ssh: say why when there is no shell to run

The published container image has no shell, so a session used to end at once with
nothing printed for a command. It now explains that, and what to do about it,
and exits with status 127.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -14,6 +14,11 @@ BAMBOO_TOKEN=
 #BAMBOO_DISCOVER_PORTS=22,80,443,8000-8010
 #BAMBOO_DISCOVER_RATE=50
 
+# Run a built-in SSH server (public keys only). The keys that may sign in go in authorized_keys in the data folder.
+#BAMBOO_SSH=1
+#BAMBOO_SSH_LISTEN=127.0.0.1:2222
+#BAMBOO_SSH_KEYS=
+
 # Folder for this agent's WireGuard key.
 #BAMBOO_DATA=./bamboo-data
 

README.md

@@ -24,6 +24,9 @@ Bamboo only makes outbound connections (HTTPS to Hammerhead, and WireGuard UDP t
 | `-discover-subnets` | `BAMBOO_DISCOVER_SUBNETS` | also scan these private subnets, e.g. `192.168.1.0/24,10.0.0.0/24` (each at most a /22) |
 | `-discover-ports` | `BAMBOO_DISCOVER_PORTS` | ports to try when scanning, e.g. `22,80,443,8000-8010` (default: 19 common ones) |
 | `-discover-rate` | `BAMBOO_DISCOVER_RATE` | most connection attempts per second (default 50) |
+| `-ssh` | `BAMBOO_SSH=1` | run a small SSH server so this machine can be reached through a tunnelled port (Linux and macOS) |
+| `-ssh-listen` | `BAMBOO_SSH_LISTEN` | address it listens on (default `127.0.0.1:2222`) |
+| `-ssh-keys` | `BAMBOO_SSH_KEYS` | `authorized_keys` file listing who may sign in (default: `authorized_keys` in the data folder) |
 | `-env` | | `.env` file to read (default `./.env`) |
 
 Settings and secrets can live in a `.env` file instead of the command line; see `.env.example`. Real environment variables always win.
@@ -33,6 +36,7 @@ Settings and secrets can live in a `.env` file instead of the command line; see
 - **Tunnel:** one WireGuard peer per edge, through a userspace network stack (no root, no kernel interface, no driver; works on Windows, macOS and Linux). Its private key never leaves this machine. TCP connections and native UDP datagrams are accepted from the edge and handed to your services.
 - **Docker discovery:** with `-docker`, lists running containers (and their ports and networks) so you can pick one as a target in the dashboard.
 - **Service discovery:** off unless you ask for it. With `-discover`, lists the TCP services listening on this machine (read from `/proc/net/tcp`, so Linux only). With `-discover-subnets`, it also tries the chosen ports on every address of those subnets. Each hit is identified (SSH, SMTP, FTP, HTTP, HTTPS, or the usual service for that port) and reported to Hammerhead as a suggested target; nothing is exposed until you pick one. It is deliberately gentle: only private, loopback or link-local subnets of at most 1024 addresses are accepted, connection attempts are capped (50 per second by default), a sweep runs every 15 minutes, and a service that stays silent gets a single TLS handshake and then one `HEAD /` request, nothing more. At most 500 services are reported. Only scan networks you are allowed to scan.
+- **SSH server:** off unless you ask for it. With `-ssh`, Bamboo runs a small SSH server, so you can open a shell or run a command on this machine from anywhere through a tunnelled port, with no sshd to install. Put the public keys that may sign in in `authorized_keys` in the data folder (one per line, like OpenSSH; Bamboo will not start the server without at least one, and picks up edits without a restart). Then, in Hammerhead, add a TCP port whose target is this site at `127.0.0.1:2222`, and connect with `ssh -p <port> user@<edge address>`. The user name is ignored: sessions run as the user Bamboo runs as, so a Bamboo running as root gives a root shell, and the keys should be treated that way. Public keys only (no passwords), session channels only (no port forwarding, agent forwarding or SFTP), and it listens on the loopback address unless you change `-ssh-listen`. The host key is created in the data folder on first start and its fingerprint is written to the log, so you can check it the first time you connect. Hammerhead's dashboard terminal reaches this server through the agent itself: Bamboo reports where the server listens, and when someone opens a terminal it connects out to Hammerhead and joins that connection to the server, so no port has to be open anywhere. Add the public key Hammerhead shows (SSH button on the Sites page) to `authorized_keys` to allow it. Not available on Windows.
 - **Mail relay:** for a mail egress configured in the dashboard, opens a small SMTP relay on this machine (default `127.0.0.1:2525`). Point your mail server at it (Postfix: `relayhost = [127.0.0.1]:2525`) and each outgoing message leaves from the edge's public IP, so reverse DNS, SPF and your HELO name line up. Supports `AUTH PLAIN/LOGIN`, requires a password if it listens beyond `127.0.0.1`, relays one destination domain per transaction (extra domains get `452` so your server resends them separately), and passes your server's queue and retries through unchanged. 50 MB message limit.
