bastion RSSH + other changes

2026-07-29 01:38:41 +03:00 · 2026-06-15 11:56:23 +02:00
parent 22cc1c6a6a
commit 2421c4007b
19 changed files with 549 additions and 53 deletions
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -139,5 +139,9 @@ dependencies {

    implementation 'com.github.mwiede:jsch:0.2.21'

+    implementation 'org.apache.sshd:sshd-core:2.14.0'
+    implementation 'org.apache.sshd:sshd-scp:2.14.0'
+    implementation 'org.slf4j:slf4j-android:1.7.36'
+
    implementation project(':tunnel')
 }
--- a/app/src/main/assets/licenses/combined.html
+++ b/app/src/main/assets/licenses/combined.html
@@ -19,6 +19,7 @@
 <li><b>Google Play In-App Review</b> — Google Play SDK terms</li>
 <li><b>Eclipse Paho MQTT client</b> — Eclipse Public License 1.0 and Eclipse Distribution License 1.0 (dual-licensed)</li>
 <li><b>JSch (mwiede fork)</b> — BSD 3-Clause License (reverse SSH remote access)</li>
+<li><b>Apache MINA SSHD</b> — Apache License 2.0 (embedded local SSH on device for RSSH alpha)</li>
 </ul>

 <h2>JUnit 4</h2>
--- a/app/src/main/java/com/foxx/androidcast/remoteaccess/ReverseSshTunnelBridge.java
+++ b/app/src/main/java/com/foxx/androidcast/remoteaccess/ReverseSshTunnelBridge.java
@@ -42,6 +42,10 @@ public final class ReverseSshTunnelBridge {
            Log.w(TAG, "incomplete RSSH credentials");
            return false;
        }
+        if (!RsshLocalSshServer.start(user, pass, localPort)) {
+            Log.w(TAG, "local SSH on :" + localPort + " failed");
+            return false;
+        }
        CountDownLatch connectedLatch = new CountDownLatch(1);
        AtomicBoolean ok = new AtomicBoolean(false);
        worker = new Thread(() -> {
@@ -54,7 +58,7 @@ public final class ReverseSshTunnelBridge {
                s.setConfig(cfg);
                s.setServerAliveInterval(30_000);
                s.connect(CONNECT_TIMEOUT_MS);
-                s.setPortForwardingR(remotePort, localHost, localPort);
+                s.setPortForwardingR("127.0.0.1", remotePort, localHost, localPort);
                session = s;
                connected.set(true);
                ok.set(true);
@@ -98,6 +102,7 @@ public final class ReverseSshTunnelBridge {
        Session s = session;
        session = null;
        connected.set(false);
+        RsshLocalSshServer.stop();
        if (s != null) {
            try {
                s.disconnect();
--- a/app/src/main/java/com/foxx/androidcast/remoteaccess/RsshLocalSshServer.java
+++ b/app/src/main/java/com/foxx/androidcast/remoteaccess/RsshLocalSshServer.java
@@ -0,0 +1,83 @@
+package com.foxx.androidcast.remoteaccess;
+
+import android.util.Log;
+
+import org.apache.sshd.server.SshServer;
+import org.apache.sshd.server.auth.password.PasswordAuthenticator;
+import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
+import org.apache.sshd.server.shell.ProcessShellFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Embedded SSH on {@code 127.0.0.1:8022} for RSSH reverse forward target.
+ * Operator reaches this via bastion forwarded port (same username/password).
+ */
+public final class RsshLocalSshServer {
+    private static final String TAG = "RsshLocalSsh";
+
+    private static volatile SshServer server;
+    private static volatile String activeUser = "";
+    private static final AtomicBoolean running = new AtomicBoolean(false);
+
+    private RsshLocalSshServer() {}
+
+    public static boolean start(String username, String password, int port) {
+        stop();
+        if (username == null || username.isEmpty() || password == null || password.isEmpty()) {
+            return false;
+        }
+        if (port <= 0 || port > 65535) {
+            port = 8022;
+        }
+        final String user = username;
+        final String pass = password;
+        final int listenPort = port;
+        try {
+            Path hostKey = Files.createTempFile("rssh_host", ".key");
+            hostKey.toFile().deleteOnExit();
+            SshServer sshd = SshServer.setUpDefaultServer();
+            sshd.setHost("127.0.0.1");
+            sshd.setPort(listenPort);
+            sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider(hostKey));
+            sshd.setPasswordAuthenticator((PasswordAuthenticator) (u, p, session) ->
+                    user.equals(u) && pass.equals(p));
+            sshd.setShellFactory(new ProcessShellFactory("/system/bin/sh", "-"));
+            sshd.start();
+            server = sshd;
+            activeUser = user;
+            running.set(true);
+            Log.i(TAG, "local SSH listening 127.0.0.1:" + listenPort + " user=" + user);
+            return true;
+        } catch (Exception e) {
+            Log.w(TAG, "local SSH start failed: " + e.getMessage());
+            stop();
+            return false;
+        }
+    }
+
+    public static void stop() {
+        running.set(false);
+        activeUser = "";
+        SshServer local = server;
+        server = null;
+        if (local != null) {
+            try {
+                local.stop(true);
+            } catch (Exception e) {
+                Log.d(TAG, "local SSH stop: " + e.getMessage());
+            }
+        }
+    }
+
+    public static boolean isRunning() {
+        SshServer local = server;
+        return running.get() && local != null && local.isStarted();
+    }
+
+    public static String activeUsername() {
+        return activeUser != null ? activeUser : "";
+    }
+}
--- a/docs/OPEN_TASKS_GRAPH.md
+++ b/docs/OPEN_TASKS_GRAPH.md
@@ -1,29 +1,8 @@
 # Open tasks — dependency graph

