Mult Port + TCP Calibration (SSH DEAD)

2026-08-17 17:08:57 -03:00
parent 7ea221a99c
commit b997294607
58 changed files with 6033 additions and 497 deletions
@@ -0,0 +1,854 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"dragontcp/internal/protocol"
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	defaultSSHInternalHost = "dragontcp-ssh.internal"
+	defaultSSHListen       = "127.0.0.1:2222"
+)
+
+type sshUserRecord struct {
+	Username       string    `json:"username"`
+	PasswordHash   string    `json:"password_hash"`
+	ExpiresAt      time.Time `json:"expires_at,omitempty"`
+	MaxConnections int       `json:"max_connections,omitempty"`
+	Disabled       bool      `json:"disabled,omitempty"`
+}
+
+type sshUserFile struct {
+	Version int             `json:"version"`
+	Users   []sshUserRecord `json:"users"`
+}
+
+type sshUserStore struct {
+	path    string
+	mu      sync.RWMutex
+	users   map[string]sshUserRecord
+	modTime time.Time
+}
+
+func newSSHUserStore(path string) *sshUserStore {
+	return &sshUserStore{path: path, users: make(map[string]sshUserRecord)}
+}
+
+func normalizeSSHUsername(v string) string {
+	return strings.TrimSpace(v)
+}
+
+func validateSSHUsername(v string) error {
+	v = normalizeSSHUsername(v)
+	if v == "" {
+		return errors.New("SSH username is required")
+	}
+	if len(v) > 64 {
+		return errors.New("SSH username is too long")
+	}
+	for _, r := range v {
+		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '_' || r == '-' || r == '.' {
+			continue
+		}
+		return fmt.Errorf("SSH username contains unsupported character %q", r)
+	}
+	return nil
+}
+
+func (s *sshUserStore) loadLocked() error {
+	data, err := os.ReadFile(s.path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			s.users = make(map[string]sshUserRecord)
+			s.modTime = time.Time{}
+			return nil
+		}
+		return err
+	}
+	var file sshUserFile
+	if err := json.Unmarshal(data, &file); err != nil {
+		return fmt.Errorf("parse %s: %w", s.path, err)
+	}
+	users := make(map[string]sshUserRecord, len(file.Users))
+	for _, u := range file.Users {
+		u.Username = normalizeSSHUsername(u.Username)
+		if u.Username == "" || u.PasswordHash == "" {
+			continue
+		}
+		users[u.Username] = u
+	}
+	s.users = users
+	if st, err := os.Stat(s.path); err == nil {
+		s.modTime = st.ModTime()
+	}
+	return nil
+}
+
+func (s *sshUserStore) Load() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.loadLocked()
+}
+
+func (s *sshUserStore) reloadIfChanged() error {
+	st, err := os.Stat(s.path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			s.mu.RLock()
+			alreadyEmpty := len(s.users) == 0 && s.modTime.IsZero()
+			s.mu.RUnlock()
+			if alreadyEmpty {
+				return nil
+			}
+			s.mu.Lock()
+			defer s.mu.Unlock()
+			s.users = make(map[string]sshUserRecord)
+			s.modTime = time.Time{}
+			return nil
+		}
+		return err
+	}
+	s.mu.RLock()
+	unchanged := st.ModTime().Equal(s.modTime)
+	s.mu.RUnlock()
+	if unchanged {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if st2, err := os.Stat(s.path); err == nil && st2.ModTime().Equal(s.modTime) {
+		return nil
+	}
+	return s.loadLocked()
+}
+
+func (s *sshUserStore) snapshot() ([]sshUserRecord, error) {
+	if err := s.reloadIfChanged(); err != nil {
+		return nil, err
+	}
+	s.mu.RLock()
+	out := make([]sshUserRecord, 0, len(s.users))
+	for _, u := range s.users {
+		out = append(out, u)
+	}
+	s.mu.RUnlock()
+	sort.Slice(out, func(i, j int) bool { return out[i].Username < out[j].Username })
+	return out, nil
+}
+
+func (s *sshUserStore) get(username string) (sshUserRecord, bool) {
+	_ = s.reloadIfChanged()
+	s.mu.RLock()
+	u, ok := s.users[normalizeSSHUsername(username)]
+	s.mu.RUnlock()
+	return u, ok
+}
+