 
 ## Deploying
@@ -42,10 +46,10 @@ Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea
 **On a Linux server (systemd)**
 
 ```
-curl -LO https://git.veillax.com/Veillax/bamboo/releases/download/v0.1.0/bamboo_v0.1.0_linux_amd64.tar.gz
+curl -LO https://git.veillax.com/Veillax/bamboo/releases/download/v0.1.6/bamboo_v0.1.6_linux_amd64.tar.gz
-curl -LO https://git.veillax.com/Veillax/bamboo/releases/download/v0.1.0/SHA256SUMS
+curl -LO https://git.veillax.com/Veillax/bamboo/releases/download/v0.1.6/SHA256SUMS
 sha256sum -c --ignore-missing SHA256SUMS
-tar xzf bamboo_v0.1.0_linux_amd64.tar.gz && cd bamboo_v0.1.0_linux_amd64
+tar xzf bamboo_v0.1.6_linux_amd64.tar.gz && cd bamboo_v0.1.6_linux_amd64
 sudo ./install.sh                 # installs the binary and a hardened systemd service
 sudoedit /etc/bamboo/bamboo.env   # your settings and secrets
 sudo systemctl start bamboo

bamboo.go

@@ -37,6 +37,7 @@ type Config struct {
 	DataDir    string          // holds this agent's WireGuard key
 	Docker     bool            // report local Docker containers so they can be picked as targets
 	Discover   discover.Config // opt-in: report listening services found on this host and configured subnets as suggested targets
+	SSH        string          // where this machine's SSH server listens ("" = not running); Hammerhead's terminal reaches it through the agent
 
 	// Version, AutoUpdate and UpdateNow work as in blacktip.Config.
 	Version    string
@@ -57,6 +58,7 @@ type Bamboo struct {
 	tun     *wg.Device
 	edges   []model.EdgeRef
 	lastRep string
+	terms   map[string]time.Time // terminal sessions already answered, by id
 
 	updating  atomic.Bool
 	updateMsg string // outcome of the update Hammerhead asked for, reported back
@@ -185,6 +187,7 @@ func (b *Bamboo) apply(cfg *model.SiteConfig) {
 	b.mu.Unlock()
 	b.syncPeers()
 	b.syncMail(cfg.MailEgress)
+	b.openTerminals(cfg.Terminals)
 	go b.report()
 }
 
@@ -284,6 +287,7 @@ func (b *Bamboo) report() {
 	msg, uid, stage, pct, ulog := b.updateMsg, b.updateID, b.updStage, b.updPct, append([]string(nil), b.updLog...)
 	b.mu.Unlock()
 	body, _ := json.Marshal(model.SiteReport{PublicKey: b.wgPub, Connected: ids, Containers: containers, Discovered: found, MailEgress: b.mailStatus(),
+		SSH: b.cfg.SSH, SSHRelay: true,
 		Version: b.cfg.Version, AutoUpdate: b.cfg.AutoUpdate, UpdateMsg: msg, UpdateID: uid, UpdateStage: stage, UpdatePct: pct, UpdateLog: ulog})
 	req, _ := http.NewRequest("POST", b.cfg.Hammerhead+"/site/report", bytes.NewReader(body))
 	req.Header.Set("Authorization", "Bearer "+b.cfg.Token)

cmd/bamboo/main.go

@@ -7,11 +7,13 @@ import (
 	"log"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 
 	"git.veillax.com/Veillax/bamboo"
 	"git.veillax.com/Veillax/bamboo/discover"
+	"git.veillax.com/Veillax/bamboo/sshd"
 	"git.veillax.com/Veillax/reef/dotenv"
 	"git.veillax.com/Veillax/reef/selfupdate"
 )
@@ -47,6 +49,9 @@ func main() {
 	discoverSubnets := flag.String("discover-subnets", os.Getenv("BAMBOO_DISCOVER_SUBNETS"), "comma-separated private subnets to scan for services, e.g. 192.168.1.0/24 (at most /22 each; off by default)")
 	discoverPorts := flag.String("discover-ports", os.Getenv("BAMBOO_DISCOVER_PORTS"), "TCP ports to try on scanned addresses, e.g. 22,80,443,8000-8010 (default: a short list of common ones)")
 	discoverRate := flag.Float64("discover-rate", envFloat("BAMBOO_DISCOVER_RATE", discover.DefaultRate), "most connection attempts per second discovery may make")
+	sshOn := flag.Bool("ssh", os.Getenv("BAMBOO_SSH") == "1", "run a built-in SSH server (public keys only) so this machine can be reached through a tunnelled port")
+	sshListen := flag.String("ssh-listen", env("BAMBOO_SSH_LISTEN", sshd.DefaultListen), "address the SSH server listens on; point a Hammerhead port at it from this site")
+	sshKeys := flag.String("ssh-keys", os.Getenv("BAMBOO_SSH_KEYS"), "authorized_keys file listing who may sign in (default: authorized_keys in the data folder)")
 	flag.String("env", ".env", "file to read secrets and settings from")
 	autoUpdate := flag.Bool("auto-update", os.Getenv("BAMBOO_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
@@ -74,7 +79,28 @@ func main() {
 	if dc.Ports, err = discover.ParsePorts(*discoverPorts); err != nil {
 		log.Fatalf("-discover-ports: %v", err)
 	}
-	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn, Discover: dc,
+	sshAddr := "" // reported to Hammerhead, so its terminal can reach the server through this agent
+	if *sshOn {
+		if !sshd.Supported {
+			log.Fatal("-ssh: the SSH server is not available on this platform")
+		}
+		keys := *sshKeys
+		if keys == "" {
+			keys = filepath.Join(*data, "authorized_keys")