-_Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off graph** (postponed)._
+_Last synced: 2026-06-04 (RSSH full stack on `feature/rssh-alpha`, RA control HTTP, cluster acl0 DNS). **DNS 2.x off graph** (postponed)._

-**Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)
-
---
-
---
-
---
-
---
-
-## Table of contents
-
-<!-- toc -->
- [Removed from graph (done)](#removed-from-graph-done)
- [Postponed / off graph (DNS + mail)](#postponed-off-graph-dns-mail)
- [Priority tiers (open only)](#priority-tiers-open-only)
- [Dependency graph](#dependency-graph)
- [Task index (open)](#task-index-open)
- [Critical path](#critical-path)
-<!-- /toc -->
-
-**Documentation index:** [README.md](README.md)
+**Standing rules:** [../bottomline_reminder.txt](../bottomline_reminder.txt) · **Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)

 ---

@@ -33,13 +12,22 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
 |----|------|
 | **0.1** | Stream dump |
 | **3.x** | Auth register + verify + TOTP + migration `008` |
-| **4.x** | RSSH alpha — BE + Android + JSch |
-| **4.wg** | WG lab — BE `wg0`, FE + **router** DNAT persist |
+| **4.wg** | WG lab — BE `wg0`, FE + router DNAT persist |
 | **RBAC** (core) | Admin panel + lockout clear |
 | **Browser** | JS syntax validated; `validate_be_services.sh` |
-| **1.1 / 1.2** | Graphs drill-down, columns, full-width (`shell--graphs-full`) |
-| **5.3** | RSSH API validate — `test_rssh_api.sh` OK on BE |
+| **1.1 / 1.2** | Graphs drill-down, columns, full-width |
+| **5.3** | RSSH API smoke — `test_rssh_api.sh` |
 | **Infra doc** | `20260608_BE_SERVICES_and_infra.md` + PDF |
+| **RA control** | `:ra_control` HTTP + WebSocket shell + adb JSON `ra_control` block |
+
+---
+
+## In progress (feature/rssh-alpha)
+
+| ID | Owner | Blocker | Status |
+|----|-------|---------|--------|
+| **4.rssh** | Agent | BE `provision_users` + FE stream deploy on PO | **In progress** — mobile MINA :8022, bastion provisioner, linux-sim, docs/tests in repo |
+| **cluster0** | Agent | cast01–03 reachable | **Ongoing** — lab VMs; DNS `c1–c3.acl0.f0xx.org` noted in `cluster.env` |

 ---

@@ -47,7 +35,7 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g

 | ID | Owner | Note |
 |----|-------|------|
-| **2.1–2.4** | Developer | DNS / forwards — **postponed** |
+| **2.1–2.4** | Developer | DNS / forwards — **postponed** (acl0 CNAMEs added for cluster lab only) |
 | **2.5** | Agent | SMTP — frozen |
 | **5.4** (mail) | Agent | Auth mail E2E — frozen |

@@ -58,9 +46,10 @@ _Last synced: 2026-06-08 (post infra/browser/graphs/RSSH fixes). **DNS 2.x off g
 | Tier | IDs | Alpha blocker |
 |------|-----|---------------|
 | **P4** | **5.1 OTA**, **5.2 URLs**, **5.5** RBAC UI soak | **Yes** |
+| **P4b** | **4.rssh** deploy soak | **Yes** (alpha essential) |
 | **P5** | **6.1–6.6** app LAN | LAN alpha |
 | **P9** | **9.x** landing (excl. globe FR) | No |
-| **Post-alpha** | **SFU** relay (`feature/sfu-relay`) | No |
+| **Post-alpha** | **SFU** relay | No |

 ---

@@ -72,6 +61,7 @@ flowchart TB
        OTA["5.1 OTA channel<br/>SVC-OTA · HTTP 400"]
        URL["5.2 device URLs<br/>SVC-URL · legacy host"]
        RBACV["5.5 RBAC UI soak<br/>API ✓"]
+        RSSH["4.rssh full stack<br/>feature/rssh-alpha<br/>Agent"]
    end

    subgraph P5["P5 — app LAN · dev"]
@@ -83,12 +73,16 @@ flowchart TB
        A66["6.6 stream analysis"]
    end