+func (s *sshUserStore) authenticate(username string, password []byte) (sshUserRecord, error) {
+	if err := s.reloadIfChanged(); err != nil {
+		return sshUserRecord{}, err
+	}
+	s.mu.RLock()
+	u, ok := s.users[normalizeSSHUsername(username)]
+	s.mu.RUnlock()
+	if !ok || u.Disabled {
+		return sshUserRecord{}, errors.New("authentication failed")
+	}
+	if !u.ExpiresAt.IsZero() && time.Now().After(u.ExpiresAt) {
+		return sshUserRecord{}, errors.New("account expired")
+	}
+	if bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), password) != nil {
+		return sshUserRecord{}, errors.New("authentication failed")
+	}
+	return u, nil
+}
+
+func (s *sshUserStore) writeRecords(records []sshUserRecord) error {
+	sort.Slice(records, func(i, j int) bool { return records[i].Username < records[j].Username })
+	file := sshUserFile{Version: 1, Users: records}
+	data, err := json.MarshalIndent(file, "", "  ")
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	dir := filepath.Dir(s.path)
+	if dir != "." && dir != "" {
+		if err := os.MkdirAll(dir, 0700); err != nil {
+			return err
+		}
+	}
+	tmp := s.path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0600); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, s.path); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return s.Load()
+}
+
+func (s *sshUserStore) upsert(username, password string, days, maxConnections int) error {
+	if err := validateSSHUsername(username); err != nil {
+		return err
+	}
+	if password == "" {
+		return errors.New("SSH password is required")
+	}
+	if days < 0 {
+		return errors.New("account lifetime days cannot be negative")
+	}
+	if maxConnections < 0 {
+		return errors.New("max connections cannot be negative")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	var expires time.Time
+	if days > 0 {
+		expires = time.Now().UTC().Add(time.Duration(days) * 24 * time.Hour)
+	}
+	records, err := s.snapshot()
+	if err != nil {
+		return err
+	}
+	updated := false
+	for i := range records {
+		if records[i].Username == normalizeSSHUsername(username) {
+			records[i].PasswordHash = string(hash)
+			records[i].ExpiresAt = expires
+			records[i].MaxConnections = maxConnections
+			records[i].Disabled = false
+			updated = true
+			break
+		}
+	}
+	if !updated {
+		records = append(records, sshUserRecord{
+			Username:       normalizeSSHUsername(username),
+			PasswordHash:   string(hash),
+			ExpiresAt:      expires,
+			MaxConnections: maxConnections,
+		})
+	}
+	return s.writeRecords(records)
+}
+
+func (s *sshUserStore) delete(username string) error {
+	username = normalizeSSHUsername(username)
+	records, err := s.snapshot()
+	if err != nil {
+		return err
+	}
+	out := records[:0]
+	found := false
+	for _, u := range records {
+		if u.Username == username {
+			found = true
+			continue
+		}
+		out = append(out, u)
+	}
+	if !found {
+		return fmt.Errorf("SSH user %q not found", username)
+	}
+	return s.writeRecords(out)
+}
+
+func (s *sshUserStore) setPassword(username, password string) error {
+	username = normalizeSSHUsername(username)
+	if err := validateSSHUsername(username); err != nil {
+		return err
+	}
+	if password == "" {
+		return errors.New("SSH password is required")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	records, err := s.snapshot()
+	if err != nil {
+		return err
+	}
+	for i := range records {
+		if records[i].Username == username {
+			records[i].PasswordHash = string(hash)
+			return s.writeRecords(records)
+		}
+	}
+	return fmt.Errorf("SSH user %q not found", username)
+}
+
+func (s *sshUserStore) updateSettings(username string, days, maxConnections int) error {
+	username = normalizeSSHUsername(username)
+	if err := validateSSHUsername(username); err != nil {
+		return err
+	}
+	if days < 0 {
