Services → SSH host

Connect SSH host

A fixed menu of diagnostic commands on a Linux host. Not a shell — the adapter has no free-form command tool and never will.

Tier 2 Private key PEM (or a password) ~5 min profile ssh/diagnostics-read

Setting this up with your own agent? Give it these instructions.

Read-only SSH does not exist; a reviewed command menu does

There is no SSH permission that means "read-only". So Prodpeek ships an adapter whose entire surface is a fixed list of named commands — df -hP, journalctl -u <unit> -n <lines>, docker logs --tail, and so on — each a hardcoded argv template with validated arguments. There is no run_command, and the profile records that refusal explicitly rather than leaving it implied by absence.

Three layers, honestly labelled: the adapter validates and builds the command, the gateway enforces the same constraints independently before the call reaches it, and the unix account bounds what those commands can see. The third one is yours to set up, and it is why this recipe is mostly about the user rather than the key.

Steps

  1. On the host, create a dedicated user:

``bash sudo adduser --disabled-password --gecos "" diag ``

  1. On your machine, generate a keypair used for nothing else:

``bash ssh-keygen -t ed25519 -C "prodpeek" -f ~/.ssh/prodpeek_diag ``

  1. Install the public key:

``bash sudo -u diag mkdir -p /home/diag/.ssh sudo -u diag tee -a /home/diag/.ssh/authorized_keys < ~/.ssh/prodpeek_diag.pub sudo -u diag chmod 700 /home/diag/.ssh sudo -u diag chmod 600 /home/diag/.ssh/authorized_keys ``

  1. Add groups only if you need the tools that require them:

``bash sudo usermod -aG systemd-journal diag # journal_tail beyond own units sudo usermod -aG docker diag # docker_* tools — see the warning above ``

  1. In Prodpeek: Services → Add a service → SSH host, URL diag@your-host:22, and paste the private key (~/.ssh/prodpeek_diag, the file without .pub).

If the host rate-limits SSH

A ufw limit rule on 22/tcp allows six new connections per thirty seconds per source. Prodpeek reuses one authenticated connection per target and opens a new session per command, so a run of checks no longer trips it — and if something does get refused, the error says so rather than looking like a dead host.

The cost of that reuse: a pooled connection stays usable for up to PRODPEEK_SSH_POOL_TTL (300s by default) after you revoke the key. Lower it if that window matters to you.

Screenshots

The dedicated user's authorized_keys, containing only the Prodpeek key. Screenshot pending — the steps above stand on their own.
The dedicated user's authorized_keys, containing only the Prodpeek key.