-    subgraph P9["P9 — landing"]
-        L9["9.x hub cards<br/>no globe FR"]
+    subgraph LAB["Lab · cluster0"]
+        C0["cast01–03<br/>c1–c3.acl0.f0xx.org"]
    end

-    subgraph POST["Post-alpha · hidden"]
-        SFU["SFU / Janus relay<br/>feature/sfu-relay"]
+    subgraph P9["P9 — landing"]
+        L9["9.x hub cards"]
+    end
+
+    subgraph POST["Post-alpha"]
+        SFU["SFU / Janus relay"]
    end

    FULL["FULL_ALPHA<br/>no DNS/mail"]
@@ -96,7 +90,9 @@ flowchart TB
    OTA --> FULL
    URL --> FULL
    RBACV --> FULL
+    RSSH --> FULL
    A62 --> FULL
+    C0 -.-> RSSH

    A63 <--> A64
    A65 --> A66
@@ -106,6 +102,7 @@ flowchart TB
    style FULL fill:#1e3a5f,color:#fff
    style OTA fill:#991b1b,color:#fff
    style URL fill:#b45309,color:#fff
+    style RSSH fill:#7c3aed,color:#fff
    style SFU fill:#e5e7eb,color:#374151
 ```

@@ -115,12 +112,14 @@ flowchart TB

 | ID | Owner | Depends on | Status |
 |----|-------|------------|--------|
-| **5.1** | 50/50 | nginx OTA path | **Open** — `SVC-OTA` ticket |
-| **5.2** | 50/50 | — | **Open** — `SVC-URL` / `settings.json` base |
-| **5.5** | Agent | RBAC API ✓ | Light UI soak (optional) |
+| **4.rssh** | Agent | FE stream + BE sshd Match User | **In progress** — repo complete pending deploy soak |
+| **5.1** | 50/50 | nginx OTA path | **Open** |
+| **5.2** | 50/50 | — | **Open** |
+| **5.5** | Agent | RBAC API ✓ | Light UI soak |
 | **6.1–6.6** | Developer (~99%) | 0.1 ✓ | Open |
-| **9.x** | Agent (low) | — | Open (globe out of scope) |
-| **SFU** | Agent | owner spec | Hidden preview on `feature/sfu-relay` |
+| **9.x** | Agent (low) | — | Open |
+| **cluster0** | Agent | NFS/DNS | cast01–03 lab |
+| **SFU** | Agent | owner spec | Hidden |

 ---

@@ -129,9 +128,23 @@ flowchart TB
 ```text
 BLOCKER:  5.1 OTA nginx (/v0/ota/ on apps.f0xx.org) ──┐
 SHARED:   5.2 production URLs (apps not f0xx.org) ─────┼──► FULL_ALPHA
-OPTIONAL: 5.5 RBAC UI click-through ──────────────────┤
-DEV:      6.2 LAN soak ───────────────────────────────┘
+ALPHA:    4.rssh deploy (FE stream + BE sshd + app) ───┤
+OPTIONAL: 5.5 RBAC UI click-through ────────────────────┤
+DEV:      6.2 LAN soak ────────────────────────────────┘

-Off graph:  2.x DNS/mail (postponed)
-Parallel:   6.1/6.3–6.6, 9.x (no globe), SFU post-alpha
+Parallel: cluster0 lab (c1–c3.acl0.f0xx.org), 6.1/6.3–6.6, 9.x, SFU
+Off graph: 2.x DNS/mail (postponed)
 ```
+
+---
+
+## Numbered priority legend (PO overrides AI)
+
+1. **5.1 OTA** — nginx path (PO/dev)
+2. **5.2 URLs** — production base URLs
+3. **4.rssh** — alpha remote access (Agent, `feature/rssh-alpha`)
+4. **5.5 RBAC UI soak** — optional click-through
+5. **6.2 LAN soak** — developer device validation
+6. **cluster0** — cast01–03 integration tests
+7. **6.1 / 6.3–6.6** — app LAN quality
+8. **9.x** — landing polish
--- a/docs/REMOTE_ACCESS_IMPL.md
+++ b/docs/REMOTE_ACCESS_IMPL.md
@@ -186,11 +186,28 @@ bash scripts/init-third-party-submodules.sh   # or ./rebuild.sh (includes init +

 Gradle fails fast if the submodule is missing. VPN runs in `:vpn` (`AndroidCastVpnService` + AIDL); `WireGuardVpnEngine` uses `GoBackend` with TUN fallback in the same process.

+## RSSH alpha (reverse SSH)
+
+| Layer | Component | Notes |
+|-------|-----------|--------|
+| **App** | `ReverseSshTunnelBridge` | JSch outbound `-R 127.0.0.1:<port>:127.0.0.1:8022` |
+| **App** | `RsshLocalSshServer` | Apache MINA SSHD on `127.0.0.1:8022` |
+| **BE** | `RsshSessionProvisioner` / `RsshBastionProvisioner` | DB creds; optional Linux user via `rssh_bastion_user.sh` |
+| **FE** | nginx `stream` | `nginx/rssh-bastion-stream.conf.example` |
+| **Sim** | `examples/rssh/linux-sim/` | Laptop heartbeat + `ssh -R` |
+
+Developer settings → **RSSH** (no VPN dialog). Operator command shown in admin active sessions.
+
+## RA control HTTP (`:ra_control`)
+
+Isolated process: template web UI + sandbox shell when RA session is up. Port/token in `adb.json` `ra_control` block.
+
 ## Tests

