**Source:** coord:log:ssh-security:20260625

**Time:** 2026-06-25T20:04:00

---

## SSH Security & Reverse Tunnel — 2026-06-25

### Task: coord:task:master:ssh_key_exchange_and_port_protection

**Actions completed:**

1. ✅ SSH key pair regenerated (Ed25519, sage@marko-Lenovo-G50-80)

2. ✅ ~/.ssh/config verified (VPS direct, Android-direct, Android-relay hosts)

3. ✅ Reverse tunnel: systemd user service (reverse-tunnel.service) — active (running)

4. ✅ VPS port 2224 → laptop:22 — bidirectional verified

5. ✅ Test: from VPS → ssh -p 2224 marko@localhost → laptop ✅

**Laptop SSH security posture:**

- PasswordAuthentication: no

- ChallengeResponseAuthentication: no

- PermitRootLogin: prohibit-password

- PubkeyAuthentication: yes

- Authorized keys: 4 (2×Android, laptop, hermes-vps)

- GatewayPorts: no (prevents public port binding)

**Public key for VPS access (already authorized):**

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB6IpHCrtkv58Roa0ZwYhAj5joiSyrMmIerfM1ep5TI2 sage@marko-Lenovo-G50-80