Central server

On a central server, records and passwords live in one place; team members connect with their own clients. It is managed with the quicksshd commands on the server and the web panel.

Users

quicksshd user-add alice --key ~/alice.pub --access group:Acme
quicksshd user-add bob --key ~/bob.pub --edit --access vpn:acme --access ssh:web
quicksshd user-add admin --admin --secrets --key ~/admin.pub
quicksshd users
quicksshd passwd alice        # new temporary password for the panel
quicksshd user-remove alice

Permission	Meaning
`--access`	The records they can reach: `*`, `group:NAME`, `vpn:NAME`, `ssh:NAME` (repeatable)
`--edit`	Can add, change and delete the records they can reach
`--secrets`	Can see stored passwords and keys; otherwise only uses them
`--admin`	Sees and changes everything and reads everyone's log

Users connect to the server with their own SSH key; the key can only run quickssh requests and can't open a shell.

Admin panel

quicksshd web --listen 127.0.0.1:8822

The panel has records, users, permissions, the audit log and server settings.

First login: users sign in with their temporary password and must change it.
OTP: users register their authenticator app (TOTP) in the panel.
Settings: OTP requirement, client lock time, panel session time, VPN idle stop time, the external access port range and the agent install script.

The panel speaks plain HTTP. If you expose it to the network, put a TLS-terminating reverse proxy in front of it.

OTP lock

If the admin requires OTP, the client unlocks with the code from the user's authenticator app and locks by itself after the set idle time.

quickssh unlock    # asks for the code
quickssh lock

While locked, the external access and database ports opened for the user close too.

External access ports

When a user opens a VPN's SSH tunnel and proxy, or a database record, the server opens ports just for them and accepts connections only from their current IP address. The default range is 42000–42999 and can be changed in the panel; open this range to your users' networks in the firewall.

Temporary access (agent)

quicksshd agent-setup

The command prints the install commands to run on the target server as the user you connect with. On targets with the agent, every connection gets its own key, which is deleted when the connection closes.

Stopping the server

quicksshd stop    # all VPNs, remote desktops and open ports close
quicksshd start

A stopped server accepts no requests until it is started again.

Moving and image updates

If the path of the server application changed (a move, an image update), rewrite the users' key permissions:

quicksshd sync-keys