 ```bash
 ./gradlew :app:testDebugUnitTest --tests 'com.foxx.androidcast.remoteaccess.*'
-bash examples/crash_reporter/backend/scripts/test_rbac_api.sh
+bash examples/crash_reporter/backend/scripts/test_rssh_unit.sh
+bash examples/crash_reporter/backend/scripts/test_rssh_api.sh
 bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
 BASE=https://apps.f0xx.org/app/androidcast_project/crashes bash examples/crash_reporter/backend/scripts/test_remote_access_api.sh
 BASE=https://apps.f0xx.org/app/androidcast_project/crashes bash examples/crash_reporter/backend/scripts/ra_e2e_cli.sh
--- a/examples/crash_reporter/backend/config/config.example.php
+++ b/examples/crash_reporter/backend/config/config.example.php
@@ -71,6 +71,9 @@ return [
            'local_forward_port' => 8022,
            'remote_port_min' => 18000,
            'remote_port_max' => 18999,
+            // Lab/prod: create ephemeral Match User ra-* on BE sshd (see scripts/rssh_bastion_user.sh)
+            'provision_users' => false,
+            'provision_script' => '', // default: backend/scripts/rssh_bastion_user.sh
        ],
    ],
    // Outbound mail (registration verify, password reset) — see docs/20260607-2FA-email-mobile-auth-flow.md
--- a/examples/crash_reporter/backend/nginx/rssh-bastion-stream.conf.example
+++ b/examples/crash_reporter/backend/nginx/rssh-bastion-stream.conf.example
@@ -0,0 +1,16 @@
+# FE nginx stream — TCP proxy to BE sshd for RSSH bastion (ra.apps.f0xx.org:443).
+# Install on FE (Gentoo); BE runs openssh with Match User ra-* (see sshd_config.d/ra.conf).
+#
+# Include from nginx.conf:
+#   include /etc/nginx/stream.d/rssh-bastion.conf;
+
+upstream rssh_bastion_be {
+    server 10.7.16.128:22;  # artc0 / alpine-be — adjust for cluster/lab
+}
+
+server {
+    listen 443;
+    proxy_pass rssh_bastion_be;
+    proxy_connect_timeout 30s;
+    proxy_timeout 24h;
+}
--- a/examples/crash_reporter/backend/public/assets/js/remote_access.js
+++ b/examples/crash_reporter/backend/public/assets/js/remote_access.js
@@ -598,12 +598,23 @@
        const closeBtn = canOperate()
          ? '<button type="button" class="btn btn-sm" data-close-session="' + esc(s.session_id) + '" data-device="' + esc(s.device_id) + '">Close</button>'
          : '';
+        let endpoint = s.endpoint || '—';
+        if (s.tunnel === 'ssh_reverse' && s.rssh_remote_bind) {
+          endpoint = endpoint + ' → ' + esc(s.rssh_remote_bind);
+        }
+        let operator = '';
+        if (s.rssh_operator) {
+          operator =
+            '<div class="ra-rssh-cmds muted"><code>' +
+            esc(s.rssh_operator.shell || '') +
+            '</code></div>';
+        }
        tr.innerHTML =
          '<td><code>' + esc(s.session_id) + '</code></td>' +
          '<td><code>' + esc(s.device_id) + '</code></td>' +
          '<td>' + esc(s.status) + '</td>' +
          '<td>' + esc(s.tunnel) + '</td>' +
-          '<td>' + esc(s.endpoint || '—') + '</td>' +
+          '<td>' + endpoint + operator + '</td>' +
          '<td>' + closeBtn + '</td>';
        aBody.appendChild(tr);
      });
--- a/examples/crash_reporter/backend/scripts/rssh_bastion_user.sh
+++ b/examples/crash_reporter/backend/scripts/rssh_bastion_user.sh
@@ -0,0 +1,59 @@
+#!/bin/sh
+# Ephemeral RSSH bastion users (Match User ra-* in sshd_config.d/ra.conf).
+# Usage: rssh_bastion_user.sh add|remove USERNAME [PASSWORD]
+set -eu
+
+ACTION="${1:-}"
+USER="${2:-}"
+PASS="${3:-}"
+
+die() {
+  echo "rssh_bastion_user: $*" >&2
+  exit 1
+}
+
+validate_user() {
+  case "$USER" in
+    ra-*)
+      return 0
+      ;;
+    *)
+      die "invalid username (expected ra-* prefix)"
+      ;;
+  esac
+}
+
+cmd_add() {
+  validate_user
+  [ -n "$PASS" ] || die "password required for add"
+  if id "$USER" >/dev/null 2>&1; then
+    echo "$USER:$PASS" | chpasswd
+    exit 0
+  fi
+  if command -v adduser >/dev/null 2>&1; then
+    adduser -D -h /dev/null -s /bin/sh "$USER"
+  elif command -v useradd >/dev/null 2>&1; then
+    useradd -M -s /bin/sh "$USER"
+  else
+    die "no adduser/useradd"
+  fi
+  echo "$USER:$PASS" | chpasswd
+}
+
+cmd_remove() {
+  validate_user
+  if ! id "$USER" >/dev/null 2>&1; then
+    exit 0
+  fi
+  if command -v deluser >/dev/null 2>&1; then
+    deluser "$USER" 2>/dev/null || true
+  elif command -v userdel >/dev/null 2>&1; then
+    userdel "$USER" 2>/dev/null || true
+  fi
+}
+
+case "$ACTION" in
+  add) cmd_add ;;
+  remove) cmd_remove ;;
+  *) die "usage: $0 add|remove USERNAME [PASSWORD]" ;;
+esac
--- a/examples/crash_reporter/backend/scripts/test_rssh_api.sh
+++ b/examples/crash_reporter/backend/scripts/test_rssh_api.sh
@@ -25,6 +25,6 @@ body=$(printf '{"heartbeat":{"type":"ra","status":"enable","device_id":"%s","ran
 curl -sf -X POST -H 'Content-Type: application/json' -d "$body" "$(ra_heartbeat_url)" > /tmp/rssh-connect.json
 grep -q '"action":"connect"' /tmp/rssh-connect.json && echo OK connect
 grep -q 'bastion_host' /tmp/rssh-connect.json && echo OK bastion fields
-grep -q 'remote_port' /tmp/rssh-connect.json && echo OK remote_port
+grep -q 'remote_bind_port' /tmp/rssh-connect.json && echo OK remote_bind_port