+		}
+		srv, err := sshd.New(sshd.Config{Listen: *sshListen, AuthorizedKeys: keys, HostKey: filepath.Join(*data, "ssh_host_ed25519_key"), Logf: log.Printf})
+		if err != nil {
+			log.Fatalf("-ssh: %v", err)
+		}
+		sshAddr = *sshListen
+		log.Printf("ssh: listening on %s, host key %s", *sshListen, srv.Fingerprint())
+		go func() {
+			if err := srv.Run(ctx); err != nil {
+				log.Printf("ssh: stopped: %v", err)
+			}
+		}()
+	}
+	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn, Discover: dc, SSH: sshAddr,
 		Version: version, AutoUpdate: *autoUpdate,
 		UpdateNow: func(ctx context.Context, progress func(string, int, string)) (string, error) {
 			c := upd

go.mod

@@ -3,15 +3,16 @@ module git.veillax.com/Veillax/bamboo
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/reef v0.1.11
+	git.veillax.com/Veillax/reef v0.1.12
+	github.com/creack/pty v1.1.24
+	golang.org/x/crypto v0.58.0
+	golang.org/x/net v0.61.0
 	golang.org/x/time v0.7.0
 )
 
 require (
 	github.com/Microsoft/go-winio v0.6.4 // indirect
 	github.com/google/btree v1.1.2 // indirect
-	golang.org/x/crypto v0.58.0 // indirect
-	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20261024220952-b3bc704ef0ee // indirect

go.sum

@@ -1,7 +1,9 @@
-git.veillax.com/Veillax/reef v0.1.11 h1:kbjgxJpmpp1HRckbW1tqJUm5/ftgvSlmUHAhFXugOlY=
+git.veillax.com/Veillax/reef v0.1.12 h1:Yizgcbh/TUz/dkO/4F+MOZkXlN7FU3/et/5uq1dH72s=
-git.veillax.com/Veillax/reef v0.1.11/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.12/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
@@ -10,6 +12,8 @@ golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
 golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
 golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
 golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=

sshd/run_unix.go

@@ -0,0 +1,95 @@
+//go:build !windows
+
+package sshd
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+
+	"github.com/creack/pty"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	ptySupported = true
+	runSupported = true
+)
+
+// run starts the user's shell (or, for exec, runs cmd through it) and returns its exit code.
+// With a pty request it gets a terminal, otherwise plain pipes.
+func run(ch ssh.Channel, cmd string, p *ptyReq, win <-chan [2]uint32) int {
+	shell := os.Getenv("SHELL")
+	if shell == "" {
+		shell = "/bin/sh"
+	}
+	// Without this the client sees only a session that ends at once. The container image Bamboo is
+	// published in contains no shell at all, so say so, and what to do about it.
+	if _, err := exec.LookPath(shell); err != nil {
+		fmt.Fprintf(ch.Stderr(), "bamboo: there is no shell to run (%v).\r\n"+
+			"The Bamboo container image has none, and a shell in a container is not a shell on the machine. "+
+			"Run Bamboo directly on the machine (for example with its systemd unit) to get one, or set SHELL to a shell that exists.\r\n", err)
+		return 127
+	}
+	var c *exec.Cmd
+	if cmd == "" {
+		c = exec.Command(shell, "-l")
+	} else {
+		c = exec.Command(shell, "-c", cmd)
+	}
+	c.Env = os.Environ()
+	if p != nil {
+		term := p.term
+		if term == "" {
+			term = "xterm"
+		}
+		c.Env = append(c.Env, "TERM="+term)
+		return runPty(ch, c, p, win)
+	}
+	in, err := c.StdinPipe()
+	if err != nil {
+		fmt.Fprintf(ch.Stderr(), "bamboo: %v\r\n", err)
+		return 255
+	}
+	go func() { io.Copy(in, ch); in.Close() }()
+	c.Stdout = ch
+	c.Stderr = ch.Stderr()
+	return exitCode(c.Run(), c)
+}
+
+func runPty(ch ssh.Channel, c *exec.Cmd, p *ptyReq, win <-chan [2]uint32) int {
+	f, err := pty.StartWithSize(c, &pty.Winsize{Cols: uint16(p.cols), Rows: uint16(p.rows)})
+	if err != nil {
+		fmt.Fprintf(ch.Stderr(), "bamboo: %v\r\n", err)
+		return 255
+	}
+	defer f.Close()
+	done := make(chan struct{})
+	defer close(done)
+	go func() {
+		for {
+			select {
+			case w := <-win:
+				pty.Setsize(f, &pty.Winsize{Cols: uint16(w[0]), Rows: uint16(w[1])})
+			case <-done:
+				return
+			}
+		}
+	}()
+	go func() { io.Copy(f, ch) }()
+	io.Copy(ch, f) // ends with an error when the shell exits and the terminal closes
+	return exitCode(c.Wait(), c)
+}
+
+func exitCode(err error, c *exec.Cmd) int {
+	if err == nil {
+		return 0
+	}
+	var ee *exec.ExitError
+	if errors.As(err, &ee) && ee.ExitCode() >= 0 {
+		return ee.ExitCode()
+	}
+	return 255
+}

sshd/run_unix_test.go

@@ -0,0 +1,113 @@
+//go:build !windows
+
+package sshd
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/ssh"
+)
+
+func session(t *testing.T) (*ssh.Session, func()) {
+	t.Helper()
+	good := newSigner(t)
+	addr, _, _ := start(t, good)
+	c, err := dial(addr, ssh.PublicKeys(good))
