Password management

Agent password composition and management

The password authenticates operator connections to the SSH service embedded in the agent. It is separate from the access and admin tokens used by the server’s HTTP APIs.

Quick configuration

Set a static agent password at runtime:

password: PASSWORD_REPLACE_ME
sshd-enabled: true

The equivalent option is --password. See Client authentication for ways to provide the password to tealc.

How authentication works

The password used for an agent connection has two parts:

  • An ephemeral part is generated each time the agent starts and transmitted to the server over the encrypted Socket.IO control channel.
  • An optional static part remains on the agent and is never transmitted to the server.

This lets the server authorize the routed connection while the agent still enforces a secret known only to the operator and target.

Choose the static password source

The static part can come from:

  1. A compile-time default supplied while building the agent.
  2. A runtime CLI, environment, or YAML value that overrides the compiled default.
  3. A randomly generated value printed in the agent log when no static value is configured.

See Variables for precedence and Compile agent for build-time values.

Disable password authentication

Use --disable-password or:

disable-password: true

This overrides compiled and runtime static passwords. Disable the SSH service entirely with --no-sshd-enabled; the control channel can remain connected, but shells and other SSH-backed operator features will not work.

Security notes

  • Do not embed a reusable production password in documentation or a shared build-variable file.
  • Runtime command-line passwords may be visible in process listings; prefer a protected configuration file or interactive client prompt.
  • Agent logs can contain a generated password. Protect and rotate those logs according to the engagement policy.