 echo "All RSSH API checks passed."
--- a/examples/crash_reporter/backend/scripts/test_rssh_unit.sh
+++ b/examples/crash_reporter/backend/scripts/test_rssh_unit.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Unit checks for RsshSessionProvisioner + RsshBastionProvisioner (no DB).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+export CRASHES_CONFIG="${CRASHES_CONFIG:-$ROOT/config/config.example.php}"
+
+php -r '
+require "'"$ROOT"'/src/bootstrap.php";
+$alloc = RsshSessionProvisioner::allocate("test-session-abc");
+assert($alloc["username"] !== "");
+assert($alloc["remote_bind_port"] >= 18000);
+assert($alloc["local_forward_port"] === 8022);
+$cmds = RsshBastionProvisioner::operatorCommands([
+    "rssh_username" => $alloc["username"],
+    "rssh_remote_port" => $alloc["remote_bind_port"],
+]);
+assert(isset($cmds["shell"]));
+assert(str_contains($cmds["shell"], (string) $alloc["remote_bind_port"]));
+echo "OK RsshSessionProvisioner + operatorCommands\n";
+'
+
+echo "All RSSH PHP unit checks passed."
--- a/examples/crash_reporter/backend/src/RemoteAccessRepository.php
+++ b/examples/crash_reporter/backend/src/RemoteAccessRepository.php
@@ -473,6 +473,10 @@ final class RemoteAccessRepository {
            ];
        }
        $alloc = RsshSessionProvisioner::allocate($sessionId);
+        $bastion = RsshBastionProvisioner::addUser($alloc['username'], $alloc['password']);
+        if (!$bastion['ok']) {
+            throw new RuntimeException((string) ($bastion['error'] ?? 'bastion_user_add_failed'));
+        }
        Database::pdo()->prepare(
            'UPDATE remote_access_sessions SET rssh_bastion_host = ?, rssh_bastion_port = ?, rssh_username = ?, rssh_secret = ?, rssh_remote_port = ?, rssh_local_port = ? WHERE session_id = ?'
        )->execute([
@@ -572,14 +576,18 @@ final class RemoteAccessRepository {