+		return errors.New("account lifetime days cannot be negative")
+	}
+	if maxConnections < 0 {
+		return errors.New("max connections cannot be negative")
+	}
+	var expires time.Time
+	if days > 0 {
+		expires = time.Now().UTC().Add(time.Duration(days) * 24 * time.Hour)
+	}
+	records, err := s.snapshot()
+	if err != nil {
+		return err
+	}
+	for i := range records {
+		if records[i].Username == username {
+			records[i].ExpiresAt = expires
+			records[i].MaxConnections = maxConnections
+			return s.writeRecords(records)
+		}
+	}
+	return fmt.Errorf("SSH user %q not found", username)
+}
+
+func generateSSHPassword() (string, error) {
+	buf := make([]byte, 18)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}
+
+type sshRuntime struct {
+	store *sshUserStore
+	mu    sync.Mutex
+	conns map[string]int
+}
+
+func newSSHRuntime(store *sshUserStore) *sshRuntime {
+	return &sshRuntime{store: store, conns: make(map[string]int)}
+}
+
+func (r *sshRuntime) acquire(username string) (sshUserRecord, error) {
+	u, ok := r.store.get(username)
+	if !ok || u.Disabled || (!u.ExpiresAt.IsZero() && time.Now().After(u.ExpiresAt)) {
+		return sshUserRecord{}, errors.New("account unavailable")
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if u.MaxConnections > 0 && r.conns[username] >= u.MaxConnections {
+		return sshUserRecord{}, fmt.Errorf("max connections reached (%d)", u.MaxConnections)
+	}
+	r.conns[username]++
+	return u, nil
+}
+
+func (r *sshRuntime) release(username string) {
+	r.mu.Lock()
+	if r.conns[username] <= 1 {
+		delete(r.conns, username)
+	} else {
+		r.conns[username]--
+	}
+	r.mu.Unlock()
+}
+
+func ensureSSHHostSigner(path string) (ssh.Signer, error) {
+	if data, err := os.ReadFile(path); err == nil {
+		return ssh.ParsePrivateKey(data)
+	} else if !os.IsNotExist(err) {
+		return nil, err
+	}
+
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	der, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return nil, err
+	}
+	block := &pem.Block{Type: "PRIVATE KEY", Bytes: der}
+	data := pem.EncodeToMemory(block)
+	dir := filepath.Dir(path)
+	if dir != "." && dir != "" {
+		if err := os.MkdirAll(dir, 0700); err != nil {
+			return nil, err
+		}
+	}
+	if err := os.WriteFile(path, data, 0600); err != nil {
+		return nil, err
+	}
+	return ssh.ParsePrivateKey(data)
+}
+
+type sshDirectTCPIPRequest struct {
+	Host       string
+	Port       uint32
+	OriginHost string
+	OriginPort uint32
+}
+
+func handleSSHDirectTCPIP(newChan ssh.NewChannel, allowPrivate bool, cache *dnsCache, tcpBuffer int) {
+	var req sshDirectTCPIPRequest
+	if err := ssh.Unmarshal(newChan.ExtraData(), &req); err != nil || req.Host == "" || req.Port == 0 || req.Port > 65535 {
+		_ = newChan.Reject(ssh.Prohibited, "bad direct-tcpip request")
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 12*time.Second)
+	defer cancel()
+	var backend net.Conn
+	var err error
+	if internalAddr, ok := lookupSSHOnlyInternalTarget(req.Host, int(req.Port)); ok {
+		d := net.Dialer{Timeout: 10 * time.Second, KeepAlive: 30 * time.Second}
+		backend, err = d.DialContext(ctx, "tcp", internalAddr)
+		if err == nil {
+			protocol.TuneTCP(backend)
+			protocol.TuneTCPBuffer(backend, tcpBuffer)
+		}
+	} else {
+		backend, err = dialTarget(ctx, req.Host, int(req.Port), allowPrivate, cache, tcpBuffer)
+	}
+	if err != nil {
+		_ = newChan.Reject(ssh.ConnectionFailed, "connect failed")
+		return
+	}
+	ch, reqs, err := newChan.Accept()
+	if err != nil {
+		_ = backend.Close()
+		return
+	}
+	go ssh.DiscardRequests(reqs)
+
+	// Preserve TCP half-close semantics. A client may finish uploading while the
+	// destination is still sending a large response, so do not close both sides
+	// merely because one copy direction reached EOF.
