merge main

client/ssh/auth/auth.go

@@ -0,0 +1,177 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
+)
+
+const (
+	// DefaultUserIDClaim is the default JWT claim used to extract user IDs
+	DefaultUserIDClaim = "sub"
+	// Wildcard is a special user ID that matches all users
+	Wildcard = "*"
+)
+
+var (
+	ErrEmptyUserID           = errors.New("JWT user ID is empty")
+	ErrUserNotAuthorized     = errors.New("user is not authorized to access this peer")
+	ErrNoMachineUserMapping  = errors.New("no authorization mapping for OS user")
+	ErrUserNotMappedToOSUser = errors.New("user is not authorized to login as OS user")
+)
+
+// Authorizer handles SSH fine-grained access control authorization
+type Authorizer struct {
+	// UserIDClaim is the JWT claim to extract the user ID from
+	userIDClaim string
+
+	// authorizedUsers is a list of hashed user IDs authorized to access this peer
+	authorizedUsers []sshuserhash.UserIDHash
+
+	// machineUsers maps OS login usernames to lists of authorized user indexes
+	machineUsers map[string][]uint32
+
+	// mu protects the list of users
+	mu sync.RWMutex
+}
+
+// Config contains configuration for the SSH authorizer
+type Config struct {
+	// UserIDClaim is the JWT claim to extract the user ID from (e.g., "sub", "email")
+	UserIDClaim string
+
+	// AuthorizedUsers is a list of hashed user IDs (FNV-1a 64-bit) authorized to access this peer
+	AuthorizedUsers []sshuserhash.UserIDHash
+
+	// MachineUsers maps OS login usernames to indexes in AuthorizedUsers
+	// If a user wants to login as a specific OS user, their index must be in the corresponding list
+	MachineUsers map[string][]uint32
+}
+
+// NewAuthorizer creates a new SSH authorizer with empty configuration
+func NewAuthorizer() *Authorizer {
+	a := &Authorizer{
+		userIDClaim:  DefaultUserIDClaim,
+		machineUsers: make(map[string][]uint32),
+	}
+
+	return a
+}
+
+// Update updates the authorizer configuration with new values
+func (a *Authorizer) Update(config *Config) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	if config == nil {
+		// Clear authorization
+		a.userIDClaim = DefaultUserIDClaim
+		a.authorizedUsers = []sshuserhash.UserIDHash{}
+		a.machineUsers = make(map[string][]uint32)
+		log.Info("SSH authorization cleared")
+		return
+	}
+
+	userIDClaim := config.UserIDClaim
+	if userIDClaim == "" {
+		userIDClaim = DefaultUserIDClaim
+	}
+	a.userIDClaim = userIDClaim
+
+	// Store authorized users list
+	a.authorizedUsers = config.AuthorizedUsers
+
+	// Store machine users mapping
+	machineUsers := make(map[string][]uint32)
+	for osUser, indexes := range config.MachineUsers {
+		if len(indexes) > 0 {
+			machineUsers[osUser] = indexes
+		}
+	}
+	a.machineUsers = machineUsers
+
+	log.Debugf("SSH auth: updated with %d authorized users, %d machine user mappings",
+		len(config.AuthorizedUsers), len(machineUsers))
+}
+
+// Authorize validates if a user is authorized to login as the specified OS user.
+// Returns a success message describing how authorization was granted, or an error.
+func (a *Authorizer) Authorize(jwtUserID, osUsername string) (string, error) {
+	if jwtUserID == "" {
+		return "", fmt.Errorf("JWT user ID is empty for OS user %q: %w", osUsername, ErrEmptyUserID)
+	}
+
+	// Hash the JWT user ID for comparison
+	hashedUserID, err := sshuserhash.HashUserID(jwtUserID)
+	if err != nil {
+		return "", fmt.Errorf("hash user ID %q for OS user %q: %w", jwtUserID, osUsername, err)
+	}
+
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+
+	// Find the index of this user in the authorized list
+	userIndex, found := a.findUserIndex(hashedUserID)
+	if !found {
+		return "", fmt.Errorf("user %q (hash: %s) not in authorized list for OS user %q: %w", jwtUserID, hashedUserID, osUsername, ErrUserNotAuthorized)
+	}
+
+	return a.checkMachineUserMapping(jwtUserID, osUsername, userIndex)
+}
+
+// checkMachineUserMapping validates if a user's index is authorized for the specified OS user
+// Checks wildcard mapping first, then specific OS user mappings
+func (a *Authorizer) checkMachineUserMapping(jwtUserID, osUsername string, userIndex int) (string, error) {
+	// If wildcard exists and user's index is in the wildcard list, allow access to any OS user
+	if wildcardIndexes, hasWildcard := a.machineUsers[Wildcard]; hasWildcard {
+		if a.isIndexInList(uint32(userIndex), wildcardIndexes) {
+			return fmt.Sprintf("granted via wildcard (index: %d)", userIndex), nil
+		}
+	}
+
+	// Check for specific OS username mapping
+	allowedIndexes, hasMachineUserMapping := a.machineUsers[osUsername]
+	if !hasMachineUserMapping {
+		// No mapping for this OS user - deny by default (fail closed)
+		return "", fmt.Errorf("no machine user mapping for OS user %q (JWT user: %s): %w", osUsername, jwtUserID, ErrNoMachineUserMapping)
+	}
+
+	// Check if user's index is in the allowed indexes for this specific OS user
+	if !a.isIndexInList(uint32(userIndex), allowedIndexes) {
+		return "", fmt.Errorf("user %q not mapped to OS user %q (index: %d): %w", jwtUserID, osUsername, userIndex, ErrUserNotMappedToOSUser)
+	}
+
+	return fmt.Sprintf("granted (index: %d)", userIndex), nil
+}
+
+// GetUserIDClaim returns the JWT claim name used to extract user IDs
+func (a *Authorizer) GetUserIDClaim() string {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	return a.userIDClaim
+}
+
+// findUserIndex finds the index of a hashed user ID in the authorized users list
+// Returns the index and true if found, 0 and false if not found
+func (a *Authorizer) findUserIndex(hashedUserID sshuserhash.UserIDHash) (int, bool) {
+	for i, id := range a.authorizedUsers {
+		if id == hashedUserID {
+			return i, true
+		}
+	}
+	return 0, false
+}
+
+// isIndexInList checks if an index exists in a list of indexes
+func (a *Authorizer) isIndexInList(index uint32, indexes []uint32) bool {
+	for _, idx := range indexes {
+		if idx == index {
+			return true
+		}
+	}
+	return false
+}