    public static function closeSession(string $sessionId, string $status, string $reason): void {
        $st = Database::pdo()->prepare(
-            'SELECT tunnel, wg_client_public_key FROM remote_access_sessions WHERE session_id = ? LIMIT 1'
+            'SELECT tunnel, wg_client_public_key, rssh_username FROM remote_access_sessions WHERE session_id = ? LIMIT 1'
        );
        $st->execute([$sessionId]);
        $row = $st->fetch(PDO::FETCH_ASSOC);
-        if (is_array($row) && ($row['tunnel'] ?? 'wireguard') === 'wireguard') {
-            $pub = $row['wg_client_public_key'] ?? '';
-            if (is_string($pub) && $pub !== '') {
-                WireGuardPeerProvisioner::removeClientPeer($pub);
+        if (is_array($row)) {
+            if (($row['tunnel'] ?? 'wireguard') === 'wireguard') {
+                $pub = $row['wg_client_public_key'] ?? '';
+                if (is_string($pub) && $pub !== '') {
+                    WireGuardPeerProvisioner::removeClientPeer($pub);
+                }
+            } elseif (($row['tunnel'] ?? '') === 'ssh_reverse') {
+                RsshBastionProvisioner::removeUser((string) ($row['rssh_username'] ?? ''));
            }
        }
        $now = self::nowSql();
@@ -857,12 +865,27 @@ final class RemoteAccessRepository {

        return [
            'devices' => self::listDevicesForDashboard($issuesBase, $projectBase),
-            'active_sessions' => $active,
-            'inactive_sessions' => array_slice($inactive, 0, 50),
+            'active_sessions' => array_map([self::class, 'enrichSessionRow'], $active),
+            'inactive_sessions' => array_map([self::class, 'enrichSessionRow'], array_slice($inactive, 0, 50)),
            'recent_events' => self::listEvents(30),
        ];
    }

+    /** @param array<string, mixed> $row @return array<string, mixed> */
+    private static function enrichSessionRow(array $row): array {
+        if (($row['tunnel'] ?? '') === 'ssh_reverse') {
+            $cmds = RsshBastionProvisioner::operatorCommands($row);
+            if ($cmds !== []) {
+                $row['rssh_operator'] = $cmds;
+            }
+            $remote = (int) ($row['rssh_remote_port'] ?? 0);
+            if ($remote > 0) {
+                $row['rssh_remote_bind'] = '127.0.0.1:' . $remote;
+            }
+        }
+        return $row;
+    }
+
    /** @return list<array<string, mixed>> */
    public static function listDevicesForDashboard(string $issuesBase, string $projectBase): array {
        $devices = self::listDevices();
--- a/examples/crash_reporter/backend/src/RsshBastionProvisioner.php
+++ b/examples/crash_reporter/backend/src/RsshBastionProvisioner.php
@@ -0,0 +1,89 @@
+<?php
+declare(strict_types=1);
+
+/** Ephemeral Linux users on the RSSH bastion (sshd Match User ra-*). */
+final class RsshBastionProvisioner {
+    private function __construct() {
+    }
+
+    public static function isEnabled(): bool {
+        return (bool) cfg('remote_access.rssh.provision_users', false);
+    }
+
+    public static function scriptPath(): string {
+        $configured = trim((string) cfg('remote_access.rssh.provision_script', ''));
+        if ($configured !== '') {
+            return $configured;
+        }
+        return dirname(__DIR__) . '/scripts/rssh_bastion_user.sh';
+    }
+
+    /** @return array{ok:bool,error?:string} */
+    public static function addUser(string $username, string $password): array {
+        $user = self::normalizeUsername($username);
+        if ($user === '') {
+            return ['ok' => false, 'error' => 'invalid_username'];
+        }
+        if (!self::isEnabled()) {
+            return ['ok' => true];
+        }
+        $code = self::runScript('add', $user, $password);
+        if ($code !== 0) {
+            error_log('RsshBastionProvisioner add failed for ' . $user . ' exit=' . $code);
+            return ['ok' => false, 'error' => 'bastion_user_add_failed'];
+        }
+        return ['ok' => true];
+    }
+
+    public static function removeUser(?string $username): void {
+        $user = self::normalizeUsername((string) $username);
+        if ($user === '' || !self::isEnabled()) {
+            return;
+        }
+        $code = self::runScript('remove', $user, '');
+        if ($code !== 0) {
+            error_log('RsshBastionProvisioner remove failed for ' . $user . ' exit=' . $code);
+        }
+    }
+
+    /** Operator command lines once device has connected reverse forward. */
+    public static function operatorCommands(array $session): array {
+        $username = trim((string) ($session['rssh_username'] ?? ''));
+        $remotePort = (int) ($session['rssh_remote_port'] ?? 0);
+        if ($username === '' || $remotePort <= 0) {
+            return [];
+        }
+        $host = '127.0.0.1';
+        return [
+            'shell' => sprintf('ssh -p %d %s@%s', $remotePort, $username, $host),
+            'sftp' => sprintf('sftp -P %d %s@%s', $remotePort, $username, $host),
+            'scp_example' => sprintf('scp -P %d %s@%s:/path/on/device ./', $remotePort, $username, $host),
+        ];
+    }
+
+    private static function normalizeUsername(string $username): string {
+        $user = trim($username);
+        if ($user === '' || !preg_match('/^ra-[a-zA-Z0-9_-]{1,30}$/', $user)) {
+            return '';
+        }
+        return $user;
+    }
+
+    private static function runScript(string $action, string $username, string $password): int {
+        $script = self::scriptPath();
+        if (!is_file($script) || !is_executable($script)) {
+            error_log('RsshBastionProvisioner: script missing or not executable: ' . $script);
+            return 127;
+        }
+        $cmd = escapeshellarg($script) . ' ' . escapeshellarg($action) . ' ' . escapeshellarg($username);
+        if ($action === 'add') {
+            $cmd .= ' ' . escapeshellarg($password);
+        }
+        $out = [];
+        exec($cmd . ' 2>&1', $out, $code);
+        if ($code !== 0 && $out !== []) {
+            error_log('RsshBastionProvisioner: ' . implode("\n", $out));
+        }
+        return (int) $code;
+    }
+}
--- a/examples/crash_reporter/backend/src/bootstrap.php
+++ b/examples/crash_reporter/backend/src/bootstrap.php
@@ -70,6 +70,7 @@ require_once __DIR__ . '/WireGuardPeerProvisioner.php';
 require_once __DIR__ . '/WireGuardAddressPool.php';
 require_once __DIR__ . '/WireGuardTrafficStats.php';
 require_once __DIR__ . '/RsshSessionProvisioner.php';
+require_once __DIR__ . '/RsshBastionProvisioner.php';
 require_once __DIR__ . '/AnalyticsHead.php';