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, err := c.NewSession()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s, func() { s.Close(); c.Close() }
+}
+
+func TestExec(t *testing.T) {
+	s, done := session(t)
+	defer done()
+	out, err := s.Output("echo hello; echo oops >&2")
+	if err != nil || string(out) != "hello\n" {
+		t.Fatalf("got %q, %v", out, err)
+	}
+}
+
+func TestExecExitStatus(t *testing.T) {
+	s, done := session(t)
+	defer done()
+	err := s.Run("exit 3")
+	var ee *ssh.ExitError
+	if !errors.As(err, &ee) || ee.ExitStatus() != 3 {
+		t.Fatalf("want exit status 3, got %v", err)
+	}
+}
+
+func TestExecReadsStdin(t *testing.T) {
+	s, done := session(t)
+	defer done()
+	s.Stdin = strings.NewReader("from the client\n")
+	out, err := s.Output("cat")
+	if err != nil || string(out) != "from the client\n" {
+		t.Fatalf("got %q, %v", out, err)
+	}
+}
+
+func TestPtyExec(t *testing.T) {
+	s, done := session(t)
+	defer done()
+	if err := s.RequestPty("xterm", 24, 80, ssh.TerminalModes{ssh.ECHO: 0}); err != nil {
+		t.Fatal(err)
+	}
+	out, err := s.CombinedOutput(`echo term=$TERM; test -t 0 && echo tty`)
+	if err != nil || !strings.Contains(string(out), "term=xterm") || !strings.Contains(string(out), "tty") {
+		t.Fatalf("got %q, %v", out, err)
+	}
+}
+
+func TestShell(t *testing.T) {
+	s, done := session(t)
+	defer done()
+	s.Stdin = strings.NewReader("echo from-shell\nexit 4\n")
+	var out strings.Builder
+	s.Stdout = &out
+	err := s.Shell()
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = s.Wait()
+	var ee *ssh.ExitError
+	if !errors.As(err, &ee) || ee.ExitStatus() != 4 || !strings.Contains(out.String(), "from-shell") {
+		t.Fatalf("got %q, %v", out.String(), err)
+	}
+}
+
+// A machine with no shell (the published container image is one) must say so, not just hang up.
+func TestNoShellIsExplained(t *testing.T) {
+	t.Setenv("SHELL", "/nonexistent/shell")
+	for name, usePty := range map[string]bool{"exec": false, "pty shell": true} {
+		s, done := session(t)
+		var stderr, stdout strings.Builder
+		s.Stderr, s.Stdout = &stderr, &stdout
+		var err error
+		if usePty {
+			if err = s.RequestPty("xterm", 24, 80, ssh.TerminalModes{}); err == nil {
+				err = s.Shell()
+				if err == nil {
+					err = s.Wait()
+				}
+			}
+		} else {
+			err = s.Run("true")
+		}
+		done()
+		var ee *ssh.ExitError
+		if !errors.As(err, &ee) || ee.ExitStatus() != 127 {
+			t.Errorf("%s: want exit status 127, got %v", name, err)
+		}
+		if !strings.Contains(stderr.String()+stdout.String(), "no shell to run") {
+			t.Errorf("%s: no explanation (stderr %q, stdout %q)", name, stderr.String(), stdout.String())
+		}
+	}
+}

sshd/run_windows.go

@@ -0,0 +1,12 @@
+package sshd
+
+import "golang.org/x/crypto/ssh"
+
+// Shells need a pseudo-terminal, which Windows has no simple equivalent of here, so the server
+// signs people in but refuses to start a session. main reports this before it starts the server.
+const (
+	ptySupported = false
+	runSupported = false
+)
+
+func run(ssh.Channel, string, *ptyReq, <-chan [2]uint32) int { return 1 }

sshd/sshd.go

@@ -0,0 +1,303 @@
+// Package sshd is a small SSH server for Bamboo, so a machine behind NAT can be reached with an
+// ordinary ssh client through a tunnelled port, without installing or configuring sshd. It is
+// opt-in and deliberately narrow: public keys only (listed in an authorized_keys file), session
+// channels only (a shell or one command, no port forwarding, no agent forwarding, no SFTP), and
+// it listens on the loopback address unless told otherwise. Sessions run as the user Bamboo runs as.
+package sshd
+
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	// DefaultListen is loopback only: a Hammerhead port that targets this site reaches it
+	// through Bamboo, and nothing else on the network can.
+	DefaultListen = "127.0.0.1:2222"
+
+	maxConns         = 16
+	handshakeTimeout = 20 * time.Second
+)
+
+// Supported says whether this platform can run shells (it cannot on Windows).
+const Supported = runSupported
+
+// Config says where the server listens and which keys may sign in.
+type Config struct {
+	Listen         string // host:port, default DefaultListen
+	AuthorizedKeys string // path of an authorized_keys file; read on every sign-in, so edits apply at once
+	HostKey        string // path of the server's ed25519 key; created on first start
+	Logf           func(format string, args ...any)
+}
+
+// Server accepts SSH connections.
+type Server struct {
+	cfg  Config
+	conf *ssh.ServerConfig
+	host ssh.Signer
+	sem  chan struct{}
+}
+
+// New loads (or creates) the host key and checks that at least one authorized key exists, so
+// the server never starts in a state where nobody, or everybody, could sign in.
