> ## Documentation Index
> Fetch the complete documentation index at: https://hoopdev-fix-add-missing-mechanic-for-session-download-button.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure Shell (SSH)

> A cryptographic network protocol for operating network services securely over an unsecured network, commonly used for remote command-line login.

export const ConnectionTemplate = ({config}) => {
  const defaultConfig = {
    name: "Connection",
    description: "Connection description",
    features: {
      tlsTerminationProxy: {
        native: false,
        oneOff: false
      },
      audit: {
        native: false,
        oneOff: false
      },
      dataMaskingGoogleDLP: {
        native: false,
        oneOff: false
      },
      dataMaskingMSPresidio: {
        native: false,
        oneOff: false
      },
      guardrails: {
        native: false,
        oneOff: false
      },
      credentialsOffload: {
        native: false,
        oneOff: false
      },
      interactiveAccess: {
        native: false,
        oneOff: false
      }
    }
  };
  const finalConfig = Object.assign({}, defaultConfig, config);
  const renderIcon = enabled => {
    return enabled ? <Icon icon="check" /> : <Icon icon="xmark" />;
  };
  return <div>
      <h2>Before you start</h2>
      <p>To get the most out of this guide, you will need to:</p>
      <ul>
        <li>Either <a href="https://use.hoop.dev">create an account in our managed instance</a> or <a href="/getting-started/installation/overview">deploy your own hoop.dev instance</a></li>
        <li>You must be your account administrator to perform the following commands</li>
      </ul>

      {finalConfig.requirements && <>
          <h2>Requirements</h2>
          <p>{finalConfig.requirements.description}</p>
          {finalConfig.requirements.items && <ul>
            {finalConfig.requirements.items.map(item => <li>{item}</li>)}
          </ul>}
        </>}

      <h2>Features</h2>
      <p>The table below outlines the features available for this type of connection.</p>
      
      <ul>
        <li><strong>Native</strong> - Indicates the connectivity happens through the Hoop command line  (<code>hoop connect &lt;connection-name&gt;</code>) or acessing the protocol port directly on the gateway.</li>
        <li><strong>One Off</strong> - This term refers to accessing the resource from Hoop Web Console.</li>
      </ul>

      <table>
        <thead>
          <tr>
            <th>Feature</th>
            <th>Native</th>
            <th>One Off</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td>TLS Termination Proxy</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.native)}</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.oneOff)}</td>
            <td>The local proxy terminates the connection with TLS, enabling the connection with the remote server to be TLS encrypted.</td>
          </tr>
          <tr>
            <td>Audit</td>
            <td>{renderIcon(finalConfig.features?.audit?.native)}</td>
            <td>{renderIcon(finalConfig.features?.audit?.oneOff)}</td>
            <td>The gateway stores and audits the queries being issued by the client.</td>
          </tr>
          <tr>
            <td>Data Masking (Google DLP)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Data Masking (MS Presidio)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Guardrails</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.native)}</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.oneOff)}</td>
            <td>An intelligent layer of protection with smart access controls and monitoring mechanisms.</td>
          </tr>
          <tr>
            <td>Credentials Offload</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.native)}</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.oneOff)}</td>
            <td>The user authenticates via SSO instead of using database credentials.</td>
          </tr>
          <tr>
            <td>Interactive Access</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.native)}</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.oneOff)}</td>
            <td>Interactive access is available when using an IDE or connecting via a terminal to perform analysis exploration.</td>
          </tr>
        </tbody>
      </table>

      {finalConfig.resourceConfiguration?.credentials && <>
      <h2>Configuration</h2>
      <table>
        <thead>
          <tr>
            <th>Name</th>
            <th>Type</th>
            <th>Required</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          {Object.entries(finalConfig.resourceConfiguration.credentials).map(([key, credential]) => {
    if (typeof credential === 'string' || credential.hidden) return null;
    return <tr key={key}>
                <td>{credential.name}</td>
                <td>{credential.type}</td>
                <td>{credential.required ? 'yes' : 'no'}</td>
                <td>
                  {credential.description?.split(/(\[[^\]]+\]\([^)]+\))/).map((part, index) => {
      const linkMatch = part.match(/\[([^\]]+)\]\(([^)]+)\)/);
      if (linkMatch) {
        return <a key={index} href={linkMatch[2]} target="_blank" rel="noopener noreferrer">{linkMatch[1]}</a>;
      }
      return part;
    })}
                </td>
              </tr>;
  }).filter(Boolean)}
        </tbody>
      </table>
      </>}
    </div>;
};