client/ssh/auth/auth_test.go

@@ -0,0 +1,612 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/sshauth"
+)
+
+func TestAuthorizer_Authorize_UserNotInList(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up authorized users list with one user
+	authorizedUserHash, err := sshauth.HashUserID("authorized-user")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{authorizedUserHash},
+		MachineUsers:    map[string][]uint32{},
+	}
+	authorizer.Update(config)
+
+	// Try to authorize a different user
+	_, err = authorizer.Authorize("unauthorized-user", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotAuthorized)
+}
+
+func TestAuthorizer_Authorize_UserInList_NoMachineUserRestrictions(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash},
+		MachineUsers:    map[string][]uint32{}, // Empty = deny all (fail closed)
+	}
+	authorizer.Update(config)
+
+	// All attempts should fail when no machine user mappings exist (fail closed)
+	_, err = authorizer.Authorize("user1", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	_, err = authorizer.Authorize("user2", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+}
+
+func TestAuthorizer_Authorize_UserInList_WithMachineUserMapping_Allowed(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+	user3Hash, err := sshauth.HashUserID("user3")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash, user3Hash},
+		MachineUsers: map[string][]uint32{
+			"root":     {0, 1}, // user1 and user2 can access root
+			"postgres": {1, 2}, // user2 and user3 can access postgres
+			"admin":    {0},    // only user1 can access admin
+		},
+	}
+	authorizer.Update(config)
+
+	// user1 (index 0) should access root and admin
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user1", "admin")
+	assert.NoError(t, err)
+
+	// user2 (index 1) should access root and postgres
+	_, err = authorizer.Authorize("user2", "root")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user2", "postgres")
+	assert.NoError(t, err)
+
+	// user3 (index 2) should access postgres
+	_, err = authorizer.Authorize("user3", "postgres")
+	assert.NoError(t, err)
+}
+
+func TestAuthorizer_Authorize_UserInList_WithMachineUserMapping_Denied(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up authorized users list
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+	user3Hash, err := sshauth.HashUserID("user3")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash, user3Hash},
+		MachineUsers: map[string][]uint32{
+			"root":     {0, 1}, // user1 and user2 can access root
+			"postgres": {1, 2}, // user2 and user3 can access postgres
+			"admin":    {0},    // only user1 can access admin
+		},
+	}
+	authorizer.Update(config)
+
+	// user1 (index 0) should NOT access postgres
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+
+	// user2 (index 1) should NOT access admin
+	_, err = authorizer.Authorize("user2", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+
+	// user3 (index 2) should NOT access root
+	_, err = authorizer.Authorize("user3", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+
+	// user3 (index 2) should NOT access admin
+	_, err = authorizer.Authorize("user3", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+}
+
+func TestAuthorizer_Authorize_UserInList_OSUserNotInMapping(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up authorized users list
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers: map[string][]uint32{
+			"root": {0}, // only root is mapped
+		},
+	}
+	authorizer.Update(config)
+
+	// user1 should NOT access an unmapped OS user (fail closed)
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+}
+
+func TestAuthorizer_Authorize_EmptyJWTUserID(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up authorized users list
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers:    map[string][]uint32{},
+	}
+	authorizer.Update(config)
+
+	// Empty user ID should fail
+	_, err = authorizer.Authorize("", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrEmptyUserID)
+}
+
+func TestAuthorizer_Authorize_MultipleUsersInList(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up multiple authorized users
+	userHashes := make([]sshauth.UserIDHash, 10)
+	for i := 0; i < 10; i++ {
+		hash, err := sshauth.HashUserID("user" + string(rune('0'+i)))
+		require.NoError(t, err)
+		userHashes[i] = hash
+	}
+
+	// Create machine user mapping for all users
+	rootIndexes := make([]uint32, 10)
+	for i := 0; i < 10; i++ {
+		rootIndexes[i] = uint32(i)
+	}
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: userHashes,
+		MachineUsers: map[string][]uint32{
+			"root": rootIndexes,
+		},
+	}
+	authorizer.Update(config)
+
+	// All users should be authorized for root
+	for i := 0; i < 10; i++ {
+		_, err := authorizer.Authorize("user"+string(rune('0'+i)), "root")
+		assert.NoError(t, err, "user%d should be authorized", i)
+	}
+
+	// User not in list should fail
+	_, err := authorizer.Authorize("unknown-user", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotAuthorized)
+}
+
+func TestAuthorizer_Update_ClearsConfiguration(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up initial configuration
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers:    map[string][]uint32{"root": {0}},
+	}
+	authorizer.Update(config)
+
+	// user1 should be authorized
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	// Clear configuration
+	authorizer.Update(nil)
+
+	// user1 should no longer be authorized
+	_, err = authorizer.Authorize("user1", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotAuthorized)
+}
+
+func TestAuthorizer_Update_EmptyMachineUsersListEntries(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	// Machine users with empty index lists should be filtered out
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers: map[string][]uint32{
+			"root":     {0},
+			"postgres": {},  // empty list - should be filtered out
+			"admin":    nil, // nil list - should be filtered out
+		},
+	}
+	authorizer.Update(config)
+
+	// root should work
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	// postgres should fail (no mapping)
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	// admin should fail (no mapping)
+	_, err = authorizer.Authorize("user1", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+}
+
+func TestAuthorizer_CustomUserIDClaim(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up with custom user ID claim
+	user1Hash, err := sshauth.HashUserID("user@example.com")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     "email",
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers: map[string][]uint32{
+			"root": {0},
+		},
+	}
+	authorizer.Update(config)
+
+	// Verify the custom claim is set
+	assert.Equal(t, "email", authorizer.GetUserIDClaim())
+
+	// Authorize with email as user ID
+	_, err = authorizer.Authorize("user@example.com", "root")
+	assert.NoError(t, err)
+}
+
+func TestAuthorizer_DefaultUserIDClaim(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Verify default claim
+	assert.Equal(t, DefaultUserIDClaim, authorizer.GetUserIDClaim())
+	assert.Equal(t, "sub", authorizer.GetUserIDClaim())
+
+	// Set up with empty user ID claim (should use default)
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     "", // empty - should use default
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers:    map[string][]uint32{},
+	}
+	authorizer.Update(config)
+
+	// Should fall back to default
+	assert.Equal(t, DefaultUserIDClaim, authorizer.GetUserIDClaim())
+}
+
+func TestAuthorizer_MachineUserMapping_LargeIndexes(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Create a large authorized users list
+	const numUsers = 1000
+	userHashes := make([]sshauth.UserIDHash, numUsers)
+	for i := 0; i < numUsers; i++ {
+		hash, err := sshauth.HashUserID("user" + string(rune(i)))
+		require.NoError(t, err)
+		userHashes[i] = hash
+	}
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: userHashes,
+		MachineUsers: map[string][]uint32{
+			"root": {0, 500, 999}, // first, middle, and last user
+		},
+	}
+	authorizer.Update(config)
+
+	// First user should have access
+	_, err := authorizer.Authorize("user"+string(rune(0)), "root")
+	assert.NoError(t, err)
+
+	// Middle user should have access
+	_, err = authorizer.Authorize("user"+string(rune(500)), "root")
+	assert.NoError(t, err)
+
+	// Last user should have access
+	_, err = authorizer.Authorize("user"+string(rune(999)), "root")
+	assert.NoError(t, err)
+
+	// User not in mapping should NOT have access
+	_, err = authorizer.Authorize("user"+string(rune(100)), "root")
+	assert.Error(t, err)
+}
+
+func TestAuthorizer_ConcurrentAuthorization(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	// Set up authorized users
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash},
+		MachineUsers: map[string][]uint32{
+			"root": {0, 1},
+		},
+	}
+	authorizer.Update(config)
+
+	// Test concurrent authorization calls (should be safe to read concurrently)
+	const numGoroutines = 100
+	errChan := make(chan error, numGoroutines)
+
+	for i := 0; i < numGoroutines; i++ {
+		go func(idx int) {
+			user := "user1"
+			if idx%2 == 0 {
+				user = "user2"
+			}
+			_, err := authorizer.Authorize(user, "root")
+			errChan <- err
+		}(i)
+	}
+
+	// Wait for all goroutines to complete and collect errors
+	for i := 0; i < numGoroutines; i++ {
+		err := <-errChan
+		assert.NoError(t, err)
+	}
+}
+
+func TestAuthorizer_Wildcard_AllowsAllAuthorizedUsers(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+	user3Hash, err := sshauth.HashUserID("user3")
+	require.NoError(t, err)
+
+	// Configure with wildcard - all authorized users can access any OS user
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash, user3Hash},
+		MachineUsers: map[string][]uint32{
+			"*": {0, 1, 2}, // wildcard with all user indexes
+		},
+	}
+	authorizer.Update(config)
+
+	// All authorized users should be able to access any OS user
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user2", "postgres")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user3", "admin")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user1", "ubuntu")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user2", "nginx")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user3", "docker")
+	assert.NoError(t, err)
+}
+
+func TestAuthorizer_Wildcard_UnauthorizedUserStillDenied(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+
+	// Configure with wildcard
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash},
+		MachineUsers: map[string][]uint32{
+			"*": {0},
+		},
+	}
+	authorizer.Update(config)
+
+	// user1 should have access
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	// Unauthorized user should still be denied even with wildcard
+	_, err = authorizer.Authorize("unauthorized-user", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotAuthorized)
+}
+
+func TestAuthorizer_Wildcard_TakesPrecedenceOverSpecificMappings(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+
+	// Configure with both wildcard and specific mappings
+	// Wildcard takes precedence for users in the wildcard index list
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash},
+		MachineUsers: map[string][]uint32{
+			"*":    {0, 1}, // wildcard for both users
+			"root": {0},    // specific mapping that would normally restrict to user1 only
+		},
+	}
+	authorizer.Update(config)
+
+	// Both users should be able to access root via wildcard (takes precedence over specific mapping)
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user2", "root")
+	assert.NoError(t, err)
+
+	// Both users should be able to access any other OS user via wildcard
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.NoError(t, err)
+
+	_, err = authorizer.Authorize("user2", "admin")
+	assert.NoError(t, err)
+}
+
+func TestAuthorizer_NoWildcard_SpecificMappingsOnly(t *testing.T) {
+	authorizer := NewAuthorizer()
+
+	user1Hash, err := sshauth.HashUserID("user1")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+
+	// Configure WITHOUT wildcard - only specific mappings
+	config := &Config{
+		UserIDClaim:     DefaultUserIDClaim,
+		AuthorizedUsers: []sshauth.UserIDHash{user1Hash, user2Hash},
+		MachineUsers: map[string][]uint32{
+			"root":     {0}, // only user1
+			"postgres": {1}, // only user2
+		},
+	}
+	authorizer.Update(config)
+
+	// user1 can access root
+	_, err = authorizer.Authorize("user1", "root")
+	assert.NoError(t, err)
+
+	// user2 can access postgres
+	_, err = authorizer.Authorize("user2", "postgres")
+	assert.NoError(t, err)
+
+	// user1 cannot access postgres
+	_, err = authorizer.Authorize("user1", "postgres")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+
+	// user2 cannot access root
+	_, err = authorizer.Authorize("user2", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotMappedToOSUser)
+
+	// Neither can access unmapped OS users
+	_, err = authorizer.Authorize("user1", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	_, err = authorizer.Authorize("user2", "admin")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+}
+
+func TestAuthorizer_Wildcard_WithPartialIndexes_AllowsAllUsers(t *testing.T) {
+	// This test covers the scenario where wildcard exists with limited indexes.
+	// Only users whose indexes are in the wildcard list can access any OS user via wildcard.
+	// Other users can only access OS users they are explicitly mapped to.
+	authorizer := NewAuthorizer()
+
+	// Create two authorized user hashes (simulating the base64-encoded hashes in the config)
+	wasmHash, err := sshauth.HashUserID("wasm")
+	require.NoError(t, err)
+	user2Hash, err := sshauth.HashUserID("user2")
+	require.NoError(t, err)
+
+	// Configure with wildcard having only index 0, and specific mappings for other OS users
+	config := &Config{
+		UserIDClaim:     "sub",
+		AuthorizedUsers: []sshauth.UserIDHash{wasmHash, user2Hash},
+		MachineUsers: map[string][]uint32{
+			"*":     {0}, // wildcard with only index 0 - only wasm has wildcard access
+			"alice": {1}, // specific mapping for user2
+			"bob":   {1}, // specific mapping for user2
+		},
+	}
+	authorizer.Update(config)
+
+	// wasm (index 0) should access any OS user via wildcard
+	_, err = authorizer.Authorize("wasm", "root")
+	assert.NoError(t, err, "wasm should access root via wildcard")
+
+	_, err = authorizer.Authorize("wasm", "alice")
+	assert.NoError(t, err, "wasm should access alice via wildcard")
+
+	_, err = authorizer.Authorize("wasm", "bob")
+	assert.NoError(t, err, "wasm should access bob via wildcard")
+
+	_, err = authorizer.Authorize("wasm", "postgres")
+	assert.NoError(t, err, "wasm should access postgres via wildcard")
+
+	// user2 (index 1) should only access alice and bob (explicitly mapped), NOT root or postgres
+	_, err = authorizer.Authorize("user2", "alice")
+	assert.NoError(t, err, "user2 should access alice via explicit mapping")
+
+	_, err = authorizer.Authorize("user2", "bob")
+	assert.NoError(t, err, "user2 should access bob via explicit mapping")
+
+	_, err = authorizer.Authorize("user2", "root")
+	assert.Error(t, err, "user2 should NOT access root (not in wildcard indexes)")
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	_, err = authorizer.Authorize("user2", "postgres")
+	assert.Error(t, err, "user2 should NOT access postgres (not explicitly mapped)")
+	assert.ErrorIs(t, err, ErrNoMachineUserMapping)
+
+	// Unauthorized user should still be denied
+	_, err = authorizer.Authorize("user3", "root")
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrUserNotAuthorized, "unauthorized user should be denied")
+}

