Services → SSH host

Connect SSH host

A fixed menu of diagnostic commands on a Linux host. Not a shell — the adapter has no free-form command tool and never will.

Tier 2 Private key PEM (or a password) ~5 min profile ssh/diagnostics-read

Setting this up with your own agent? Give it these instructions.

Read-only SSH does not exist; a reviewed command menu does

There is no SSH permission that means "read-only". So Prodpeek ships an adapter

whose entire surface is a fixed list of named commands — df -hP, `journalctl -u

<unit> -n <lines>, docker logs --tail`, and so on — each a hardcoded argv template

with validated arguments. There is no run_command, and the profile records that

refusal explicitly rather than leaving it implied by absence.

Three layers, honestly labelled: the adapter validates and builds the command, the

gateway enforces the same constraints independently before the call reaches it, and

the unix account bounds what those commands can see. The third one is yours to set

up, and it is why this recipe is mostly about the user rather than the key.

Steps

  1. On the host, create a dedicated user:

```bash

sudo adduser --disabled-password --gecos "" diag

```

  1. On your machine, generate a keypair used for nothing else:

```bash

ssh-keygen -t ed25519 -C "prodpeek" -f ~/.ssh/prodpeek_diag

```

  1. Install the public key:

```bash

sudo -u diag mkdir -p /home/diag/.ssh

sudo -u diag tee -a /home/diag/.ssh/authorized_keys < ~/.ssh/prodpeek_diag.pub

sudo -u diag chmod 700 /home/diag/.ssh

sudo -u diag chmod 600 /home/diag/.ssh/authorized_keys

```

  1. Add groups only if you need the tools that require them:

```bash

sudo usermod -aG systemd-journal diag # journal_tail beyond own units

sudo usermod -aG docker diag # docker_* tools — see the warning above

```

  1. In Prodpeek: Services → Add a service → SSH host, URL diag@your-host:22, and paste the private key (~/.ssh/prodpeek_diag, the file without .pub).

If the host rate-limits SSH

A ufw limit rule on 22/tcp allows six new connections per thirty seconds per

source. Prodpeek reuses one authenticated connection per target and opens a new

session per command, so a run of checks no longer trips it — and if something does

get refused, the error says so rather than looking like a dead host.

The cost of that reuse: a pooled connection stays usable for up to

PRODPEEK_SSH_POOL_TTL (300s by default) after you revoke the key. Lower it if that

window matters to you.

Screenshots

The dedicated user's authorized_keys, containing only the Prodpeek key. Screenshot pending — the steps above stand on their own.
The dedicated user's authorized_keys, containing only the Prodpeek key.