+func New(cfg Config) (*Server, error) {
+	if cfg.Listen == "" {
+		cfg.Listen = DefaultListen
+	}
+	if cfg.Logf == nil {
+		cfg.Logf = func(string, ...any) {}
+	}
+	if cfg.AuthorizedKeys == "" {
+		return nil, errors.New("no authorized_keys file configured")
+	}
+	keys, err := loadAuthorizedKeys(cfg.AuthorizedKeys)
+	if err != nil {
+		return nil, err
+	}
+	if len(keys) == 0 {
+		return nil, fmt.Errorf("%s has no public keys: add the keys that may sign in, one per line", cfg.AuthorizedKeys)
+	}
+	signer, err := loadOrCreateHostKey(cfg.HostKey)
+	if err != nil {
+		return nil, err
+	}
+	s := &Server{cfg: cfg, host: signer, sem: make(chan struct{}, maxConns)}
+	s.conf = &ssh.ServerConfig{
+		MaxAuthTries: 3,
+		// Only public keys. There is no password or keyboard-interactive callback at all.
+		PublicKeyCallback: func(c ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			keys, err := loadAuthorizedKeys(s.cfg.AuthorizedKeys)
+			if err != nil {
+				s.cfg.Logf("ssh: %v", err)
+				return nil, errors.New("no access")
+			}
+			for _, k := range keys {
+				if bytes.Equal(k.Marshal(), key.Marshal()) {
+					return &ssh.Permissions{Extensions: map[string]string{"fp": ssh.FingerprintSHA256(key)}}, nil
+				}
+			}
+			return nil, errors.New("key not authorized")
+		},
+	}
+	s.conf.AddHostKey(signer)
+	return s, nil
+}
+
+// Fingerprint is the server's host key fingerprint, for the log so it can be checked on first use.
+func (s *Server) Fingerprint() string { return ssh.FingerprintSHA256(s.host.PublicKey()) }
+
+// Run listens until ctx is cancelled.
+func (s *Server) Run(ctx context.Context) error {
+	ln, err := net.Listen("tcp", s.cfg.Listen)
+	if err != nil {
+		return err
+	}
+	return s.Serve(ctx, ln)
+}
+
+// Serve accepts connections on ln until ctx is cancelled.
+func (s *Server) Serve(ctx context.Context, ln net.Listener) error {
+	go func() { <-ctx.Done(); ln.Close() }()
+	var wg sync.WaitGroup
+	defer wg.Wait()
+	for {
+		c, err := ln.Accept()
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil
+			}
+			var ne net.Error
+			if errors.As(err, &ne) && ne.Timeout() {
+				continue
+			}
+			return err
+		}
+		select {
+		case s.sem <- struct{}{}:
+		default:
+			c.Close() // too many sessions already
+			continue
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			defer func() { <-s.sem }()
+			s.handle(ctx, c)
+		}()
+	}
+}
+
+func (s *Server) handle(ctx context.Context, nc net.Conn) {
+	defer nc.Close()
+	nc.SetDeadline(time.Now().Add(handshakeTimeout))
+	rc := &readCounter{Conn: nc}
+	conn, chans, reqs, err := ssh.NewServerConn(rc, s.conf)
+	if err != nil {
+		// A client that connects and never says anything is a port probe or a health check (Hammerhead
+		// checks every TCP resource this way), not a failed sign-in, so it is not worth a log line each time.
+		if rc.n.Load() > 0 {
+			s.cfg.Logf("ssh: sign-in from %s failed: %v", nc.RemoteAddr(), err)
+		}
+		return
+	}
+	nc.SetDeadline(time.Time{})
+	defer conn.Close()
+	s.cfg.Logf("ssh: %s signed in as %s (%s)", conn.User(), nc.RemoteAddr(), conn.Permissions.Extensions["fp"])
+	go func() { <-ctx.Done(); conn.Close() }()
+	go ssh.DiscardRequests(reqs)
+	var wg sync.WaitGroup
+	for ch := range chans {
+		if ch.ChannelType() != "session" {
+			ch.Reject(ssh.UnknownChannelType, "only sessions are allowed")
+			continue
+		}
+		c, creqs, err := ch.Accept()
+		if err != nil {
+			continue
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			s.session(c, creqs)
+		}()
+	}
+	wg.Wait()
+}
+
+// readCounter counts the bytes a client has sent.
+type readCounter struct {
+	net.Conn
+	n atomic.Int64
+}
+
+func (r *readCounter) Read(p []byte) (int, error) {
+	n, err := r.Conn.Read(p)
+	r.n.Add(int64(n))
+	return n, err
+}
+
+type ptyReq struct {
+	term       string
+	cols, rows uint32
+}
+
+// session answers a session channel's requests: pty-req, window-change, env (ignored), shell and exec.