client/ssh/client.go

@@ -1,118 +0,0 @@
-//go:build !js
-
-package ssh
-
-import (
-	"fmt"
-	"net"
-	"os"
-	"time"
-
-	"golang.org/x/crypto/ssh"
-	"golang.org/x/term"
-)
-
-// Client wraps crypto/ssh Client to simplify usage
-type Client struct {
-	client *ssh.Client
-}
-
-// Close closes the wrapped SSH Client
-func (c *Client) Close() error {
-	return c.client.Close()
-}
-
-// OpenTerminal starts an interactive terminal session with the remote SSH server
-func (c *Client) OpenTerminal() error {
-	session, err := c.client.NewSession()
-	if err != nil {
-		return fmt.Errorf("failed to open new session: %v", err)
-	}
-	defer func() {
-		err := session.Close()
-		if err != nil {
-			return
-		}
-	}()
-
-	fd := int(os.Stdout.Fd())
-	state, err := term.MakeRaw(fd)
-	if err != nil {
-		return fmt.Errorf("failed to run raw terminal: %s", err)
-	}
-	defer func() {
-		err := term.Restore(fd, state)
-		if err != nil {
-			return
-		}
-	}()
-
-	w, h, err := term.GetSize(fd)
-	if err != nil {
-		return fmt.Errorf("terminal get size: %s", err)
-	}
-
-	modes := ssh.TerminalModes{
-		ssh.ECHO:          1,
-		ssh.TTY_OP_ISPEED: 14400,
-		ssh.TTY_OP_OSPEED: 14400,
-	}
-
-	terminal := os.Getenv("TERM")
-	if terminal == "" {
-		terminal = "xterm-256color"
-	}
-	if err := session.RequestPty(terminal, h, w, modes); err != nil {
-		return fmt.Errorf("failed requesting pty session with xterm: %s", err)
-	}
-
-	session.Stdout = os.Stdout
-	session.Stderr = os.Stderr
-	session.Stdin = os.Stdin
-
-	if err := session.Shell(); err != nil {
-		return fmt.Errorf("failed to start login shell on the remote host: %s", err)
-	}
-
-	if err := session.Wait(); err != nil {
-		if e, ok := err.(*ssh.ExitError); ok {
-			if e.ExitStatus() == 130 {
-				return nil
-			}
-		}
-		return fmt.Errorf("failed running SSH session: %s", err)
-	}
-
-	return nil
-}
-
-// DialWithKey connects to the remote SSH server with a provided private key file (PEM).
-func DialWithKey(addr, user string, privateKey []byte) (*Client, error) {
-
-	signer, err := ssh.ParsePrivateKey(privateKey)
-	if err != nil {
-		return nil, err
-	}
-
-	config := &ssh.ClientConfig{
-		User:    user,
-		Timeout: 5 * time.Second,
-		Auth: []ssh.AuthMethod{
-			ssh.PublicKeys(signer),
-		},
-		HostKeyCallback: ssh.HostKeyCallback(func(hostname string, remote net.Addr, key ssh.PublicKey) error { return nil }),
-	}
-
-	return Dial("tcp", addr, config)
-}
-
-// Dial connects to the remote SSH server.
-func Dial(network, addr string, config *ssh.ClientConfig) (*Client, error) {
-	client, err := ssh.Dial(network, addr, config)
-	if err != nil {
-		return nil, err
-	}
-	return &Client{
-		client: client,
-	}, nil
-}