+	var relayWG sync.WaitGroup
+	relayWG.Add(2)
+	go func() {
+		defer relayWG.Done()
+		_, _ = io.Copy(backend, ch)
+		if cw, ok := backend.(interface{ CloseWrite() error }); ok {
+			_ = cw.CloseWrite()
+		}
+	}()
+	go func() {
+		defer relayWG.Done()
+		_, _ = io.Copy(ch, backend)
+		if cw, ok := ch.(interface{ CloseWrite() error }); ok {
+			_ = cw.CloseWrite()
+		}
+	}()
+	relayWG.Wait()
+	_ = backend.Close()
+	_ = ch.Close()
+}
+
+func handleSSHDummySession(newChan ssh.NewChannel) {
+	ch, reqs, err := newChan.Accept()
+	if err != nil {
+		return
+	}
+	go func() {
+		defer ch.Close()
+		for req := range reqs {
+			if req.WantReply {
+				_ = req.Reply(false, nil)
+			}
+		}
+	}()
+}
+
+func serveSSHConn(conn net.Conn, cfg *ssh.ServerConfig, runtime *sshRuntime, allowPrivate bool, cache *dnsCache, tcpBuffer int) {
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(20 * time.Second))
+	sshConn, chans, reqs, err := ssh.NewServerConn(conn, cfg)
+	if err != nil {
+		return
+	}
+	_ = conn.SetDeadline(time.Time{})
+	username := sshConn.User()
+	user, err := runtime.acquire(username)
+	if err != nil {
+		log.Printf("fake-ssh rejected user=%q remote=%s: %v", username, sshConn.RemoteAddr(), err)
+		_ = sshConn.Close()
+		return
+	}
+	log.Printf("fake-ssh connected user=%q remote=%s mode=tunnel-only", username, sshConn.RemoteAddr())
+	defer func() {
+		runtime.release(username)
+		log.Printf("fake-ssh disconnected user=%q remote=%s", username, sshConn.RemoteAddr())
+	}()
+	defer sshConn.Close()
+	if !user.ExpiresAt.IsZero() {
+		remaining := time.Until(user.ExpiresAt)
+		if remaining <= 0 {
+			return
+		}
+		expiryTimer := time.AfterFunc(remaining, func() { _ = sshConn.Close() })
+		defer expiryTimer.Stop()
+	}
+	go ssh.DiscardRequests(reqs)
+
+	for newChan := range chans {
+		switch newChan.ChannelType() {
+		case "direct-tcpip":
+			go handleSSHDirectTCPIP(newChan, allowPrivate, cache, tcpBuffer)
+		case "session":
+			go handleSSHDummySession(newChan)
+		default:
+			_ = newChan.Reject(ssh.UnknownChannelType, "unsupported channel type")
+		}
+	}
+}
+
+func startFakeSSH(listenAddr, hostKeyPath string, store *sshUserStore, allowPrivate bool, cache *dnsCache, tcpBuffer int) (net.Listener, string, error) {
+	if err := store.Load(); err != nil {
+		return nil, "", err
+	}
+	signer, err := ensureSSHHostSigner(hostKeyPath)
+	if err != nil {
+		return nil, "", err
+	}
+	runtime := newSSHRuntime(store)
+	cfg := &ssh.ServerConfig{
+		NoClientAuth: false,
+		PasswordCallback: func(meta ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
+			if _, err := store.authenticate(meta.User(), password); err != nil {
