Healthcheck
Use these checks to verify that the server’s SSH data path is reachable through each enabled transport.
Prerequisites
Run the checks from a machine that uses the same network path as the agent. Set the host, port, and domain variables to match the deployment. Building the WebSocket and DNS helpers requires the Goauld source tree and Go toolchain.
These healthchecks verify only that the SSH server banner is reachable through a transport. They do not validate agent registration, operator authentication, or an interactive shell.
Direct SSH
nc SERVER_HOST 2222 | grep "SSH-2.0-"
Expected output on success:
TODO_PLACEHOLDER_HERE
SSH over TLS
echo -ne "00000000000000000000000000000000" | timeout 1 openssl s_client -quiet -connect "$TLS_DOMAIN:$TLS_PORT" 2>/dev/null | grep "SSH-2.0-"
Expected output on success:
TODO_PLACEHOLDER_HERE
SSH over WebSocket
Build the helper
go build -o ws-healthcheck ./healthcheck/websocket
Run the check
Establish connection, wait for response, and check for SSH banner:
{ echo "" ; sleep 1; } | ws-healthcheck "wss://$HTTP_DOMAIN/wssh/00000000000000000000000000000000" 2>/dev/null | grep "SSH-2.0-"
Expected output on success:
TODO_PLACEHOLDER_HERE
SSH over DNS
Build the helper
go build -o dns-healthcheck ./healthcheck/dns/dnstt-client
Run the check
{ echo "00000000000000000000000000000000S" ; sleep 1; } | dns-healthcheck -udp "$DNS_SERVER:$DNS_SERVER_PORT" "$DNS_DOMAIN" 2>/dev/null | grep "SSH-2.0-"
Expected output on success:
TODO_PLACEHOLDER_HERE
The S is a tag byte indicating that the payload is SSH traffic.
If a check fails
Confirm that the corresponding server listener is enabled, DNS resolves to the server, firewall rules permit the port and protocol, and any reverse proxy supports the selected transport. Continue with Diagnose an agent.