Shells, commands and SSH

Everything here goes through the agent’s outbound channel or the project’s SSH certificate authority. Every session runs as the stratum-ssh user inside the guest, which normally has passwordless sudo.

A shell

Console: the instance’s Session Manager tab opens a shell in the browser.

CLI: stratumctl instances ssh signs a short-lived SSH certificate for a throwaway key and connects. It goes through the agent’s channel when the instance has no floating IP, or with --tunnel; otherwise straight to the instance’s SSH port.

stratumctl instances ssh i-abc123 --project p-web
stratumctl instances ssh i-abc123 --project p-web --tunnel     # always through the agent

Screenshotconsole-session-shell

A browser shell on the Session Manager tab.

Sessions are recorded with who opened them and when:

stratumctl instances sessions list i-abc123 --project p-web
stratumctl instances sessions describe i-abc123 sess-abc123 --project p-web

Each project allows 5 concurrent sessions by default. An operator changes it per project on the instance’s Session Manager tab, under Concurrent session limit.

Run a command on many instances

stratumctl instances run-command --instances i-abc123,i-def456 \
  --command "uptime; df -h /" --timeout 60s --project p-web

Up to 100 instances at a time. Each returns its exit code and combined output (up to 64 KiB). The default timeout is 60 seconds, the maximum 10 minutes.

Forward a port

Reach a service inside the instance from a workstation, with no floating IP or open port:

stratumctl instances port-forward i-abc123 --local 5432 --remote 5432 --project p-web
psql -h 127.0.0.1 -p 5432 -U app appdb          # in another terminal

--remote is a port on the instance’s loopback. One forwarded connection at a time per instance.

SSH with your own tools

The agent keeps the guest trusting the project’s user CA and gets the guest’s host keys signed by its host CA. Sign your own key for a short time, then use any SSH client:

stratumctl ssh-ca sign --public-key-file ~/.ssh/id_ed25519.pub --instance i-abc123 \
  --valid-for 15m --out ~/.ssh/id_ed25519-cert.pub --project p-web
ssh -i ~/.ssh/id_ed25519 stratum-ssh@198.51.100.20

Trust the project’s host CA once, and no host key prompt appears again, even after instances are replaced:

stratumctl ssh-ca trust-bundle --known-hosts --project p-web

Certificates last 15 minutes by default, one hour at most. stratumctl ssh-ca describe shows the project’s CA keys and limits; ssh-ca rotate-key rotates them.

The serial console

For an instance whose agent and network are both down:

stratumctl instances console-serial i-abc123 --project p-web

It returns a single-use URL valid for 60 seconds. The console’s Console tab does the same in the browser.