+				log.Printf("fake-ssh auth failed user=%q remote=%s", meta.User(), meta.RemoteAddr())
+				return nil, err
+			}
+			return nil, nil
+		},
+	}
+	cfg.AddHostKey(signer)
+
+	ln, err := net.Listen("tcp", listenAddr)
+	if err != nil {
+		return nil, "", err
+	}
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				if errors.Is(err, net.ErrClosed) {
+					return
+				}
+				log.Printf("fake-ssh accept: %v", err)
+				continue
+			}
+			go serveSSHConn(conn, cfg, runtime, allowPrivate, cache, tcpBuffer)
+		}
+	}()
+	return ln, ssh.FingerprintSHA256(signer.PublicKey()), nil
+}
+
+type sshCLIFlags struct {
+	usersPath      *string
+	addUser        *string
+	deleteUser     *string
+	password       *string
+	passwordEnv    *string
+	days           *int
+	maxConnections *int
+	listUsers      *bool
+	menu           *bool
+}
+
+func registerSSHCLIFlags() sshCLIFlags {
+	return sshCLIFlags{
+		usersPath:      flag.String("ssh-users", "dragontcp-users.json", "fake SSH user database JSON path"),
+		addUser:        flag.String("ssh-user-add", "", "create or update an SSH tunnel user, then exit"),
+		deleteUser:     flag.String("ssh-user-delete", "", "delete an SSH tunnel user, then exit"),
+		password:       flag.String("ssh-user-password", "", "password used with --ssh-user-add"),
+		passwordEnv:    flag.String("ssh-user-password-env", "", "environment variable containing password for --ssh-user-add"),
+		days:           flag.Int("ssh-user-days", 0, "account lifetime in days; 0 means no expiry"),
+		maxConnections: flag.Int("ssh-user-max-connections", 1, "maximum simultaneous SSH connections for the account; 0 means unlimited"),
+		listUsers:      flag.Bool("ssh-user-list", false, "list SSH tunnel users, then exit"),
+		menu:           flag.Bool("ssh-menu", false, "interactive SSH tunnel user management menu, then exit"),
+	}
+}
+
+func menuReadLine(reader *bufio.Reader, prompt string) (string, error) {
+	fmt.Print(prompt)
+	line, err := reader.ReadString('\n')
+	if err != nil && !errors.Is(err, io.EOF) {
+		return "", err
+	}
+	return strings.TrimSpace(line), nil
+}
+
+func menuReadInt(reader *bufio.Reader, prompt string, defaultValue, minValue int) (int, error) {
+	for {
+		line, err := menuReadLine(reader, prompt)
+		if err != nil {
+			return 0, err
+		}
+		if line == "" {
+			return defaultValue, nil
+		}
+		v, err := strconv.Atoi(line)
+		if err != nil || v < minValue {
+			fmt.Printf("Enter a number >= %d.\n", minValue)
+			continue
+		}
+		return v, nil
+	}
+}
+
+func printSSHUserList(store *sshUserStore) error {
+	records, err := store.snapshot()
+	if err != nil {
+		return err
+	}
+	if len(records) == 0 {
+		fmt.Println("No SSH tunnel users.")
