feat: add SSH CLI access to PAM revamp

[bernie-g]

Description

Wire SSH account type into the new path-based pam access flow so it starts a local proxy and prints connection info, matching the database proxy pattern.

Type of change

• New feature (non-breaking change which adds functionality)

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-274-feat-add-ssh-cli-access-to-pam-revamp

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[linear]

PAM-271

[greptile-apps]

Greptile Summary

This PR wires the SSH account type into the path-based pam access flow by adding a startSSHAccess handler and printSSHSessionInfo banner, mirroring the existing database proxy pattern. ssh-proxy.go is significantly simplified by removing the previous SSH-client-launching logic in favour of a pure proxy-only mode.

• startSSHAccess follows the same lifecycle as startDatabaseProxy: parse duration, validate metadata, create SSHProxyServer, bind a local port, print connection info, register a signal handler, then block on Run().
• ssh-proxy.go drops SSHAccessOptions, StartSSHLocalProxy, launchSSHClient, waitForSSHCompletion, and the SSH exit-code propagation logic; gracefulShutdown now unconditionally exits 0.
• printSSHSessionInfo has a minor inconsistency where the Examples: header goes to stdout while the actual command lines go to stderr via util.PrintfStderr, matching the same asymmetry in printDatabaseSessionInfo.

Confidence Score: 4/5

The change is a straightforward port of the established database-proxy pattern to SSH; the core logic is correct and the simplification of ssh-proxy.go removes more complexity than it adds.

The SSRF concern (API-supplied relay host + mTLS credentials with no allowlist) is a real structural risk, but it is inherent to the existing proxy design rather than a mistake introduced here. The remaining findings are cosmetic: empty-username guard missing from the banner, mixed stdout/stderr output, and a log line that omits the username. None of these affect runtime correctness of the happy path.

packages/pam/local/access.go — review the printSSHSessionInfo banner and the relay-host origin in startSSHAccess.

Security Review

• SSRF via API-supplied relay host (packages/pam/local/access.go, startSSHAccess): response.RelayHost and all associated mTLS credentials (relayClientCert, relayClientKey, relayServerCertChain) are taken from the PAM API response and used without domain allowlisting. A compromised or intercepted API response could redirect outbound relay connections to an attacker-controlled endpoint; because the certificates are also attacker-supplied, mTLS validation would not mitigate the redirection. This pattern is pre-existing in the database proxy but is now present in the SSH access path as well.

Important Files Changed

Filename	Overview
packages/pam/local/access.go	Added startSSHAccess and printSSHSessionInfo to wire SSH account type into the PAM access flow; minor issues with empty username guard, mixed stdout/stderr output, and missing username in log context.
packages/pam/local/ssh-proxy.go	Significantly simplified — removed the old SSH-client-launching logic (launchSSHClient, waitForSSHCompletion, SSHAccessOptions, StartSSHLocalProxy) and the sshProcess/options/sshExitCode fields; now a clean proxy-only server matching the database proxy pattern.

_{Reviews (1): Last reviewed commit: "feat: add ssh cli access to pam revamp" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10