client/ssh/client/client.go

@@ -0,0 +1,705 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
+	"golang.org/x/term"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+	"github.com/netbirdio/netbird/util"
+	"github.com/netbirdio/netbird/util/netrelay"
+)
+
+const (
+	// DefaultDaemonAddr is the default address for the NetBird daemon
+	DefaultDaemonAddr = "unix:///var/run/netbird.sock"
+	// DefaultDaemonAddrWindows is the default address for the NetBird daemon on Windows
+	DefaultDaemonAddrWindows = "tcp://127.0.0.1:41731"
+)
+
+// Client wraps crypto/ssh Client for simplified SSH operations
+type Client struct {
+	client        *ssh.Client
+	terminalState *term.State
+	terminalFd    int
+
+	windowsStdoutMode uint32 // nolint:unused
+	windowsStdinMode  uint32 // nolint:unused
+}
+
+func (c *Client) Close() error {
+	return c.client.Close()
+}
+
+func (c *Client) OpenTerminal(ctx context.Context) error {
+	session, err := c.client.NewSession()
+	if err != nil {
+		return fmt.Errorf("new session: %w", err)
+	}
+	defer func() {
+		if err := session.Close(); err != nil {
+			log.Debugf("session close error: %v", err)
+		}
+	}()
+
+	if err := c.setupTerminalMode(ctx, session); err != nil {
+		return err
+	}
+
+	c.setupSessionIO(session)
+
+	if err := session.Shell(); err != nil {
+		return fmt.Errorf("start shell: %w", err)
+	}
+
+	return c.waitForSession(ctx, session)
+}
+
+// setupSessionIO connects session streams to local terminal
+func (c *Client) setupSessionIO(session *ssh.Session) {
+	session.Stdout = os.Stdout
+	session.Stderr = os.Stderr
+	session.Stdin = os.Stdin
+}
+
+// waitForSession waits for the session to complete with context cancellation
+func (c *Client) waitForSession(ctx context.Context, session *ssh.Session) error {
+	done := make(chan error, 1)
+	go func() {
+		done <- session.Wait()
+	}()
+
+	defer c.restoreTerminal()
+
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case err := <-done:
+		return c.handleSessionError(err)
+	}
+}
+
+// handleSessionError processes session termination errors
+func (c *Client) handleSessionError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var e *ssh.ExitError
+	var em *ssh.ExitMissingError
+	if !errors.As(err, &e) && !errors.As(err, &em) {
+		return fmt.Errorf("session wait: %w", err)
+	}
+
+	return nil
+}
+
+// restoreTerminal restores the terminal to its original state
+func (c *Client) restoreTerminal() {
+	if c.terminalState != nil {
+		_ = term.Restore(c.terminalFd, c.terminalState)
+		c.terminalState = nil
+		c.terminalFd = 0
+	}
+
+	if err := c.restoreWindowsConsoleState(); err != nil {
+		log.Debugf("restore Windows console state: %v", err)
+	}
+}
+
+// ExecuteCommand executes a command on the remote host and returns the output
+func (c *Client) ExecuteCommand(ctx context.Context, command string) ([]byte, error) {
+	session, cleanup, err := c.createSession(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer cleanup()
+
+	output, err := session.CombinedOutput(command)
+	if err != nil {
+		var e *ssh.ExitError
+		var em *ssh.ExitMissingError
+		if !errors.As(err, &e) && !errors.As(err, &em) {
+			return output, fmt.Errorf("execute command: %w", err)
+		}
+	}
+
+	return output, nil
+}
+
+// ExecuteCommandWithIO executes a command with interactive I/O connected to local terminal
+func (c *Client) ExecuteCommandWithIO(ctx context.Context, command string) error {
+	session, cleanup, err := c.createSession(ctx)
+	if err != nil {
+		return fmt.Errorf("create session: %w", err)
+	}
+	defer cleanup()
+
+	c.setupSessionIO(session)
+
+	if err := session.Start(command); err != nil {
+		return fmt.Errorf("start command: %w", err)
+	}
+
+	done := make(chan error, 1)
+	go func() {
+		done <- session.Wait()
+	}()
+
+	select {
+	case <-ctx.Done():
+		_ = session.Signal(ssh.SIGTERM)
+		select {
+		case <-done:
+			return ctx.Err()
+		case <-time.After(100 * time.Millisecond):
+			return ctx.Err()
+		}
+	case err := <-done:
+		return c.handleCommandError(err)
+	}
+}
+
+// ExecuteCommandWithPTY executes a command with a pseudo-terminal for interactive sessions
+func (c *Client) ExecuteCommandWithPTY(ctx context.Context, command string) error {
+	session, cleanup, err := c.createSession(ctx)
+	if err != nil {
+		return fmt.Errorf("create session: %w", err)
+	}
+	defer cleanup()
+
+	if err := c.setupTerminalMode(ctx, session); err != nil {
+		return fmt.Errorf("setup terminal mode: %w", err)
+	}
+
+	c.setupSessionIO(session)
+
+	if err := session.Start(command); err != nil {
+		return fmt.Errorf("start command: %w", err)
+	}
+
+	defer c.restoreTerminal()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- session.Wait()
+	}()
+
+	select {
+	case <-ctx.Done():
+		_ = session.Signal(ssh.SIGTERM)
+		select {
+		case <-done:
+			return ctx.Err()
+		case <-time.After(100 * time.Millisecond):
+			return ctx.Err()
+		}
+	case err := <-done:
+		return c.handleCommandError(err)
+	}
+}
+
+// handleCommandError processes command execution errors
+func (c *Client) handleCommandError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var e *ssh.ExitError
+	var em *ssh.ExitMissingError
+	if errors.As(err, &e) || errors.As(err, &em) {
+		return err
+	}
+
+	return fmt.Errorf("execute command: %w", err)
+}
+
+// setupContextCancellation sets up context cancellation for a session
+func (c *Client) setupContextCancellation(ctx context.Context, session *ssh.Session) func() {
+	done := make(chan struct{})
+	go func() {
+		select {
+		case <-ctx.Done():
+			_ = session.Signal(ssh.SIGTERM)
+			_ = session.Close()
+		case <-done:
+		}
+	}()
+	return func() { close(done) }
+}
+
+// createSession creates a new SSH session with context cancellation setup
+func (c *Client) createSession(ctx context.Context) (*ssh.Session, func(), error) {
+	session, err := c.client.NewSession()
+	if err != nil {
+		return nil, nil, fmt.Errorf("new session: %w", err)
+	}
+
+	cancel := c.setupContextCancellation(ctx, session)
+	cleanup := func() {
+		cancel()
+		_ = session.Close()
+	}
+
+	return session, cleanup, nil
+}
+
+// getDefaultDaemonAddr returns the daemon address from environment or default for the OS
+func getDefaultDaemonAddr() string {
+	if addr := os.Getenv("NB_DAEMON_ADDR"); addr != "" {
+		return addr
+	}
+	if runtime.GOOS == "windows" {
+		return DefaultDaemonAddrWindows
+	}
+	return daemonaddr.ResolveUnixDaemonAddr(DefaultDaemonAddr)
+}
+
+// DialOptions contains options for SSH connections
+type DialOptions struct {
+	KnownHostsFile     string
+	IdentityFile       string
+	DaemonAddr         string
+	SkipCachedToken    bool
+	InsecureSkipVerify bool
+	NoBrowser          bool
+}
+
+// Dial connects to the given ssh server with specified options
+func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, error) {
+	daemonAddr := opts.DaemonAddr
+	if daemonAddr == "" {
+		daemonAddr = getDefaultDaemonAddr()
+	}
+	opts.DaemonAddr = daemonAddr
+
+	hostKeyCallback, err := createHostKeyCallback(opts)
+	if err != nil {
+		return nil, fmt.Errorf("create host key callback: %w", err)
+	}
+
+	config := &ssh.ClientConfig{
+		User:            user,
+		Timeout:         30 * time.Second,
+		HostKeyCallback: hostKeyCallback,
+	}
+
+	if opts.IdentityFile != "" {
+		authMethod, err := createSSHKeyAuth(opts.IdentityFile)
+		if err != nil {
+			return nil, fmt.Errorf("create SSH key auth: %w", err)
+		}
+		config.Auth = append(config.Auth, authMethod)
+	}
+
+	return dialWithJWT(ctx, "tcp", addr, config, daemonAddr, opts.SkipCachedToken, opts.NoBrowser)
+}
+
+// dialSSH establishes an SSH connection without JWT authentication
+func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
+	dialer := &net.Dialer{}
+	conn, err := dialer.DialContext(ctx, network, addr)
+	if err != nil {
+		return nil, fmt.Errorf("dial %s: %w", addr, err)
+	}
+
+	clientConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
+	if err != nil {
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("connection close after handshake failure: %v", closeErr)
+		}
+		return nil, fmt.Errorf("ssh handshake: %w", err)
+	}
+
+	client := ssh.NewClient(clientConn, chans, reqs)
+	return &Client{
+		client: client,
+	}, nil
+}
+
+// dialWithJWT establishes an SSH connection with optional JWT authentication based on server detection
+func dialWithJWT(ctx context.Context, network, addr string, config *ssh.ClientConfig, daemonAddr string, skipCache, noBrowser bool) (*Client, error) {
+	host, portStr, err := net.SplitHostPort(addr)
+	if err != nil {
+		return nil, fmt.Errorf("parse address %s: %w", addr, err)
+	}
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return nil, fmt.Errorf("parse port %s: %w", portStr, err)
+	}
+
+	detectionCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	dialer := &net.Dialer{}
+	serverType, err := detection.DetectSSHServerType(detectionCtx, dialer, host, port)
+	if err != nil {
+		return nil, fmt.Errorf("SSH server detection: %w", err)
+	}
+
+	if !serverType.RequiresJWT() {
+		return dialSSH(ctx, network, addr, config)
+	}
+
+	jwtCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+	defer cancel()
+
+	jwtToken, err := requestJWTToken(jwtCtx, daemonAddr, skipCache, noBrowser)
+	if err != nil {
+		return nil, fmt.Errorf("request JWT token: %w", err)
+	}
+
+	configWithJWT := nbssh.AddJWTAuth(config, jwtToken)
+	return dialSSH(ctx, network, addr, configWithJWT)
+}
+
+// requestJWTToken requests a JWT token from the NetBird daemon
+func requestJWTToken(ctx context.Context, daemonAddr string, skipCache, noBrowser bool) (string, error) {
+	hint := profilemanager.GetLoginHint()
+
+	conn, err := connectToDaemon(daemonAddr)
+	if err != nil {
+		return "", fmt.Errorf("connect to daemon: %w", err)
+	}
+	defer conn.Close()
+
+	client := proto.NewDaemonServiceClient(conn)
+
+	var browserOpener func(string) error
+	if !noBrowser {
+		browserOpener = util.OpenBrowser
+	}
+
+	return nbssh.RequestJWTToken(ctx, client, os.Stdout, os.Stderr, !skipCache, hint, browserOpener)
+}
+
+// verifyHostKeyViaDaemon verifies SSH host key by querying the NetBird daemon
+func verifyHostKeyViaDaemon(hostname string, remote net.Addr, key ssh.PublicKey, daemonAddr string) error {
+	conn, err := connectToDaemon(daemonAddr)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := conn.Close(); err != nil {
+			log.Debugf("daemon connection close error: %v", err)
+		}
+	}()
+
+	client := proto.NewDaemonServiceClient(conn)
+	verifier := nbssh.NewDaemonHostKeyVerifier(client)
+	callback := nbssh.CreateHostKeyCallback(verifier)
+	return callback(hostname, remote, key)
+}
+
+func connectToDaemon(daemonAddr string) (*grpc.ClientConn, error) {
+	addr := strings.TrimPrefix(daemonAddr, "tcp://")
+
+	conn, err := grpc.NewClient(
+		addr,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err != nil {
+		log.Debugf("failed to create gRPC client for NetBird daemon at %s: %v", daemonAddr, err)
+		return nil, fmt.Errorf("failed to connect to NetBird daemon: %w", err)
+	}
+
+	return conn, nil
+}
+
+// getKnownHostsFiles returns paths to known_hosts files in order of preference
+func getKnownHostsFiles() []string {
+	var files []string
+
+	// User's known_hosts file (highest priority)
+	if homeDir, err := os.UserHomeDir(); err == nil {
+		userKnownHosts := filepath.Join(homeDir, ".ssh", "known_hosts")
+		files = append(files, userKnownHosts)
+	}
+
+	// NetBird managed known_hosts files
+	if runtime.GOOS == "windows" {
+		programData := os.Getenv("PROGRAMDATA")
+		if programData == "" {
+			programData = `C:\ProgramData`
+		}
+		netbirdKnownHosts := filepath.Join(programData, "ssh", "ssh_known_hosts.d", "99-netbird")
+		files = append(files, netbirdKnownHosts)
+	} else {
+		files = append(files, "/etc/ssh/ssh_known_hosts.d/99-netbird")
+		files = append(files, "/etc/ssh/ssh_known_hosts")
+	}
+
+	return files
+}
+
+// createHostKeyCallback creates a host key verification callback
+func createHostKeyCallback(opts DialOptions) (ssh.HostKeyCallback, error) {
+	if opts.InsecureSkipVerify {
+		return ssh.InsecureIgnoreHostKey(), nil // #nosec G106 - User explicitly requested insecure mode
+	}
+
+	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		if err := tryDaemonVerification(hostname, remote, key, opts.DaemonAddr); err == nil {
+			return nil
+		}
+		return tryKnownHostsVerification(hostname, remote, key, opts.KnownHostsFile)
+	}, nil
+}
+
+func tryDaemonVerification(hostname string, remote net.Addr, key ssh.PublicKey, daemonAddr string) error {
+	if daemonAddr == "" {
+		return fmt.Errorf("no daemon address")
+	}
+	return verifyHostKeyViaDaemon(hostname, remote, key, daemonAddr)
+}
+
+func tryKnownHostsVerification(hostname string, remote net.Addr, key ssh.PublicKey, knownHostsFile string) error {
+	knownHostsFiles := getKnownHostsFilesList(knownHostsFile)
+	hostKeyCallbacks := buildHostKeyCallbacks(knownHostsFiles)
+
+	for _, callback := range hostKeyCallbacks {
+		if err := callback(hostname, remote, key); err == nil {
+			return nil
+		}
+	}
+	return fmt.Errorf("host key verification failed: key for %s not found in any known_hosts file", hostname)
+}
+
+func getKnownHostsFilesList(knownHostsFile string) []string {
+	if knownHostsFile != "" {
+		return []string{knownHostsFile}
+	}
+	return getKnownHostsFiles()
+}
+
+func buildHostKeyCallbacks(knownHostsFiles []string) []ssh.HostKeyCallback {
+	var hostKeyCallbacks []ssh.HostKeyCallback
+	for _, file := range knownHostsFiles {
+		if callback, err := knownhosts.New(file); err == nil {
+			hostKeyCallbacks = append(hostKeyCallbacks, callback)
+		}
+	}
+	return hostKeyCallbacks
+}
+
+// createSSHKeyAuth creates SSH key authentication from a private key file
+func createSSHKeyAuth(keyFile string) (ssh.AuthMethod, error) {
+	keyData, err := os.ReadFile(keyFile)
+	if err != nil {
+		return nil, fmt.Errorf("read SSH key file %s: %w", keyFile, err)
+	}
+
+	signer, err := ssh.ParsePrivateKey(keyData)
+	if err != nil {
+		return nil, fmt.Errorf("parse SSH private key: %w", err)
+	}
+
+	return ssh.PublicKeys(signer), nil
+}
+
+// LocalPortForward sets up local port forwarding, binding to localAddr and forwarding to remoteAddr
+func (c *Client) LocalPortForward(ctx context.Context, localAddr, remoteAddr string) error {
+	localListener, err := net.Listen("tcp", localAddr)
+	if err != nil {
+		return fmt.Errorf("listen on %s: %w", localAddr, err)
+	}
+
+	go func() {
+		defer func() {
+			if err := localListener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+				log.Debugf("local listener close error: %v", err)
+			}
+		}()
+		for {
+			localConn, err := localListener.Accept()
+			if err != nil {
+				if ctx.Err() != nil {
+					return
+				}
+				continue
+			}
+
+			go c.handleLocalForward(ctx, localConn, remoteAddr)
+		}
+	}()
+
+	<-ctx.Done()
+	if err := localListener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
+		log.Debugf("local listener close error: %v", err)
+	}
+	return ctx.Err()
+}
+
+// handleLocalForward handles a single local port forwarding connection
+func (c *Client) handleLocalForward(ctx context.Context, localConn net.Conn, remoteAddr string) {
+	defer func() {
+		if err := localConn.Close(); err != nil {
+			log.Debugf("local port forwarding: close local connection: %v", err)
+		}
+	}()
+
+	channel, err := c.client.Dial("tcp", remoteAddr)
+	if err != nil {
+		var openErr *ssh.OpenChannelError
+		if errors.As(err, &openErr) && openErr.Reason == ssh.Prohibited {
+			_, _ = fmt.Fprintf(os.Stderr, "channel open failed: port forwarding is disabled\n")
+		} else {
+			log.Debugf("local port forwarding to %s failed: %v", remoteAddr, err)
+		}
+		return
+	}
+	defer func() {
+		if err := channel.Close(); err != nil {
+			log.Debugf("local port forwarding: close remote channel: %v", err)
+		}
+	}()
+
+	netrelay.Relay(ctx, localConn, channel, netrelay.Options{Logger: log.NewEntry(log.StandardLogger())})
+}
+
+// RemotePortForward sets up remote port forwarding, binding on remote and forwarding to localAddr
+func (c *Client) RemotePortForward(ctx context.Context, remoteAddr, localAddr string) error {
+	host, port, err := c.parseRemoteAddress(remoteAddr)
+	if err != nil {
+		return fmt.Errorf("parse remote address: %w", err)
+	}
+
+	req := c.buildTCPIPForwardRequest(host, port)
+	if err := c.sendTCPIPForwardRequest(req); err != nil {
+		return fmt.Errorf("setup remote forward: %w", err)
+	}
+
+	go c.handleRemoteForwardChannels(ctx, localAddr)
+
+	<-ctx.Done()
+
+	if err := c.cancelTCPIPForwardRequest(req); err != nil {
+		return fmt.Errorf("cancel tcpip-forward: %w", err)
+	}
+	return ctx.Err()
+}
+
+// parseRemoteAddress parses host and port from remote address string
+func (c *Client) parseRemoteAddress(remoteAddr string) (string, uint32, error) {
+	host, portStr, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		return "", 0, fmt.Errorf("parse remote address %s: %w", remoteAddr, err)
+	}
+
+	port, err := strconv.Atoi(portStr)
+	if err != nil {
+		return "", 0, fmt.Errorf("parse remote port %s: %w", portStr, err)
+	}
+
+	return host, uint32(port), nil
+}
+
+// buildTCPIPForwardRequest creates a tcpip-forward request message
+func (c *Client) buildTCPIPForwardRequest(host string, port uint32) tcpipForwardMsg {
+	return tcpipForwardMsg{
+		Host: host,
+		Port: port,
+	}
+}
+
+// sendTCPIPForwardRequest sends the tcpip-forward request to establish remote port forwarding
+func (c *Client) sendTCPIPForwardRequest(req tcpipForwardMsg) error {
+	ok, _, err := c.client.SendRequest("tcpip-forward", true, ssh.Marshal(&req))
+	if err != nil {
+		return fmt.Errorf("send tcpip-forward request: %w", err)
+	}
+	if !ok {
+		return fmt.Errorf("remote port forwarding denied by server")
+	}
+	return nil
+}
+
+// cancelTCPIPForwardRequest cancels the tcpip-forward request
+func (c *Client) cancelTCPIPForwardRequest(req tcpipForwardMsg) error {
+	_, _, err := c.client.SendRequest("cancel-tcpip-forward", true, ssh.Marshal(&req))
+	if err != nil {
+		return fmt.Errorf("send cancel-tcpip-forward request: %w", err)
+	}
+	return nil
+}
+
+// handleRemoteForwardChannels handles incoming forwarded-tcpip channels
+func (c *Client) handleRemoteForwardChannels(ctx context.Context, localAddr string) {
+	// Get the channel once - subsequent calls return nil!
+	channelRequests := c.client.HandleChannelOpen("forwarded-tcpip")
+	if channelRequests == nil {
+		log.Debugf("forwarded-tcpip channel type already being handled")
+		return
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case newChan, ok := <-channelRequests:
+			if !ok {
+				return
+			}
+			if newChan != nil {
+				go c.handleRemoteForwardChannel(ctx, newChan, localAddr)
+			}
+		}
+	}
+}
+
+// handleRemoteForwardChannel handles a single forwarded-tcpip channel
+func (c *Client) handleRemoteForwardChannel(ctx context.Context, newChan ssh.NewChannel, localAddr string) {
+	channel, reqs, err := newChan.Accept()
+	if err != nil {
+		return
+	}
+	defer func() {
+		if err := channel.Close(); err != nil {
+			log.Debugf("remote port forwarding: close remote channel: %v", err)
+		}
+	}()
+
+	go ssh.DiscardRequests(reqs)
+
+	// Bound the dial so a black-holed localAddr can't pin the accepted SSH
+	// channel open indefinitely; the relay itself runs under the outer ctx.
+	dialCtx, cancelDial := context.WithTimeout(ctx, 10*time.Second)
+	var dialer net.Dialer
+	localConn, err := dialer.DialContext(dialCtx, "tcp", localAddr)
+	cancelDial()
+	if err != nil {
+		log.Debugf("remote port forwarding: dial %s: %v", localAddr, err)
+		return
+	}
+	defer func() {
+		if err := localConn.Close(); err != nil {
+			log.Debugf("remote port forwarding: close local connection: %v", err)
+		}
+	}()
+
+	netrelay.Relay(ctx, localConn, channel, netrelay.Options{Logger: log.NewEntry(log.StandardLogger())})
+}
+
+// tcpipForwardMsg represents the structure for tcpip-forward requests
+type tcpipForwardMsg struct {
+	Host string
+	Port uint32
+}