+		return nil
+	}
+	fmt.Printf("%-22s %-26s %-16s %s\n", "USERNAME", "EXPIRES", "MAX CONNECTIONS", "STATUS")
+	fmt.Printf("%-22s %-26s %-16s %s\n", strings.Repeat("-", 8), strings.Repeat("-", 7), strings.Repeat("-", 15), strings.Repeat("-", 6))
+	now := time.Now()
+	for _, u := range records {
+		expiry := "never"
+		status := "active"
+		if !u.ExpiresAt.IsZero() {
+			expiry = u.ExpiresAt.Local().Format("2006-01-02 15:04 MST")
+			if now.After(u.ExpiresAt) {
+				status = "expired"
+			}
+		}
+		if u.Disabled {
+			status = "disabled"
+		}
+		max := "unlimited"
+		if u.MaxConnections > 0 {
+			max = strconv.Itoa(u.MaxConnections)
+		}
+		fmt.Printf("%-22s %-26s %-16s %s\n", u.Username, expiry, max, status)
+	}
+	return nil
+}
+
+func runSSHUserMenu(store *sshUserStore) error {
+	if err := store.Load(); err != nil {
+		return err
+	}
+	reader := bufio.NewReader(os.Stdin)
+	for {
+		fmt.Println()
+		fmt.Println("========================================")
+		fmt.Println(" DragonTCP SSH Tunnel User Manager")
+		fmt.Println("========================================")
+		fmt.Printf("User database: %s\n\n", store.path)
+		fmt.Println("  1) Create user (automatic password)")
+		fmt.Println("  2) Delete user")
+		fmt.Println("  3) List users")
+		fmt.Println("  4) Reset user password (automatic)")
+		fmt.Println("  5) Renew/edit expiry and connection limit")
+		fmt.Println("  0) Exit")
+		choice, err := menuReadLine(reader, "\nSelect: ")
+		if err != nil {
+			return err
+		}
+		switch choice {
+		case "0", "q", "quit", "exit":
+			return nil
+		case "1":
+			username, err := menuReadLine(reader, "Username: ")
+			if err != nil {
+				return err
+			}
+			if err := validateSSHUsername(username); err != nil {
+				fmt.Printf("Error: %v\n", err)
+				continue
+			}
+			if _, exists := store.get(username); exists {
+				fmt.Printf("User %q already exists. Use option 4 or 5 to change it.\n", username)
+				continue
+			}
+			days, err := menuReadInt(reader, "Days [30, 0 = never expires]: ", 30, 0)
+			if err != nil {
+				return err
+			}
+			maxConnections, err := menuReadInt(reader, "Max connections [1, 0 = unlimited]: ", 1, 0)
+			if err != nil {
+				return err
+			}
+			password, err := generateSSHPassword()
+			if err != nil {
+				fmt.Printf("Error generating password: %v\n", err)
+				continue
+			}
+			if err := store.upsert(username, password, days, maxConnections); err != nil {
+				fmt.Printf("Error: %v\n", err)
+				continue
+			}
+			u, _ := store.get(username)
+			expiry := "never"
+			if !u.ExpiresAt.IsZero() {
+				expiry = u.ExpiresAt.Local().Format("2006-01-02 15:04 MST")
+			}
+			fmt.Println("\nUser created successfully.")
+			fmt.Printf("Username:        %s\n", u.Username)
+			fmt.Printf("Password:        %s\n", password)
+			fmt.Printf("Expires:         %s\n", expiry)
+			fmt.Printf("Max connections: %d\n", u.MaxConnections)
+			fmt.Println("Save the password now. DragonTCP stores only its bcrypt hash and cannot display it later.")
+		case "2":
+			username, err := menuReadLine(reader, "Username to delete: ")
+			if err != nil {
+				return err
+			}
+			if _, exists := store.get(username); !exists {
+				fmt.Printf("User %q not found.\n", normalizeSSHUsername(username))
+				continue
+			}
+			confirm, err := menuReadLine(reader, fmt.Sprintf("Delete %q? [y/N]: ", normalizeSSHUsername(username)))
+			if err != nil {
+				return err
+			}
+			if !strings.EqualFold(confirm, "y") && !strings.EqualFold(confirm, "yes") {
+				fmt.Println("Delete cancelled.")
