SSH Overview

SSH Gate Overview

SSH Gate is a platform infrastructure component that accepts secure SSH connections from the Internet and forwards them through the internal network to the required environment or container. It provides centralized and encrypted remote access without exposing every container directly.

In this article

SSH Overview

SSH, or Secure Shell, is a network protocol used to connect securely to a remote container and execute commands. The connection between the client and server is authenticated using cryptographic keys, while transferred commands and credentials remain encrypted.

Encrypted connection Commands and authentication data are protected while travelling between the local client and the platform.
Key-based authentication Access is established using a matching public and private SSH key pair.
Remote management Users can execute commands, update configuration files, deploy applications, and manage services remotely.

How SSH Gate Works

SSH Gate receives the user’s external SSH connection and routes it to the selected platform container through the internal network.

Local SSH Client
→
SSH Gate
→
Selected Container

This centralized gateway avoids the need to expose each container directly to the Internet and allows the platform to route an authenticated user to the correct account, environment, and node.

Authentication Model

The SSH Gate authentication process consists of two independent stages. Both stages use the standard SSH protocol and public/private key authentication.

External authentication Authenticates the connection from the end user and local SSH client to SSH Gate.
Internal authentication Authenticates the connection from SSH Gate to the selected platform container.
✓

Secure two-stage connection

The separation between external and internal authentication allows SSH Gate to securely route users to containers available under their accounts.

Account-Level Access

SSH Gate can provide access to the complete platform account. After authentication, an interactive menu allows users to navigate through available environment groups, environments, and containers without repeating the authentication process for every node.

1

Connect to the account using the SSH connection string provided in the dashboard.

2

Select the required environment from the interactive account menu.

3

Select the required container from the selected environment and begin the remote session.

Direct Container Access

Users can also connect directly to an individual container instead of navigating through the interactive account menu. Direct access is useful for automation tools, deployment scripts, SFTP clients, FISH-based file managers, and remote configuration workflows.

The container Node ID is added before the account User ID in the SSH connection string:

ssh <node-id>-<user-id>@gate.<platform-domain> -p 3022
!

Direct node connection

The Node ID identifies the target container, while the User ID identifies the platform account. These values are separated by a hyphen.

Permissions and Service Management

When connected to a standard platform container through SSH, the user receives the permissions required to manage application files and supported services. Main services can be controlled using approved sudo systemctl commands.

sudo systemctl start jetty sudo systemctl stop mysql sudo systemctl restart tomcat sudo systemctl status memcached sudo systemctl reload tomcat
start Starts a stopped service.
stop Stops a running service.
restart Stops and starts a service again.
status Displays the current service state and related information.
reload Reloads supported service configuration without a complete restart.

SFTP and FISH Support

SSH Gate also supports secure file-access protocols that allow users to manage and transfer container files through an encrypted SSH channel.

SFTP Secure File Transfer Protocol allows users to browse, upload, download, rename, and manage files directly on a container.
FISH Files transferred over Shell protocol enables secure file-system management through supported applications such as Midnight Commander, Konqueror, lftp, and Krusader.

Important Notes

!

Dashboard synchronization

Applications deployed, configuration changes made, or additional functionality installed manually through SSH may not be reflected in the platform dashboard.

!

Account-level availability

SSH access is provided for the complete platform account rather than being enabled independently for only one environment.

The complete SSH workflow normally includes generating an SSH key pair, adding the public key to the dashboard, connecting through SSH Gate or Web SSH, and then using SSH-based management or file-transfer tools as required.

Related Documentation