client/ssh/client/client_privileged_test.go

@@ -0,0 +1,118 @@
+//go:build privileged
+
+package client
+
+import (
+	"context"
+	"errors"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+)
+
+func TestSSHClient_CommandExecution(t *testing.T) {
+	if runtime.GOOS == "windows" && testutil.IsCI() {
+		t.Skip("Skipping Windows command execution tests in CI due to S4U authentication issues")
+	}
+
+	server, _, client := setupTestSSHServerAndClient(t)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+	defer func() {
+		err := client.Close()
+		assert.NoError(t, err)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	t.Run("ExecuteCommand captures output", func(t *testing.T) {
+		output, err := client.ExecuteCommand(ctx, "echo hello")
+		assert.NoError(t, err)
+		assert.Contains(t, string(output), "hello")
+	})
+
+	t.Run("ExecuteCommandWithIO streams output", func(t *testing.T) {
+		err := client.ExecuteCommandWithIO(ctx, "echo world")
+		assert.NoError(t, err)
+	})
+
+	t.Run("commands with flags work", func(t *testing.T) {
+		output, err := client.ExecuteCommand(ctx, "echo -n test_flag")
+		assert.NoError(t, err)
+		assert.Equal(t, "test_flag", strings.TrimSpace(string(output)))
+	})
+
+	t.Run("non-zero exit codes don't return errors", func(t *testing.T) {
+		var testCmd string
+		if runtime.GOOS == "windows" {
+			testCmd = "echo hello | Select-String notfound"
+		} else {
+			testCmd = "echo 'hello' | grep 'notfound'"
+		}
+		_, err := client.ExecuteCommand(ctx, testCmd)
+		assert.NoError(t, err)
+	})
+}
+
+func TestSSHClient_ContextCancellation(t *testing.T) {
+	server, serverAddr, _ := setupTestSSHServerAndClient(t)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	t.Run("connection with short timeout", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
+		defer cancel()
+
+		currentUser := testutil.GetTestUsername(t)
+		_, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
+		if err != nil {
+			// Check for actual timeout-related errors rather than string matching
+			assert.True(t,
+				errors.Is(err, context.DeadlineExceeded) ||
+					errors.Is(err, context.Canceled) ||
+					strings.Contains(err.Error(), "timeout"),
+				"Expected timeout-related error, got: %v", err)
+		}
+	})
+
+	t.Run("command execution cancellation", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		currentUser := testutil.GetTestUsername(t)
+		client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
+		require.NoError(t, err)
+		defer func() {
+			if err := client.Close(); err != nil {
+				t.Logf("client close error: %v", err)
+			}
+		}()
+
+		cmdCtx, cmdCancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+		defer cmdCancel()
+
+		err = client.ExecuteCommandWithPTY(cmdCtx, "sleep 10")
+		if err != nil {
+			var exitMissingErr *cryptossh.ExitMissingError
+			isValidCancellation := errors.Is(err, context.DeadlineExceeded) ||
+				errors.Is(err, context.Canceled) ||
+				errors.As(err, &exitMissingErr)
+			assert.True(t, isValidCancellation, "Should handle command cancellation properly")
+		}
+	})
+}

