Harden Desktop SSH key and host trust handling #8

Merged

ochenstarik-ui merged 2 commits from hermes/sprint1-desktop-security into main

2026-07-30 19:36:52 +00:00

ochenstarik-ui commented

2026-07-30 19:29:43 +00:00

(Migrated from github.com)

Summary

materialize DPAPI-protected SSH keys in owner-only DACL session files with crash orphan cleanup
require explicit out-of-band host-key fingerprint confirmation
isolate OpenSSH trust to one endpoint-exclusive pin file and disable alternate trust sources
add Windows ACL, pin rotation, effective OpenSSH config, and contract tests

Verification

Desktop security tests: 6/6 PASS
Desktop x64 Release build: 0 warnings, 0 errors
Windows contracts including real ssh.exe -G: PASS
fresh isolated ad-hoc verification: PASS
independent security review after HIGH repairs: APPROVE, no BLOCKING/HIGH/MEDIUM/LOW findings

Scope

Desktop Sprint 1 P0-3/P0-4 only. Server-side security is delivered separately.

## Summary - materialize DPAPI-protected SSH keys in owner-only DACL session files with crash orphan cleanup - require explicit out-of-band host-key fingerprint confirmation - isolate OpenSSH trust to one endpoint-exclusive pin file and disable alternate trust sources - add Windows ACL, pin rotation, effective OpenSSH config, and contract tests ## Verification - Desktop security tests: 6/6 PASS - Desktop x64 Release build: 0 warnings, 0 errors - Windows contracts including real `ssh.exe -G`: PASS - fresh isolated ad-hoc verification: PASS - independent security review after HIGH repairs: APPROVE, no BLOCKING/HIGH/MEDIUM/LOW findings ## Scope Desktop Sprint 1 P0-3/P0-4 only. Server-side security is delivered separately.