+func (s *Server) session(ch ssh.Channel, reqs <-chan *ssh.Request) {
+	defer ch.Close()
+	var pty *ptyReq
+	var win chan [2]uint32
+	for req := range reqs {
+		switch req.Type {
+		case "pty-req":
+			var p struct {
+				Term                 string
+				Cols, Rows, Wpx, Hpx uint32
+				Modes                string
+			}
+			if ssh.Unmarshal(req.Payload, &p) != nil || !ptySupported {
+				req.Reply(false, nil)
+				continue
+			}
+			pty = &ptyReq{term: p.Term, cols: p.Cols, rows: p.Rows}
+			win = make(chan [2]uint32, 4)
+			req.Reply(true, nil)
+		case "window-change":
+			var w struct{ Cols, Rows, Wpx, Hpx uint32 }
+			if ssh.Unmarshal(req.Payload, &w) == nil && win != nil {
+				select {
+				case win <- [2]uint32{w.Cols, w.Rows}:
+				default:
+				}
+			}
+			req.Reply(true, nil)
+		case "env":
+			req.Reply(true, nil) // accepted and ignored: the client cannot change the environment
+		case "shell", "exec":
+			var cmd string
+			if req.Type == "exec" {
+				var e struct{ Command string }
+				if ssh.Unmarshal(req.Payload, &e) != nil {
+					req.Reply(false, nil)
+					return
+				}
+				cmd = e.Command
+			}
+			if !runSupported {
+				req.Reply(false, nil)
+				return
+			}
+			req.Reply(true, nil)
+			code := run(ch, cmd, pty, win)
+			ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Code uint32 }{uint32(code)}))
+			return
+		default:
+			req.Reply(false, nil) // subsystem (sftp), agent and X11 forwarding, signals: not offered
+		}
+	}
+}
+
+// loadAuthorizedKeys reads the public keys from an authorized_keys file. Options before a key
+// (command=, from=, ...) are not supported, so a line that has them is skipped rather than being
+// honoured too loosely.
+func loadAuthorizedKeys(path string) ([]ssh.PublicKey, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("authorized keys: %w", err)
+	}
+	var keys []ssh.PublicKey
+	for len(b) > 0 {
+		key, _, options, rest, err := ssh.ParseAuthorizedKey(b)
+		if err != nil {
+			break // comments and blank lines are skipped by the parser; anything else ends the list
+		}
+		b = rest
+		if len(options) > 0 {
+			continue
+		}
+		keys = append(keys, key)
+	}
+	return keys, nil
+}
+
+// loadOrCreateHostKey keeps the server's identity across restarts, so clients are not warned
+// that it changed.
+func loadOrCreateHostKey(path string) (ssh.Signer, error) {
+	if path == "" {
+		return nil, errors.New("no host key path configured")
+	}
+	if b, err := os.ReadFile(path); err == nil {
+		return ssh.ParsePrivateKey(b)
+	} else if !os.IsNotExist(err) {
+		return nil, err
+	}
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	der, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return nil, err
+	}
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der})
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return nil, err
+	}
+	if err := os.WriteFile(path, pemBytes, 0o600); err != nil {
+		return nil, err
+	}
+	return ssh.ParsePrivateKey(pemBytes)
+}

sshd/sshd_test.go

@@ -0,0 +1,200 @@
+package sshd
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+func newSigner(t *testing.T) ssh.Signer {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, err := ssh.NewSignerFromKey(priv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s
+}
+
+func authLine(s ssh.Signer) string { return string(ssh.MarshalAuthorizedKey(s.PublicKey())) }
+
+// start runs a server that accepts the given signers and returns its address.
+func start(t *testing.T, allowed ...ssh.Signer) (addr, keysFile string, srv *Server) {
+	t.Helper()
+	dir := t.TempDir()
+	keysFile = filepath.Join(dir, "authorized_keys")
+	var lines string
+	for _, s := range allowed {
+		lines += authLine(s)
+	}
+	if err := os.WriteFile(keysFile, []byte("# who may sign in\n"+lines), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	srv, err := New(Config{AuthorizedKeys: keysFile, HostKey: filepath.Join(dir, "host_key"), Logf: t.Logf})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() { srv.Serve(ctx, ln); close(done) }()
+	t.Cleanup(func() { cancel(); <-done })
+	return ln.Addr().String(), keysFile, srv
+}
+
+func dial(addr string, auth ...ssh.AuthMethod) (*ssh.Client, error) {
+	return ssh.Dial("tcp", addr, &ssh.ClientConfig{User: "tester", Auth: auth, HostKeyCallback: ssh.InsecureIgnoreHostKey(), Timeout: 5 * time.Second})
+}
+
+func TestNewNeedsKeys(t *testing.T) {
+	dir := t.TempDir()
+	cfg := Config{AuthorizedKeys: filepath.Join(dir, "authorized_keys"), HostKey: filepath.Join(dir, "host_key")}
+	if _, err := New(cfg); err == nil {
+		t.Fatal("a missing authorized_keys file should be an error")
+	}
+	os.WriteFile(cfg.AuthorizedKeys, []byte("# nothing yet\n\n"), 0o600)
+	if _, err := New(cfg); err == nil {
+		t.Fatal("an authorized_keys file without keys should be an error")
+	}
+}
+
+func TestOptionsLinesAreSkipped(t *testing.T) {
+	a, b := newSigner(t), newSigner(t)
+	path := filepath.Join(t.TempDir(), "authorized_keys")