+				continue
+			}
+			if err := store.delete(username); err != nil {
+				fmt.Printf("Error: %v\n", err)
+				continue
+			}
+			fmt.Printf("User %q deleted.\n", normalizeSSHUsername(username))
+		case "3":
+			if err := printSSHUserList(store); err != nil {
+				fmt.Printf("Error: %v\n", err)
+			}
+		case "4":
+			username, err := menuReadLine(reader, "Username: ")
+			if err != nil {
+				return err
+			}
+			if _, exists := store.get(username); !exists {
+				fmt.Printf("User %q not found.\n", normalizeSSHUsername(username))
+				continue
+			}
+			password, err := generateSSHPassword()
+			if err != nil {
+				fmt.Printf("Error generating password: %v\n", err)
+				continue
+			}
+			if err := store.setPassword(username, password); err != nil {
+				fmt.Printf("Error: %v\n", err)
+				continue
+			}
+			fmt.Printf("New password for %s: %s\n", normalizeSSHUsername(username), password)
+			fmt.Println("Save it now; only the bcrypt hash is stored.")
+		case "5":
+			username, err := menuReadLine(reader, "Username: ")
+			if err != nil {
+				return err
+			}
+			u, exists := store.get(username)
+			if !exists {
+				fmt.Printf("User %q not found.\n", normalizeSSHUsername(username))
+				continue
+			}
+			days, err := menuReadInt(reader, "New lifetime from now in days [30, 0 = never expires]: ", 30, 0)
+			if err != nil {
+				return err
+			}
+			maxDefault := u.MaxConnections
+			maxConnections, err := menuReadInt(reader, fmt.Sprintf("Max connections [%d, 0 = unlimited]: ", maxDefault), maxDefault, 0)
+			if err != nil {
+				return err
+			}
+			if err := store.updateSettings(username, days, maxConnections); err != nil {
+				fmt.Printf("Error: %v\n", err)
+				continue
+			}
+			fmt.Printf("User %q updated. Password was not changed.\n", normalizeSSHUsername(username))
+		default:
+			fmt.Println("Invalid selection.")
+		}
+	}
+}
+
+func handleSSHCLI(flags sshCLIFlags) (bool, error) {
+	store := newSSHUserStore(*flags.usersPath)
+	actions := 0
+	if strings.TrimSpace(*flags.addUser) != "" {
+		actions++
+	}
+	if strings.TrimSpace(*flags.deleteUser) != "" {
+		actions++
+	}
+	if *flags.listUsers {
+		actions++
+	}
+	if *flags.menu {
+		actions++
+	}
+	if actions == 0 {
+		return false, nil
+	}
+	if actions > 1 {
+		return true, errors.New("choose only one of --ssh-menu, --ssh-user-add, --ssh-user-delete, or --ssh-user-list")
+	}
+	if *flags.menu {
+		return true, runSSHUserMenu(store)
+	}
+	if strings.TrimSpace(*flags.addUser) != "" {
+		password := *flags.password
+		if *flags.passwordEnv != "" {
+			password = os.Getenv(*flags.passwordEnv)
+		}
+		if err := store.upsert(*flags.addUser, password, *flags.days, *flags.maxConnections); err != nil {
+			return true, err
+		}
+		u, _ := store.get(*flags.addUser)
+		expiry := "never"
+		if !u.ExpiresAt.IsZero() {
+			expiry = u.ExpiresAt.Format(time.RFC3339)
+		}
+		fmt.Printf("SSH user %s saved (expires=%s max_connections=%d)\n", u.Username, expiry, u.MaxConnections)
+		return true, nil
+	}
+	if strings.TrimSpace(*flags.deleteUser) != "" {
+		if err := store.delete(*flags.deleteUser); err != nil {
+			return true, err
+		}
+		fmt.Printf("SSH user %s deleted\n", normalizeSSHUsername(*flags.deleteUser))
+		return true, nil
+	}
+	records, err := store.snapshot()
+	if err != nil {
+		return true, err
+	}
+	for _, u := range records {
+		expiry := "never"
+		if !u.ExpiresAt.IsZero() {
+			expiry = u.ExpiresAt.Format(time.RFC3339)
+		}
+		fmt.Printf("%s expires=%s max_connections=%d disabled=%t\n", u.Username, expiry, u.MaxConnections, u.Disabled)
+	}
+	return true, nil
+}