client/ssh/client/client_test.go

@@ -0,0 +1,411 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/ssh"
+	sshserver "github.com/netbirdio/netbird/client/ssh/server"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+)
+
+// TestMain handles package-level setup and cleanup
+func TestMain(m *testing.M) {
+	// Guard against infinite recursion when test binary is called as "netbird ssh exec"
+	// This happens when running tests as non-privileged user with fallback
+	if len(os.Args) > 2 && os.Args[1] == "ssh" && os.Args[2] == "exec" {
+		// Just exit with error to break the recursion
+		fmt.Fprintf(os.Stderr, "Test binary called as 'ssh exec' - preventing infinite recursion\n")
+		os.Exit(1)
+	}
+
+	// Run tests
+	code := m.Run()
+
+	// Cleanup any created test users
+	testutil.CleanupTestUsers()
+
+	os.Exit(code)
+}
+
+func TestSSHClient_DialWithKey(t *testing.T) {
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Create and start server
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
+	server.SetAllowRootLogin(true) // Allow root/admin login for tests
+
+	serverAddr := sshserver.StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Test Dial
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	currentUser := testutil.GetTestUsername(t)
+	client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+	defer func() {
+		err := client.Close()
+		assert.NoError(t, err)
+	}()
+
+	// Verify client is connected
+	assert.NotNil(t, client.client)
+}
+
+func TestSSHClient_ConnectionHandling(t *testing.T) {
+	server, serverAddr, _ := setupTestSSHServerAndClient(t)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Generate client key for multiple connections
+
+	const numClients = 3
+	clients := make([]*Client, numClients)
+
+	currentUser := testutil.GetTestUsername(t)
+	for i := 0; i < numClients; i++ {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
+		cancel()
+		require.NoError(t, err, "Client %d should connect successfully", i)
+		clients[i] = client
+	}
+
+	for i, client := range clients {
+		err := client.Close()
+		assert.NoError(t, err, "Client %d should close without error", i)
+	}
+}
+
+func TestSSHClient_NoAuthMode(t *testing.T) {
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
+	server.SetAllowRootLogin(true) // Allow root/admin login for tests
+
+	serverAddr := sshserver.StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	currentUser := testutil.GetTestUsername(t)
+
+	t.Run("any key succeeds in no-auth mode", func(t *testing.T) {
+		client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+			InsecureSkipVerify: true,
+		})
+		assert.NoError(t, err)
+		if client != nil {
+			require.NoError(t, client.Close(), "Client should close without error")
+		}
+	})
+}
+
+func TestSSHClient_TerminalState(t *testing.T) {
+	server, _, client := setupTestSSHServerAndClient(t)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+	defer func() {
+		err := client.Close()
+		assert.NoError(t, err)
+	}()
+
+	assert.Nil(t, client.terminalState)
+	assert.Equal(t, 0, client.terminalFd)
+
+	client.restoreTerminal()
+	assert.Nil(t, client.terminalState)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	err := client.OpenTerminal(ctx)
+	// In test environment without a real terminal, this may complete quickly or timeout
+	// Both behaviors are acceptable for testing terminal state management
+	if err != nil {
+		if runtime.GOOS == "windows" {
+			assert.True(t,
+				strings.Contains(err.Error(), "context deadline exceeded") ||
+					strings.Contains(err.Error(), "console"),
+				"Should timeout or have console error on Windows")
+		} else {
+			// On Unix systems in test environment, we may get various errors
+			// including timeouts or terminal-related errors
+			assert.True(t,
+				strings.Contains(err.Error(), "context deadline exceeded") ||
+					strings.Contains(err.Error(), "terminal") ||
+					strings.Contains(err.Error(), "pty"),
+				"Expected timeout or terminal-related error, got: %v", err)
+		}
+	}
+}
+
+func setupTestSSHServerAndClient(t *testing.T) (*sshserver.Server, string, *Client) {
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
+	server.SetAllowRootLogin(true) // Allow root/admin login for tests
+
+	serverAddr := sshserver.StartTestServer(t, server)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	currentUser := testutil.GetTestUsername(t)
+	client, err := Dial(ctx, serverAddr, currentUser, DialOptions{
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+
+	return server, serverAddr, client
+}
+
+func TestSSHClient_PortForwarding(t *testing.T) {
+	server, _, client := setupTestSSHServerAndClient(t)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+	defer func() {
+		err := client.Close()
+		assert.NoError(t, err)
+	}()
+
+	t.Run("local forwarding times out gracefully", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+		defer cancel()
+
+		err := client.LocalPortForward(ctx, "127.0.0.1:0", "127.0.0.1:8080")
+		assert.Error(t, err)
+		assert.True(t,
+			errors.Is(err, context.DeadlineExceeded) ||
+				errors.Is(err, context.Canceled) ||
+				strings.Contains(err.Error(), "connection"),
+			"Expected context or connection error")
+	})
+
+	t.Run("remote forwarding denied", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+		defer cancel()
+
+		err := client.RemotePortForward(ctx, "127.0.0.1:0", "127.0.0.1:8080")
+		assert.Error(t, err)
+		assert.True(t,
+			strings.Contains(err.Error(), "denied") ||
+				strings.Contains(err.Error(), "disabled"),
+			"Should be denied by default")
+	})
+
+	t.Run("invalid addresses fail", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+		defer cancel()
+
+		err := client.LocalPortForward(ctx, "invalid:address", "127.0.0.1:8080")
+		assert.Error(t, err)
+
+		err = client.LocalPortForward(ctx, "127.0.0.1:0", "invalid:address")
+		assert.Error(t, err)
+	})
+}
+
+func TestSSHClient_PortForwardingDataTransfer(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping data transfer test in short mode")
+	}
+
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &sshserver.Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := sshserver.New(serverConfig)
+	server.SetAllowLocalPortForwarding(true)
+	server.SetAllowRootLogin(true) // Allow root/admin login for tests
+
+	serverAddr := sshserver.StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Port forwarding requires the actual current user, not test user
+	realUser, err := getRealCurrentUser()
+	require.NoError(t, err)
+
+	// Skip if running as system account that can't do port forwarding
+	if testutil.IsSystemAccount(realUser) {
+		t.Skipf("Skipping port forwarding test - running as system account: %s", realUser)
+	}
+
+	client, err := Dial(ctx, serverAddr, realUser, DialOptions{
+		InsecureSkipVerify: true, // Skip host key verification for test
+	})
+	require.NoError(t, err)
+	defer func() {
+		if err := client.Close(); err != nil {
+			t.Logf("client close error: %v", err)
+		}
+	}()
+
+	testServer, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer func() {
+		if err := testServer.Close(); err != nil {
+			t.Logf("test server close error: %v", err)
+		}
+	}()
+
+	testServerAddr := testServer.Addr().String()
+	expectedResponse := "Hello, World!"
+
+	go func() {
+		for {
+			conn, err := testServer.Accept()
+			if err != nil {
+				return
+			}
+			go func(c net.Conn) {
+				defer func() {
+					if err := c.Close(); err != nil {
+						t.Logf("connection close error: %v", err)
+					}
+				}()
+				buf := make([]byte, 1024)
+				if _, err := c.Read(buf); err != nil {
+					t.Logf("connection read error: %v", err)
+					return
+				}
+				if _, err := c.Write([]byte(expectedResponse)); err != nil {
+					t.Logf("connection write error: %v", err)
+				}
+			}(conn)
+		}
+	}()
+
+	localListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	localAddr := localListener.Addr().String()
+	if err := localListener.Close(); err != nil {
+		t.Logf("local listener close error: %v", err)
+	}
+
+	ctx, cancel = context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	go func() {
+		err := client.LocalPortForward(ctx, localAddr, testServerAddr)
+		if err != nil && !errors.Is(err, context.Canceled) {
+			if isWindowsPrivilegeError(err) {
+				t.Logf("Port forward failed due to Windows privilege restrictions: %v", err)
+			} else {
+				t.Logf("Port forward error: %v", err)
+			}
+		}
+	}()
+
+	time.Sleep(100 * time.Millisecond)
+
+	conn, err := net.DialTimeout("tcp", localAddr, 2*time.Second)
+	require.NoError(t, err)
+	defer func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("connection close error: %v", err)
+		}
+	}()
+
+	_, err = conn.Write([]byte("test"))
+	require.NoError(t, err)
+
+	if err := conn.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+		t.Logf("set read deadline error: %v", err)
+	}
+	response := make([]byte, len(expectedResponse))
+	n, err := io.ReadFull(conn, response)
+	require.NoError(t, err)
+	assert.Equal(t, len(expectedResponse), n)
+	assert.Equal(t, expectedResponse, string(response))
+}
+
+// getRealCurrentUser returns the actual current user (not test user) for features like port forwarding
+func getRealCurrentUser() (string, error) {
+	if runtime.GOOS == "windows" {
+		if currentUser, err := user.Current(); err == nil {
+			return currentUser.Username, nil
+		}
+	}
+
+	if username := os.Getenv("USER"); username != "" {
+		return username, nil
+	}
+
+	if currentUser, err := user.Current(); err == nil {
+		return currentUser.Username, nil
+	}
+
+	return "", fmt.Errorf("unable to determine current user")
+}
+
+// isWindowsPrivilegeError checks if an error is related to Windows privilege restrictions
+func isWindowsPrivilegeError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	errStr := strings.ToLower(err.Error())
+	return strings.Contains(errStr, "ntstatus=0xc0000062") || // STATUS_PRIVILEGE_NOT_HELD
+		strings.Contains(errStr, "0xc0000041") || // STATUS_PRIVILEGE_NOT_HELD (LsaRegisterLogonProcess)
+		strings.Contains(errStr, "0xc0000062") || // STATUS_PRIVILEGE_NOT_HELD (LsaLogonUser)
+		strings.Contains(errStr, "privilege") ||
+		strings.Contains(errStr, "access denied") ||
+		strings.Contains(errStr, "user authentication failed")
+}

