Skip to content

v0.6.7-remote-access-passphrase

Choose a tag to compare

View all tags
@Bajusz15 Bajusz15 released this 30 May 18:41
v0.6.7-remote-access-passphrase
7814e77
This commit was signed with the committer’s verified signature.
Bajusz15 Máté Bajusz
SSH Key Fingerprint: Ji/8WAqmm7Hdf4gA0+uzGoCkcBt0qoU8jSiCDmhSvic
Verified
Learn about vigilant mode.

🚀 Beacon Release — Remote Terminal & Command Rename

This release adds remote terminal to Beacon — open a shell on any device from your browser, through BeaconInfra. No SSH port, no VPN, no port forwarding. Also renames beacon master to beacon start.

✨ Highlights

🚇 Tunneling on HA OS

With the beacon home-assistant OS addon you can now enable tunneling (remote access).

🖥️ Remote Terminal and Tunneling

The cloud relays a shell session (PTY) between your browser and the Beacon agent — no SSH port, no VPN needed. Sessions auto-expire after 15 minutes. Set a remote-access passphrase to require a device-verified second factor before any session opens.

How it works:

  1. Click "Open Terminal" on a device in the dashboard (Remote Access tab or the Remote Access page)
  2. BeaconInfra creates a session and sends a terminal_open piggyback command to the device
  3. The Beacon agent picks it up on the next heartbeat, dials back to the cloud via WebSocket, and spawns a local shell
  4. Browser ↔ Cloud Hub ↔ Agent PTY — bidirectional relay, binary-safe

How it stays secure — the cloud never sees your passphrase:

The passphrase is never stored. Setup writes only an Argon2id-derived key, its salt, and the cost parameters to ~/.beacon/remote-access.json (mode 0600).
At session time the agent issues a single-use, short-lived nonce. The browser derives the key from your passphrase and returns a proof = HMAC-SHA256(key, nonce ‖ action ‖ session_id). The agent recomputes and compares it in constant time. BeaconInfra only relays this challenge — it never sees the passphrase or any reusable proof, so a fully compromised cloud still cannot open a session.
A successful unlock is in-memory, session-bound, and TTL-limited, and is cleared on restart (fail-closed).
Repeated wrong attempts trigger rate-limiting / backoff to slow brute force.

Security:

  • One-time btt_ tokens per session — SHA-256 hashed, only the hash stored server-side
  • Sessions auto-expire after 15 minutes (max duration) or 5 minutes idle
  • Shell restricted to an allow-list (/bin/bash, /bin/zsh, /bin/sh, /bin/ash, /bin/dash, /usr/bin/bash, /usr/bin/zsh, /usr/bin/fish)
  • The agent runs the shell as its own OS user — no privilege escalation
  • A stale session reaper runs every 60s to clean up abandoned sessions

⌨️ beacon start (was beacon master)

The command to start the agent is now beacon start. More intuitive, less jargon. beacon master still works as an alias for backward compatibility — existing scripts and systemd units are unaffected.

🚀 Deploy from beaconinfra dashboard

The device detail page now has a prominent "Deploy" button that opens a dialog where you can enter a project name. Triggers the same deploy flow as a new tag detection.

🛠️ What's included

  • Remote terminal: terminal_open piggyback command, agent-side PTY spawner, cloud WebSocket relay hub
  • Browser terminal UI (xterm.js) with resize support and session status feedback
  • Terminal session API: POST /api/terminal/sessions, GET .../sessions/:id, POST .../sessions/:id/terminate
  • Browser and agent WebSocket endpoints with JWT and btt_ token auth
  • Shell allow-list (gosec G702 fix) — rejects arbitrary $SHELL values
  • Stale session reaper with ExpireStale storage method
  • Structured logging (zerolog) for all terminal events: session create, browser connect, agent connect, relay start, close
  • beacon master → beacon start rename across both repos (agent + cloud), master kept as Cobra alias
  • Deploy dialog on device detail page with project name input
  • Terminal accessible from Remote Access page (device dropdown) and device detail Remote Access tab

📋 What's next

  • Agent binary rebuild required — devices must run this version for terminal to work. Older agents silently ignore the terminal_open command.
  • Terminal sessions are single-user, single-device for now. Multi-tab and session sharing are future work.
  • The deploy dialog currently triggers a device-level deploy. Project-targeted deploy via piggyback commands is planned.

Full Changelog: v0.6.3-remote-ssh...v0.6.4-remote-ssh-access

Full Changelog: v0.6.3-remote-ssh...v0.6.5-remote-tty

What's Changed

Full Changelog: 0.6.6-remote-tty-ha-os-tunnel...v0.6.7-remote-access-passphrase

Contributors

Bajusz15
Assets 8
Loading