How an SSH Connection Works

When you run ssh ubuntu@server with a daemon-managed target, these steps occur:

1. OpenSSH loads the target entry generated by nk.
2. OpenSSH invokes nk proxy %h %p.
3. nk finds the target and its certificate authority in local state.
4. nk checks its local user certificate. If it needs a certificate, it asks the core to sign the local public key.
5. nk proxy opens a TCP connection to the daemon’s embedded SSH server (the endpoint the daemon reported to the core, normally the host’s private IP on port 4022).
6. The daemon verifies that the presented user certificate is signed by the trusted CA.
7. The daemon checks the certificate principal (the subject UUID) against its cached principal map for the requested Linux username.
8. On success, the daemon drops privileges and runs the session as that Linux user.

The core is involved in identity and certificate operations, not in the normal SSH byte stream.

What the daemon checks

The daemon accepts only certificate authentication; plain keys are refused. For each login it verifies:

• The certificate is valid and signed by a trusted CA (the CA public key cached from the core).
• The certificate’s validity window and critical options are valid.
• The certificate principal is authorized for the requested Linux username in the local principal cache.

The requested Linux username is checked by the daemon, and the certificate principal is the Nokku subject UUID. Two users can both be authorized for root without sharing an identity.

Manual targets

Manual targets use standard OpenSSH certificate configuration on the system sshd: TrustedUserCAKeys plus AuthorizedPrincipalsFile (or AuthorizedPrincipalsCommand). The authentication model is the same, but the administrator is responsible for keeping the principal files current and configuring the host certificate handling.