+	os.WriteFile(path, []byte(`command="/bin/false" `+authLine(a)+authLine(b)), 0o600)
+	keys, err := loadAuthorizedKeys(path)
+	if err != nil || len(keys) != 1 || ssh.FingerprintSHA256(keys[0]) != ssh.FingerprintSHA256(b.PublicKey()) {
+		t.Fatalf("only the key without options should load, got %d keys, err %v", len(keys), err)
+	}
+}
+
+func TestHostKeyIsStable(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "authorized_keys")
+	os.WriteFile(keys, []byte(authLine(newSigner(t))), 0o600)
+	cfg := Config{AuthorizedKeys: keys, HostKey: filepath.Join(dir, "sub", "host_key")}
+	a, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := New(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a.Fingerprint() != b.Fingerprint() {
+		t.Fatal("the host key changed between starts")
+	}
+}
+
+func TestKeyAuth(t *testing.T) {
+	good, bad := newSigner(t), newSigner(t)
+	addr, _, _ := start(t, good)
+
+	c, err := dial(addr, ssh.PublicKeys(good))
+	if err != nil {
+		t.Fatalf("authorized key refused: %v", err)
+	}
+	c.Close()
+	if _, err := dial(addr, ssh.PublicKeys(bad)); err == nil {
+		t.Fatal("unknown key was accepted")
+	}
+	if _, err := dial(addr, ssh.Password("hunter2")); err == nil {
+		t.Fatal("a password was accepted")
+	}
+	if _, err := dial(addr, ssh.KeyboardInteractive(func(string, string, []string, []bool) ([]string, error) { return nil, nil })); err == nil {
+		t.Fatal("keyboard-interactive was accepted")
+	}
+}
+
+func TestKeysCanChangeWhileRunning(t *testing.T) {
+	first, second := newSigner(t), newSigner(t)
+	addr, keysFile, _ := start(t, first)
+	if _, err := dial(addr, ssh.PublicKeys(second)); err == nil {
+		t.Fatal("second key accepted before it was added")
+	}
+	f, _ := os.OpenFile(keysFile, os.O_APPEND|os.O_WRONLY, 0o600)
+	f.WriteString(authLine(second))
+	f.Close()
+	c, err := dial(addr, ssh.PublicKeys(second))
+	if err != nil {
+		t.Fatalf("key added to the file was not picked up: %v", err)
+	}
+	c.Close()
+}
+
+func TestNoForwarding(t *testing.T) {
+	good := newSigner(t)
+	addr, _, _ := start(t, good)
+	c, err := dial(addr, ssh.PublicKeys(good))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+	if conn, err := c.Dial("tcp", "127.0.0.1:1"); err == nil {
+		conn.Close()
+		t.Fatal("port forwarding was allowed")
+	}
+}
+
+// Hammerhead health-checks a TCP resource by connecting and hanging up; that must not look like
+// a failed sign-in in the log, while a real failure still does.
+func TestProbesAreNotLogged(t *testing.T) {
+	good := newSigner(t)
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "authorized_keys")
+	if err := os.WriteFile(keys, []byte(authLine(good)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var mu sync.Mutex
+	var logs []string
+	srv, err := New(Config{AuthorizedKeys: keys, HostKey: filepath.Join(dir, "host_key"), Logf: func(f string, a ...any) {
+		mu.Lock()
+		logs = append(logs, fmt.Sprintf(f, a...))
+		mu.Unlock()
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() { srv.Serve(ctx, ln); close(done) }()
+	t.Cleanup(func() { cancel(); <-done })
+
+	for i := 0; i < 3; i++ {
+		c, err := net.Dial("tcp", ln.Addr().String())
+		if err != nil {
+			t.Fatal(err)
+		}
+		c.Close()
+	}
+	time.Sleep(200 * time.Millisecond)
+	if _, err := dial(ln.Addr().String(), ssh.PublicKeys(newSigner(t))); err == nil {
+		t.Fatal("an unknown key signed in")
+	}
+	time.Sleep(200 * time.Millisecond)
+	mu.Lock()
+	defer mu.Unlock()
+	if len(logs) != 1 || !strings.Contains(logs[0], "failed") {
+		t.Fatalf("want exactly the one real failure logged, got %q", logs)
+	}
+}

terminal.go

@@ -0,0 +1,99 @@
+package bamboo
+
+import (
+	"io"
+	"log"
+	"net"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/net/websocket"
+)
+
+// Terminal relay. When someone opens a terminal for this site in Hammerhead, Hammerhead lists a
+// session in the site's config (model.SiteConfig.Terminals). For each one the agent opens a
+// connection out to Hammerhead and joins it to its own SSH server, so Hammerhead can sign in over it.
+// Nothing listens for this, no port has to be open on an edge, and the SSH server still decides who
+// gets in: Hammerhead needs its public key in authorized_keys like any other client.
+
+const (
+	termSeenFor = time.Minute // a session id is answered once, even if the config is fetched again
+	termDial    = 10 * time.Second
+)
+
+// sshTarget is the address to dial for the local SSH server. An address that listens on every
+// interface is reached on the loopback one.
+func sshTarget(listen string) string {
+	if listen == "" {
+		return ""
+	}
+	host, port, err := net.SplitHostPort(listen)
+	if err != nil {
+		return listen
+	}
+	if ip := net.ParseIP(host); host == "" || (ip != nil && ip.IsUnspecified()) {
+		host = "127.0.0.1"
+	}
+	return net.JoinHostPort(host, port)
+}
+
+// openTerminals starts a relay for each session Hammerhead is waiting on that has not been answered yet.