 function cfg(string $key, $default = null) {
--- a/examples/rssh/linux-sim/README.md
+++ b/examples/rssh/linux-sim/README.md
@@ -0,0 +1,42 @@
+# Linux RSSH device/operator simulation
+
+Simulates the **Android RSSH path** on a laptop with real OpenSSH client + optional local `sshd`.
+
+## Prerequisites
+
+- `curl`, `jq`, `sshpass` (for non-interactive sim)
+- Backend reachable (`CRASHES_BASE` or default from `ra_lib.sh`)
+- Admin whitelist + open session for the simulated `device_id`
+
+## Device sim (heartbeat + reverse forward)
+
+```bash
+export CRASHES_BASE="http://cast01.intra.raptor.org/app/androidcast_project/crashes"
+export RA_DEVICE_ID="linux-rssh-lab-01"
+
+# 1) First run registers heartbeat (wait)
+./ra_device_sim.sh
+
+# 2) Whitelist device + open session in admin UI, then:
+export RA_SKIP_ADMIN=1
+./ra_device_sim.sh
+```
+
+## Operator sim (on bastion / BE)
+
+After device sim prints `REMOTE_BIND_PORT` and username:
+
+```bash
+./ra_operator_connect.sh 18022 ra-SESSIONID shell
+./ra_operator_connect.sh 18022 ra-SESSIONID sftp
+```
+
+## Android parity
+
+| Android | Linux sim |
+|---------|-----------|
+| `RemoteAccessService` poll | `ra_ra_post` via `ra_lib.sh` |
+| `RsshLocalSshServer` :8022 | local `sshd -p 8022` |
+| `ReverseSshTunnelBridge` JSch `-R` | `ssh -N -R …` |
+
+See [REMOTE_ACCESS_IMPL.md](../../../docs/REMOTE_ACCESS_IMPL.md) and [20260602_REVERSE_SSH_proposals_summary.md](../../../docs/20260602_REVERSE_SSH_proposals_summary.md).
--- a/examples/rssh/linux-sim/ra_device_sim.sh
+++ b/examples/rssh/linux-sim/ra_device_sim.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Linux laptop simulates Android RSSH device: heartbeat poll + outbound -R + local sshd on 8022.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+BE_SCRIPTS="$(cd "$(dirname "$0")/../../crash_reporter/backend/scripts" && pwd)"
+# shellcheck source=../../crash_reporter/backend/scripts/ra_lib.sh
+source "$BE_SCRIPTS/ra_lib.sh"
+
+DEVICE_ID="${RA_DEVICE_ID:-linux-rssh-$(hostname -s)-$$}"
+RANDOM_ID="${RA_RANDOM:-rssh-linux-$(date +%s)}"
+LOCAL_PORT="${RA_LOCAL_PORT:-8022}"
+WORKDIR="${RA_SIM_WORKDIR:-/tmp/rssh-sim-$$}"
+SSH_PID=""
+DB_PID=""
+
+cleanup() {
+  [ -n "$SSH_PID" ] && kill "$SSH_PID" 2>/dev/null || true
+  [ -n "$DB_PID" ] && kill "$DB_PID" 2>/dev/null || true
+  rm -rf "$WORKDIR"
+}
+trap cleanup EXIT
+
+mkdir -p "$WORKDIR"
+HOST_KEY="$WORKDIR/host_key"
+
+if ! command -v ssh-keygen >/dev/null 2>&1; then
+  echo "openssh client required" >&2
+  exit 1
+fi
+
+echo "== local device SSH on 127.0.0.1:${LOCAL_PORT} =="
+ssh-keygen -t ed25519 -f "$HOST_KEY" -N "" -q
+/usr/sbin/sshd -D -f /dev/null -h "$HOST_KEY" -p "$LOCAL_PORT" -o AuthorizedKeysFile=/dev/null \
+  -o PasswordAuthentication=yes -o PermitRootLogin=no -o UsePAM=no \
+  -o AllowUsers="${RA_SSH_USER:-rssh-sim}" 2>/dev/null &
+DB_PID=$!
