[Feature]: Add agent-based remote sessions with recording and replay

What is the installation method of your PatchMon server?

Docker

What is the version of your PatchMon server?

2.0.2

Briefly describe the feature

Improve how users access managed Linux hosts through the existing outbound PatchMon agent connection, with session recording and replay.

Detailed description

PatchMon already provides remote SSH access, but the current SSH proxy implementation is not fully transparent. Depending on the environment, users may need to manually configure or update known_hosts before remote access works.

This feature proposes a simpler approach where the PatchMon agent directly creates and relays a local terminal session. The host remains accessible through the agent's existing outbound connection without exposing its SSH port.

Remote sessions would be recorded and available from a session history page. This page would show information such as the PatchMon user, host, Linux account, date, duration, and session status. Interactive sessions could also be replayed to help understand what happened during an operation.

An experimental implementation is available in:

agent/ssh-bastion-session-recording

Technically, this branch adds a PTY protocol to the existing agent WebSocket, a server-side session broker, recording storage, and a web interface for session history and replay.

Authentication and security discussion

The current prototype authenticates local Linux accounts on the agent. This requires the privileges needed to verify local credentials, create the terminal session, and switch to the requested Linux account.

Other authentication approaches may be preferable if the PatchMon agent should not run with root privileges. For example, authentication could rely on PAM, a dedicated privileged helper, or the host SSH server.

The authentication method and required agent privileges are open for discussion.

Why is this useful?

This approach would make remote access easier to use than the current SSH proxy solution while keeping Linux hosts accessible behind NAT without exposing their SSH ports.

Session history and replay would also improve troubleshooting and auditing by showing:

• who opened a remote session;
• which host and Linux account were used;
• when the session started and ended;
• what happened during a recorded interactive session.

The same session infrastructure could be reused by the existing web terminal and other future remote-access integrations.