<ConnectionTemplate
  config={{
"resourceConfiguration": {
"type": "application",
"subtype": "ssh",
"credentials": [
  {
    "name": "HOST",
    "type": "env-var",
    "required": true,
    "description": "The IP or hostname of the SSH server",
    "placeholder": "localhost"
  },
  {
    "name": "PORT",
    "type": "env-var",
    "required": false,
    "description": "The port of the SSH server, default to 22",
    "placeholder": "22"
  },
  {
    "name": "USER",
    "type": "env-var",
    "required": true,
    "description": "The username of the Linux server",
    "placeholder": "ubuntu"
  },
  {
    "name": "PASS",
    "type": "env-var",
    "required": false,
    "description": "The credentials of the username if password authentication is enabled in the SSH server.",
    "placeholder": "password"
  },
  {
    "name": "AUTHORIZED_SERVER_KEYS",
    "type": "env-var",
    "required": false,
    "description": "The private key of the user that corresponds to the public key at $HOME/<user>/.ssh/authorized_keys",
    "placeholder": "Enter your private key"
  }
]
},
"id": "ssh",
"name": "Secure Shell (SSH)",
"description": "A cryptographic network protocol for operating network services securely over an unsecured network, commonly used for remote command-line login.",
"category": "infrastructure-access",
"icon-name": "ssh",
"tags": [
"security",
"interactive",
"cli"
],
"overview": {
"description": "Access your servers securely through Hoop.dev with comprehensive SSH session recording, intelligent command monitoring, and automated access controls. Connect to remote hosts with complete audit trails, data masking capabilities, and built-in security guardrails that eliminate the need for traditional VPN access."
},
"setupGuide": {
"accessMethods": {
  "webapp": false,
  "cli": false,
  "native": true,
  "runbooks": false
}
},
"documentationConfig": {
"path": "quickstart/ssh"
},
"features": {
"tlsTerminationProxy": {
  "native": true,
  "oneOff": false
},
"audit": {
  "native": false,
  "oneOff": false
},
"dataMaskingGoogleDLP": {
  "native": false,
  "oneOff": false
},
"dataMaskingMSPresidio": {
  "native": false,
  "oneOff": false
},
"guardrails": {
  "native": false,
  "oneOff": true
},
"credentialsOffload": {
  "native": true,
  "oneOff": false
},
"interactiveAccess": {
  "native": true,
  "oneOff": false
}
}
}}
/>

## Connection Setup

```sh theme={null}
# ssh server must enable password based authentication
hoop admin create conn myremote-server -a <agent> --overwrite \
    --type application/ssh \
    -e HOST=10.20.30.40 \
    -e USER=root \
    -e PASS=myrootpasswd

# ssh server must enable public key authentication
hoop admin create conn myremote-server -a <agent> --overwrite \
    --type application/ssh \
    -e HOST=10.20.30.40 \
    -e USER=root \
    -e AUTHORIZED_SERVER_KEYS=file:///path/to/your/private/key
```

## How to Use it

To connect automatically, it will listen to a random port and use your local `ssh` client to connect it.

```bash theme={null}
hoop connect myremote-server
```

In the listen mode, it will listen for connections on the specified port when using the `--port` flag.

```bash theme={null}
hoop connect myremote-server --port 2222
```

Connect with your local SSH client using another terminal window:

```bash theme={null}
ssh -p 2222 localhost
```

## SSH Hosts Key

To prevent fingerprint issues when connecting with the local SSH client server,
add the client host key environment variable during gateway setup.

The key must be in `PKCS#8` format and encoded as base64. You can generate a key with `openssl` utility:

```bash theme={null}
openssl genpkey -algorithm RSA -out ssh_host_hoop_key.pem \
  -pkeyopt rsa_keygen_bits:4096
base64 -i ssh_host_hoop_key.pem
```

* `SSH_CLIENT_HOST_KEY=<base64-encoded-key>`

<Tip>
  To troubleshoot the SSH connection with hosts keys, use the `--debug` flag when running the `hoop connect` command.
  This will provide detailed information about the connection process, including any issues related to parsing the host key.
</Tip>

For more details, refer to the [environment variables documentation](/setup/configuration/env-vars).

## Known Issues

### Warp Terminal

When using Warp Terminal, you might encounter issues due to its unique handling of SSH connections.
To disable it, set this option in your bash profile or your current shell session

```sh theme={null}
export WARP_USE_SSH_WRAPPER=0
```