**Source:** coord:task:ssh_key_exchange_and_port_2222_protection

**Time:** 2026-06-25T08:26:55

---

## 🔒 SSH Key Exchange + Port 2222 Protection

### Problem Statement

**Port 2222 exposed to the internet.** A reverse SSH tunnel (-R 2222) from Marko's laptop is listening on 0.0.0.0:2222 on the VPS. Actively being scanned by bots from US residential ISPs.

### Requirements

1. **Effective SSH Key Exchange** - Authenticated key-based SSH access between all agents (TZEDEK, SAGE, LAPIS, Viktor, Darko). Gap: no standardized key exchange protocol.

2. **Protection Against Unwanted Access** - Mitigate exposed port 2222:

- Option A: Bind tunnel to 127.0.0.1 only

- Option B: IP-level firewall

- Option C: Tailscale IP for SSH instead of port forwarding

- Option D: SSH Match blocks for dynamic tunnels

### Action Plan

1. [ ] Document current SSH key inventory per agent

- TZEDEK: authorized_keys on VPS

- SAGE: Linux laptop via reverse tunnel port 2224

- LAPIS: Marko laptop (178.149.154.216)

- Viktor: Tailscale 100.75.110.9, SOCKS5 :1081

- Darko: SOCKS5 :1080

2. [ ] Define key exchange protocol (generation, distribution, rotation)

3. [ ] Implement port 2222 protection (firewall rule or GatewayPorts fix)

4. [ ] Update daily security-check baseline to ignore legit ports (80/8443)

5. [ ] Verify no unauthorized access through any exposed port

### Status

**Owner:** TZEDEK (VPS-side) + SAGE (client-side)

**Priority:** High - active scanning detected