+func (b *Bamboo) openTerminals(ids []string) {
+	for _, id := range ids {
+		b.mu.Lock()
+		if b.terms == nil {
+			b.terms = map[string]time.Time{}
+		}
+		for k, t := range b.terms {
+			if time.Since(t) > termSeenFor {
+				delete(b.terms, k)
+			}
+		}
+		_, dup := b.terms[id]
+		if !dup {
+			b.terms[id] = time.Now()
+		}
+		b.mu.Unlock()
+		if !dup {
+			go b.relayTerminal(id)
+		}
+	}
+}
+
+func (b *Bamboo) relayTerminal(id string) {
+	target := sshTarget(b.cfg.SSH)
+	if target == "" {
+		log.Printf("terminal: Hammerhead asked for a terminal but the SSH server is not running (start bamboo with -ssh)")
+		return
+	}
+	wsURL := "ws" + strings.TrimPrefix(b.cfg.Hammerhead, "http") + "/site/terminal/" + id
+	cfg, err := websocket.NewConfig(wsURL, b.cfg.Hammerhead)
+	if err != nil {
+		log.Printf("terminal: %v", err)
+		return
+	}
+	cfg.Header.Set("Authorization", "Bearer "+b.cfg.Token)
+	cfg.Dialer = &net.Dialer{Timeout: termDial}
+	ws, err := websocket.DialConfig(cfg)
+	if err != nil {
+		log.Printf("terminal: could not reach Hammerhead: %v", err)
+		return
+	}
+	ws.PayloadType = websocket.BinaryFrame
+	defer ws.Close()
+	local, err := net.DialTimeout("tcp", target, termDial)
+	if err != nil {
+		log.Printf("terminal: the SSH server at %s is not answering: %v", target, err)
+		return // closing the connection tells Hammerhead at once
+	}
+	defer local.Close()
+
+	var once sync.Once
+	stop := func() { once.Do(func() { ws.Close(); local.Close() }) }
+	done := make(chan struct{}, 2)
+	go func() { io.Copy(local, ws); stop(); done <- struct{}{} }()
+	go func() { io.Copy(ws, local); stop(); done <- struct{}{} }()
+	<-done
+	<-done
+}

terminal_test.go

@@ -0,0 +1,114 @@
+package bamboo
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"golang.org/x/net/websocket"
+)
+
+func TestSSHTarget(t *testing.T) {
+	for in, want := range map[string]string{
+		"":               "",
+		"127.0.0.1:2222": "127.0.0.1:2222",
+		":2222":          "127.0.0.1:2222",
+		"0.0.0.0:2200":   "127.0.0.1:2200",
+		"[::]:2222":      "127.0.0.1:2222",
+		"10.0.0.5:2222":  "10.0.0.5:2222",
+	} {
+		if got := sshTarget(in); got != want {
+			t.Errorf("sshTarget(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// Hammerhead lists a terminal session; the agent calls back with its token and joins the connection
+// to its SSH server. Here the "SSH server" is a local echo, and Hammerhead is a test server.
+func TestTerminalRelayJoinsHammerheadToTheLocalSSHServer(t *testing.T) {
+	echo, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer echo.Close()
+	go func() {
+		for {
+			c, err := echo.Accept()
+			if err != nil {
+				return
+			}
+			go func() { defer c.Close(); io.Copy(c, c) }()
+		}
+	}()
+
+	got := make(chan *websocket.Conn, 4)
+	auth := make(chan string, 4)
+	paths := make(chan string, 4)
+	hh := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth <- r.Header.Get("Authorization")
+		paths <- r.URL.Path
+		release := make(chan struct{})
+		websocket.Server{Handshake: func(*websocket.Config, *http.Request) error { return nil }, Handler: func(ws *websocket.Conn) {
+			ws.PayloadType = websocket.BinaryFrame
+			got <- ws
+			<-release
+		}}.ServeHTTP(w, r)
+		close(release)
+	}))
+	defer hh.Close()
+
+	b, err := New(Config{Hammerhead: hh.URL, Token: "site-token", DataDir: t.TempDir(), SSH: echo.Addr().String()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.openTerminals([]string{"abc"})
+	b.openTerminals([]string{"abc"}) // fetching the config again must not answer the same session twice
+
+	var ws *websocket.Conn
+	select {
+	case ws = <-got:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the agent never called back")
+	}
+	if a := <-auth; a != "Bearer site-token" {
+		t.Errorf("call-back authorization: %q", a)
+	}
+	if p := <-paths; p != "/site/terminal/abc" {
+		t.Errorf("call-back path: %q", p)
+	}
+	if _, err := ws.Write([]byte("hello through the relay")); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 64)
+	ws.SetReadDeadline(time.Now().Add(5 * time.Second))
+	n, err := ws.Read(buf)
+	if err != nil || string(buf[:n]) != "hello through the relay" {
+		t.Fatalf("echo through the relay: %q, %v", buf[:n], err)
+	}
+	select {
+	case <-got:
+		t.Error("the same session was answered twice")
+	case <-time.After(300 * time.Millisecond):
+	}
+	ws.Close()
+}
+
+// With no SSH server the agent does not call back at all, rather than connect and hang.
+func TestTerminalRelayDoesNothingWithoutAnSSHServer(t *testing.T) {
+	called := make(chan struct{}, 1)
+	hh := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { called <- struct{}{} }))
+	defer hh.Close()
+	b, err := New(Config{Hammerhead: hh.URL, Token: "t", DataDir: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.openTerminals([]string{"x"})
+	select {
+	case <-called:
+		t.Error("the agent called Hammerhead although it has no SSH server")
+	case <-time.After(400 * time.Millisecond):
+	}
+}