[Feature]: Add raw SSH tunnels to hosts through connected agents
What is the installation method of your PatchMon server?
Docker
What is the version of your PatchMon server?
2.0.2
Briefly describe the feature
Allow users to open a raw SSH tunnel to a managed host through its existing outbound PatchMon agent connection.
Detailed description
PatchMon already provides an SSH proxy for its web terminal, but this proxy acts as an SSH client inside the agent and does not expose a standard SSH transport to external tools.
This feature proposes adding a raw tunnel between the user's SSH client and the SSH service running on the managed host.
The PatchMon agent would forward opaque TCP traffic to the host's local SSH port. SSH authentication, host key verification, and encryption would remain managed end-to-end by the user's OpenSSH client and the host's SSH server.
This would make the tunnel compatible with standard SSH tooling and features, including:
- interactive OpenSSH sessions;
- remote command execution;
- Ansible;
- SCP, SFTP, and
rsync; - SSHFS;
- local, remote, and dynamic port forwarding;
- IDE integrations such as Remote SSH;
- automation tools that already rely on OpenSSH.
When combined with the proposed PatchMon CLI, users could use PatchMon as an OpenSSH ProxyCommand, for example:
ssh -o 'ProxyCommand=patchmon ssh-tunnel my-host' user@my-hostThis would allow existing SSH configurations and tools to access hosts through PatchMon without requiring a PatchMon-specific SSH implementation.
An experimental implementation is available in:
agent/ssh-bastion-session-recording
Technically, the branch adds a binary WebSocket tunnel between the client, the PatchMon server, and the agent. The agent forwards the traffic to its local SSH service without interpreting or recording the SSH payload.
PatchMon can retain connection metadata for auditing, such as the PatchMon user, target host, start time, end time, and status. Credentials, commands, transferred files, and other SSH payloads remain encrypted and are not visible to PatchMon.
Why is this useful?
A raw tunnel would allow users to reuse the complete OpenSSH ecosystem instead of limiting remote access to the PatchMon web terminal.
It would make hosts behind NAT accessible to administration and automation tools without exposing their SSH ports publicly or deploying an additional VPN or bastion on the managed network.
Combined with the PatchMon CLI, this could make PatchMon an access path for interactive administration, Ansible, file transfers, port forwarding, IDE integrations, and existing SSH-based automation.
Like update install and reboot features, this feature add a big security risk. If this feature is added to Patchmon, it can be disabled to reduce the attack.