client/ssh/client/terminal_unix.go

@@ -0,0 +1,127 @@
+//go:build !windows
+
+package client
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/term"
+)
+
+func (c *Client) setupTerminalMode(ctx context.Context, session *ssh.Session) error {
+	stdinFd := int(os.Stdin.Fd())
+
+	if !term.IsTerminal(stdinFd) {
+		return c.setupNonTerminalMode(ctx, session)
+	}
+
+	fd := int(os.Stdin.Fd())
+
+	state, err := term.MakeRaw(fd)
+	if err != nil {
+		return c.setupNonTerminalMode(ctx, session)
+	}
+
+	if err := c.setupTerminal(session, fd); err != nil {
+		if restoreErr := term.Restore(fd, state); restoreErr != nil {
+			log.Debugf("restore terminal state: %v", restoreErr)
+		}
+		return err
+	}
+
+	c.terminalState = state
+	c.terminalFd = fd
+
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
+
+	go func() {
+		defer signal.Stop(sigChan)
+		select {
+		case <-ctx.Done():
+			if err := term.Restore(fd, state); err != nil {
+				log.Debugf("restore terminal state: %v", err)
+			}
+		case sig := <-sigChan:
+			if err := term.Restore(fd, state); err != nil {
+				log.Debugf("restore terminal state: %v", err)
+			}
+			signal.Reset(sig)
+			s, ok := sig.(syscall.Signal)
+			if !ok {
+				log.Debugf("signal %v is not a syscall.Signal: %T", sig, sig)
+				return
+			}
+			if err := syscall.Kill(syscall.Getpid(), s); err != nil {
+				log.Debugf("kill process with signal %v: %v", s, err)
+			}
+		}
+	}()
+
+	return nil
+}
+
+func (c *Client) setupNonTerminalMode(_ context.Context, session *ssh.Session) error {
+	return nil
+}
+
+// restoreWindowsConsoleState is a no-op on Unix systems
+func (c *Client) restoreWindowsConsoleState() error {
+	return nil
+}
+
+func (c *Client) setupTerminal(session *ssh.Session, fd int) error {
+	w, h, err := term.GetSize(fd)
+	if err != nil {
+		return fmt.Errorf("get terminal size: %w", err)
+	}
+
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		// Ctrl+C
+		ssh.VINTR: 3,
+		// Ctrl+\
+		ssh.VQUIT: 28,
+		// Backspace
+		ssh.VERASE: 127,
+		// Ctrl+U
+		ssh.VKILL: 21,
+		// Ctrl+D
+		ssh.VEOF:  4,
+		ssh.VEOL:  0,
+		ssh.VEOL2: 0,
+		// Ctrl+Q
+		ssh.VSTART: 17,
+		// Ctrl+S
+		ssh.VSTOP: 19,
+		// Ctrl+Z
+		ssh.VSUSP: 26,
+		// Ctrl+O
+		ssh.VDISCARD: 15,
+		// Ctrl+R
+		ssh.VREPRINT: 18,
+		// Ctrl+W
+		ssh.VWERASE: 23,
+		// Ctrl+V
+		ssh.VLNEXT: 22,
+	}
+
+	terminal := os.Getenv("TERM")
+	if terminal == "" {
+		terminal = "xterm-256color"
+	}
+
+	if err := session.RequestPty(terminal, h, w, modes); err != nil {
+		return fmt.Errorf("request pty: %w", err)
+	}
+
+	return nil
+}

client/ssh/client/terminal_windows.go

@@ -0,0 +1,265 @@
+package client
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	enableProcessedInput            = 0x0001
+	enableLineInput                 = 0x0002
+	enableEchoInput                 = 0x0004 // Input mode: ENABLE_ECHO_INPUT
+	enableVirtualTerminalProcessing = 0x0004 // Output mode: ENABLE_VIRTUAL_TERMINAL_PROCESSING (same value, different mode)
+	enableVirtualTerminalInput      = 0x0200
+)
+
+var (
+	kernel32                       = syscall.NewLazyDLL("kernel32.dll")
+	procGetConsoleMode             = kernel32.NewProc("GetConsoleMode")
+	procSetConsoleMode             = kernel32.NewProc("SetConsoleMode")
+	procGetConsoleScreenBufferInfo = kernel32.NewProc("GetConsoleScreenBufferInfo")
+)
+
+// ConsoleUnavailableError indicates that Windows console handles are not available
+// (e.g., in CI environments where stdout/stdin are redirected)
+type ConsoleUnavailableError struct {
+	Operation string
+	Err       error
+}
+
+func (e *ConsoleUnavailableError) Error() string {
+	return fmt.Sprintf("console unavailable for %s: %v", e.Operation, e.Err)
+}
+
+func (e *ConsoleUnavailableError) Unwrap() error {
+	return e.Err
+}
+
+type coord struct {
+	x, y int16
+}
+
+type smallRect struct {
+	left, top, right, bottom int16
+}
+
+type consoleScreenBufferInfo struct {
+	size              coord
+	cursorPosition    coord
+	attributes        uint16
+	window            smallRect
+	maximumWindowSize coord
+}
+
+func (c *Client) setupTerminalMode(_ context.Context, session *ssh.Session) error {
+	if err := c.saveWindowsConsoleState(); err != nil {
+		var consoleErr *ConsoleUnavailableError
+		if errors.As(err, &consoleErr) {
+			log.Debugf("console unavailable, not requesting PTY: %v", err)
+			return nil
+		}
+		return fmt.Errorf("save console state: %w", err)
+	}
+
+	if err := c.enableWindowsVirtualTerminal(); err != nil {
+		var consoleErr *ConsoleUnavailableError
+		if errors.As(err, &consoleErr) {
+			log.Debugf("virtual terminal unavailable: %v", err)
+		} else {
+			return fmt.Errorf("failed to enable virtual terminal: %w", err)
+		}
+	}
+
+	w, h := c.getWindowsConsoleSize()
+
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.ICRNL:         1,
+		ssh.OPOST:         1,
+		ssh.ONLCR:         1,
+		ssh.ISIG:          1,
+		ssh.ICANON:        1,
+		ssh.VINTR:         3,   // Ctrl+C
+		ssh.VQUIT:         28,  // Ctrl+\
+		ssh.VERASE:        127, // Backspace
+		ssh.VKILL:         21,  // Ctrl+U
+		ssh.VEOF:          4,   // Ctrl+D
+		ssh.VEOL:          0,
+		ssh.VEOL2:         0,
+		ssh.VSTART:        17, // Ctrl+Q
+		ssh.VSTOP:         19, // Ctrl+S
+		ssh.VSUSP:         26, // Ctrl+Z
+		ssh.VDISCARD:      15, // Ctrl+O
+		ssh.VWERASE:       23, // Ctrl+W
+		ssh.VLNEXT:        22, // Ctrl+V
+		ssh.VREPRINT:      18, // Ctrl+R
+	}
+
+	if err := session.RequestPty("xterm-256color", h, w, modes); err != nil {
+		if restoreErr := c.restoreWindowsConsoleState(); restoreErr != nil {
+			log.Debugf("restore Windows console state: %v", restoreErr)
+		}
+		return fmt.Errorf("request pty: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Client) saveWindowsConsoleState() error {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Debugf("panic in saveWindowsConsoleState: %v", r)
+		}
+	}()
+
+	stdout := syscall.Handle(os.Stdout.Fd())
+	stdin := syscall.Handle(os.Stdin.Fd())
+
+	var stdoutMode, stdinMode uint32
+
+	ret, _, err := procGetConsoleMode.Call(uintptr(stdout), uintptr(unsafe.Pointer(&stdoutMode)))
+	if ret == 0 {
+		log.Debugf("failed to get stdout console mode: %v", err)
+		return &ConsoleUnavailableError{
+			Operation: "get stdout console mode",
+			Err:       err,
+		}
+	}
+
+	ret, _, err = procGetConsoleMode.Call(uintptr(stdin), uintptr(unsafe.Pointer(&stdinMode)))
+	if ret == 0 {
+		log.Debugf("failed to get stdin console mode: %v", err)
+		return &ConsoleUnavailableError{
+			Operation: "get stdin console mode",
+			Err:       err,
+		}
+	}
+
+	c.terminalFd = 1
+	c.windowsStdoutMode = stdoutMode
+	c.windowsStdinMode = stdinMode
+
+	log.Debugf("saved Windows console state - stdout: 0x%04x, stdin: 0x%04x", stdoutMode, stdinMode)
+	return nil
+}
+
+func (c *Client) enableWindowsVirtualTerminal() (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("panic in enableWindowsVirtualTerminal: %v", r)
+		}
+	}()
+
+	stdout := syscall.Handle(os.Stdout.Fd())
+	stdin := syscall.Handle(os.Stdin.Fd())
+	var mode uint32
+
+	ret, _, winErr := procGetConsoleMode.Call(uintptr(stdout), uintptr(unsafe.Pointer(&mode)))
+	if ret == 0 {
+		return &ConsoleUnavailableError{
+			Operation: "get stdout console mode for VT",
+			Err:       winErr,
+		}
+	}
+
+	mode |= enableVirtualTerminalProcessing
+	ret, _, winErr = procSetConsoleMode.Call(uintptr(stdout), uintptr(mode))
+	if ret == 0 {
+		return &ConsoleUnavailableError{
+			Operation: "enable virtual terminal processing",
+			Err:       winErr,
+		}
+	}
+
+	ret, _, winErr = procGetConsoleMode.Call(uintptr(stdin), uintptr(unsafe.Pointer(&mode)))
+	if ret == 0 {
+		return &ConsoleUnavailableError{
+			Operation: "get stdin console mode for VT",
+			Err:       winErr,
+		}
+	}
+
+	mode &= ^uint32(enableLineInput | enableEchoInput | enableProcessedInput)
+	mode |= enableVirtualTerminalInput
+	ret, _, winErr = procSetConsoleMode.Call(uintptr(stdin), uintptr(mode))
+	if ret == 0 {
+		return &ConsoleUnavailableError{
+			Operation: "set stdin raw mode",
+			Err:       winErr,
+		}
+	}
+
+	log.Debugf("enabled Windows virtual terminal processing")
+	return nil
+}
+
+func (c *Client) getWindowsConsoleSize() (int, int) {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Debugf("panic in getWindowsConsoleSize: %v", r)
+		}
+	}()
+
+	stdout := syscall.Handle(os.Stdout.Fd())
+	var csbi consoleScreenBufferInfo
+
+	ret, _, err := procGetConsoleScreenBufferInfo.Call(uintptr(stdout), uintptr(unsafe.Pointer(&csbi)))
+	if ret == 0 {
+		log.Debugf("failed to get console buffer info, using defaults: %v", err)
+		return 80, 24
+	}
+
+	width := int(csbi.window.right - csbi.window.left + 1)
+	height := int(csbi.window.bottom - csbi.window.top + 1)
+
+	log.Debugf("Windows console size: %dx%d", width, height)
+	return width, height
+}
+
+func (c *Client) restoreWindowsConsoleState() error {
+	var err error
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("panic in restoreWindowsConsoleState: %v", r)
+		}
+	}()
+
+	if c.terminalFd != 1 {
+		return nil
+	}
+
+	stdout := syscall.Handle(os.Stdout.Fd())
+	stdin := syscall.Handle(os.Stdin.Fd())
+
+	ret, _, winErr := procSetConsoleMode.Call(uintptr(stdout), uintptr(c.windowsStdoutMode))
+	if ret == 0 {
+		log.Debugf("failed to restore stdout console mode: %v", winErr)
+		if err == nil {
+			err = fmt.Errorf("restore stdout console mode: %w", winErr)
+		}
+	}
+
+	ret, _, winErr = procSetConsoleMode.Call(uintptr(stdin), uintptr(c.windowsStdinMode))
+	if ret == 0 {
+		log.Debugf("failed to restore stdin console mode: %v", winErr)
+		if err == nil {
+			err = fmt.Errorf("restore stdin console mode: %w", winErr)
+		}
+	}
+
+	c.terminalFd = 0
+	c.windowsStdoutMode = 0
+	c.windowsStdinMode = 0
+
+	log.Debugf("restored Windows console state")
+	return err
+}

