Why we implemented our own SSHD solution

GitLab's transition to its own SSH daemon (SSHD) stemmed from the need for enhanced functionality and control over SSH connections, which the existing combination of OpenSSH Server and GitLab Shell couldn't fully provide. The move was motivated by a community-contributed lightweight alternative that offered benefits for containerized deployments and better performance management. Key improvements included enabling the PROXY protocol for accurate IP address tracking, ensuring compatibility with Kubernetes for graceful shutdowns, collecting detailed metrics for monitoring, and reducing the attack surface by using a restricted set of SSH features. Despite the benefits, the transition posed significant challenges, including security risks and compatibility issues with existing features, which were mitigated through thorough security reviews and gradual rollouts. The process also required addressing limitations in the golang.org/x/crypto library and implementing OpenSSH options to maintain necessary features. Incremental rollouts and seeking diverse perspectives were crucial in navigating the complexities of this shift and ensuring a successful implementation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.