+sleep 0.5
+
+echo "== heartbeat enable (tunnel_mode=rssh) =="
+export RA_TUNNEL_MODE=rssh
+ra_ra_post enable "$DEVICE_ID" "$RANDOM_ID" "linux-sim/1.0" >/tmp/rssh-sim-wait.json
+grep -q '"action":"wait"' /tmp/rssh-sim-wait.json && echo OK wait
+
+echo "Operator must whitelist + open session in admin UI, then re-run with RA_SKIP_ADMIN=1"
+if [[ "${RA_SKIP_ADMIN:-}" != "1" ]]; then
+  echo "Set RA_SKIP_ADMIN=1 after whitelisting device_id=$DEVICE_ID"
+  exit 0
+fi
+
+echo "== heartbeat connect =="
+ra_ra_post enable "$DEVICE_ID" "$RANDOM_ID-b" "linux-sim/1.0" >/tmp/rssh-sim-connect.json
+grep -q '"action":"connect"' /tmp/rssh-sim-connect.json || { cat /tmp/rssh-sim-connect.json; exit 1; }
+echo OK connect payload
+
+BASTION="$(ra_json -r '.credentials.bastion_host // empty' /tmp/rssh-sim-connect.json)"
+BPORT="$(ra_json -r '.credentials.bastion_port // 443' /tmp/rssh-sim-connect.json)"
+USER="$(ra_json -r '.credentials.username // empty' /tmp/rssh-sim-connect.json)"
+PASS="$(ra_json -r '.credentials.password // empty' /tmp/rssh-sim-connect.json)"
+RPORT="$(ra_json -r '.credentials.remote_bind_port // 0' /tmp/rssh-sim-connect.json)"
+
+[ -n "$BASTION" ] && [ -n "$USER" ] && [ "$RPORT" -gt 0 ] || { echo "missing credentials"; exit 1; }
+
+echo "== reverse SSH -R 127.0.0.1:${RPORT}:127.0.0.1:${LOCAL_PORT} =="
+sshpass -p "$PASS" ssh -N \
+  -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+  -p "$BPORT" -R "127.0.0.1:${RPORT}:127.0.0.1:${LOCAL_PORT}" \
+  "${USER}@${BASTION}" &
+SSH_PID=$!
+sleep 2
+
+echo "Tunnel up. Operator on bastion:"
+echo "  ssh -p ${RPORT} ${USER}@127.0.0.1"
+echo "Press Ctrl+C to stop."
+wait "$SSH_PID"
--- a/examples/rssh/linux-sim/ra_operator_connect.sh
+++ b/examples/rssh/linux-sim/ra_operator_connect.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Operator-side: SSH/SFTP to forwarded port on bastion (run on BE or jump host).
+set -euo pipefail
+
+RPORT="${1:-}"
+USER="${2:-}"
+MODE="${3:-shell}"
+
+if [ -z "$RPORT" ] || [ -z "$USER" ]; then
+  echo "usage: $0 REMOTE_BIND_PORT RA_USERNAME [shell|sftp]" >&2
+  exit 1
+fi
+
+case "$MODE" in
+  shell)
+    exec ssh -p "$RPORT" -o StrictHostKeyChecking=no "${USER}@127.0.0.1"
+    ;;
+  sftp)
+    exec sftp -P "$RPORT" -o StrictHostKeyChecking=no "${USER}@127.0.0.1"
+    ;;
+  *)
+    echo "unknown mode: $MODE" >&2
+    exit 1
+    ;;
+esac
--- a/orchestration/sim/cluster0/cluster.env
+++ b/orchestration/sim/cluster0/cluster.env
@@ -36,6 +36,12 @@ PUBLIC_ORIGIN=https://apps.f0xx.org
 SHORT_LINKS_PUBLIC_BASE=https://s.f0xx.org
 FE_PROXY_TARGET=cast01.intra.raptor.org:80

+# Lab DNS (2026-06): acl0.f0xx.org + c1–c3.acl0.f0xx.org → FE (cast01–03 cluster)
+ACL0_CNAME=acl0.f0xx.org
+CAST01_PUBLIC=c1.acl0.f0xx.org
+CAST02_PUBLIC=c2.acl0.f0xx.org
+CAST03_PUBLIC=c3.acl0.f0xx.org
+
 EXPECTED_CRASHES_TABLES=16
 EXPECTED_URL_SHORTENER_TABLES=4