmazonECSTaskExecutionRolePolicy)SourceAccountplusArnLikearn:…:ecs:region:account:*(a cluster ARN is not supported by ECS assume-role)Image tags and CI
public.ecr.aws/apparentorder/farssh:v1(moving tag for patched sshd). AllowedValues are the v1 ECR Public and Docker Hub URIs only.$VERSION,:v1, and:latestv*tagsPackaging
README.mdintoclient/in a thin PEP 517 backend so hatchling 1.32+ is happy, then pinhatchling>=1.24,<2instead of<1.32.