client/ssh/common.go

@@ -0,0 +1,195 @@
+package ssh
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+const (
+	NetBirdSSHConfigFile = "99-netbird.conf"
+
+	UnixSSHConfigDir    = "/etc/ssh/ssh_config.d"
+	WindowsSSHConfigDir = "ssh/ssh_config.d"
+)
+
+var (
+	// ErrPeerNotFound indicates the peer was not found in the network
+	ErrPeerNotFound = errors.New("peer not found in network")
+	// ErrNoStoredKey indicates the peer has no stored SSH host key
+	ErrNoStoredKey = errors.New("peer has no stored SSH host key")
+)
+
+// HostKeyVerifier provides SSH host key verification
+type HostKeyVerifier interface {
+	VerifySSHHostKey(peerAddress string, key []byte) error
+}
+
+// DaemonHostKeyVerifier implements HostKeyVerifier using the NetBird daemon
+type DaemonHostKeyVerifier struct {
+	client proto.DaemonServiceClient
+}
+
+// NewDaemonHostKeyVerifier creates a new daemon-based host key verifier
+func NewDaemonHostKeyVerifier(client proto.DaemonServiceClient) *DaemonHostKeyVerifier {
+	return &DaemonHostKeyVerifier{
+		client: client,
+	}
+}
+
+// VerifySSHHostKey verifies an SSH host key by querying the NetBird daemon
+func (d *DaemonHostKeyVerifier) VerifySSHHostKey(peerAddress string, presentedKey []byte) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	response, err := d.client.GetPeerSSHHostKey(ctx, &proto.GetPeerSSHHostKeyRequest{
+		PeerAddress: peerAddress,
+	})
+	if err != nil {
+		return err
+	}
+
+	if !response.GetFound() {
+		return ErrPeerNotFound
+	}
+
+	storedKeyData := response.GetSshHostKey()
+
+	return VerifyHostKey(storedKeyData, presentedKey, peerAddress)
+}
+
+// printAuthInstructions prints authentication instructions to stderr
+func printAuthInstructions(stderr io.Writer, authResponse *proto.RequestJWTAuthResponse, browserWillOpen bool) {
+	_, _ = fmt.Fprintln(stderr, "SSH authentication required.")
+
+	if browserWillOpen {
+		_, _ = fmt.Fprintln(stderr, "Please do the SSO login in your browser.")
+		_, _ = fmt.Fprintln(stderr, "If your browser didn't open automatically, use this URL to log in:")
+		_, _ = fmt.Fprintln(stderr)
+	}
+
+	_, _ = fmt.Fprintf(stderr, "%s\n", authResponse.VerificationURIComplete)
+
+	if authResponse.UserCode != "" {
+		_, _ = fmt.Fprintf(stderr, "Or visit: %s and enter code: %s\n", authResponse.VerificationURI, authResponse.UserCode)
+	}
+
+	if browserWillOpen {
+		_, _ = fmt.Fprintln(stderr)
+	}
+
+	_, _ = fmt.Fprintln(stderr, "Waiting for authentication...")
+}
+
+// RequestJWTToken requests or retrieves a JWT token for SSH authentication
+func RequestJWTToken(ctx context.Context, client proto.DaemonServiceClient, stdout, stderr io.Writer, useCache bool, hint string, openBrowser func(string) error) (string, error) {
+	req := &proto.RequestJWTAuthRequest{}
+	if hint != "" {
+		req.Hint = &hint
+	}
+	authResponse, err := client.RequestJWTAuth(ctx, req)
+	if err != nil {
+		return "", fmt.Errorf("request JWT auth: %w", err)
+	}
+
+	if useCache && authResponse.CachedToken != "" {
+		log.Debug("Using cached authentication token")
+		return authResponse.CachedToken, nil
+	}
+
+	if stderr != nil {
+		printAuthInstructions(stderr, authResponse, openBrowser != nil)
+	}
+
+	if openBrowser != nil {
+		if err := openBrowser(authResponse.VerificationURIComplete); err != nil {
+			log.Debugf("open browser: %v", err)
+		}
+	}
+
+	tokenResponse, err := client.WaitJWTToken(ctx, &proto.WaitJWTTokenRequest{
+		DeviceCode: authResponse.DeviceCode,
+		UserCode:   authResponse.UserCode,
+	})
+	if err != nil {
+		return "", fmt.Errorf("wait for JWT token: %w", err)
+	}
+
+	if stdout != nil {
+		_, _ = fmt.Fprintln(stdout, "Authentication successful!")
+	}
+	return tokenResponse.Token, nil
+}
+
+// VerifyHostKey verifies an SSH host key against stored peer key data.
+// Returns nil only if the presented key matches the stored key.
+// Returns ErrNoStoredKey if storedKeyData is empty.
+// Returns an error if the keys don't match or if parsing fails.
+func VerifyHostKey(storedKeyData []byte, presentedKey []byte, peerAddress string) error {
+	if len(storedKeyData) == 0 {
+		return ErrNoStoredKey
+	}
+
+	storedPubKey, _, _, _, err := ssh.ParseAuthorizedKey(storedKeyData)
+	if err != nil {
+		return fmt.Errorf("parse stored SSH key for %s: %w", peerAddress, err)
+	}
+
+	if !bytes.Equal(presentedKey, storedPubKey.Marshal()) {
+		return fmt.Errorf("SSH host key mismatch for %s", peerAddress)
+	}
+
+	return nil
+}
+
+// AddJWTAuth prepends JWT password authentication to existing auth methods.
+// This ensures JWT auth is tried first while preserving any existing auth methods.
+func AddJWTAuth(config *ssh.ClientConfig, jwtToken string) *ssh.ClientConfig {
+	configWithJWT := *config
+	configWithJWT.Auth = append([]ssh.AuthMethod{ssh.Password(jwtToken)}, config.Auth...)
+	return &configWithJWT
+}
+
+// CreateHostKeyCallback creates an SSH host key verification callback using the provided verifier.
+// It tries multiple addresses (hostname, IP) for the peer before failing.
+func CreateHostKeyCallback(verifier HostKeyVerifier) ssh.HostKeyCallback {
+	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		addresses := buildAddressList(hostname, remote)
+		presentedKey := key.Marshal()
+
+		for _, addr := range addresses {
+			if err := verifier.VerifySSHHostKey(addr, presentedKey); err != nil {
+				if errors.Is(err, ErrPeerNotFound) {
+					// Try other addresses for this peer
+					continue
+				}
+				return err
+			}
+			// Verified
+			return nil
+		}
+
+		return fmt.Errorf("SSH host key verification failed: peer %s not found in network", hostname)
+	}
+}
+
+// buildAddressList creates a list of addresses to check for host key verification.
+// It includes the original hostname and extracts the host part from the remote address if different.
+func buildAddressList(hostname string, remote net.Addr) []string {
+	addresses := []string{hostname}
+	if host, _, err := net.SplitHostPort(remote.String()); err == nil {
+		if host != hostname {
+			addresses = append(addresses, host)
+		}
+	}
+	return addresses
+}

client/ssh/config/manager.go

@@ -0,0 +1,313 @@
+package config
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/shared/management/domain"
+)
+
+const (
+	EnvDisableSSHConfig = "NB_DISABLE_SSH_CONFIG"
+
+	EnvForceSSHConfig = "NB_FORCE_SSH_CONFIG"
+
+	MaxPeersForSSHConfig = 200
+
+	fileWriteTimeout = 2 * time.Second
+)
+
+func isSSHConfigDisabled() bool {
+	value := os.Getenv(EnvDisableSSHConfig)
+	if value == "" {
+		return false
+	}
+
+	disabled, err := strconv.ParseBool(value)
+	if err != nil {
+		return true
+	}
+	return disabled
+}
+
+func isSSHConfigForced() bool {
+	value := os.Getenv(EnvForceSSHConfig)
+	if value == "" {
+		return false
+	}
+
+	forced, err := strconv.ParseBool(value)
+	if err != nil {
+		return true
+	}
+	return forced
+}
+
+// shouldGenerateSSHConfig checks if SSH config should be generated based on peer count
+func shouldGenerateSSHConfig(peerCount int) bool {
+	if isSSHConfigDisabled() {
+		return false
+	}
+
+	if isSSHConfigForced() {
+		return true
+	}
+
+	return peerCount <= MaxPeersForSSHConfig
+}
+
+// writeFileWithTimeout writes data to a file with a timeout
+func writeFileWithTimeout(filename string, data []byte, perm os.FileMode) error {
+	ctx, cancel := context.WithTimeout(context.Background(), fileWriteTimeout)
+	defer cancel()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- os.WriteFile(filename, data, perm)
+	}()
+
+	select {
+	case err := <-done:
+		return err
+	case <-ctx.Done():
+		return fmt.Errorf("file write timeout after %v: %s", fileWriteTimeout, filename)
+	}
+}
+
+// Manager handles SSH client configuration for NetBird peers
+type Manager struct {
+	sshConfigDir  string
+	sshConfigFile string
+}
+
+// PeerSSHInfo represents a peer's SSH configuration information
+type PeerSSHInfo struct {
+	Hostname string
+	IP       netip.Addr
+	IPv6     netip.Addr
+	FQDN     string
+}
+
+// New creates a new SSH config manager
+func New() *Manager {
+	sshConfigDir := getSystemSSHConfigDir()
+	return &Manager{
+		sshConfigDir:  sshConfigDir,
+		sshConfigFile: nbssh.NetBirdSSHConfigFile,
+	}
+}
+
+// getSystemSSHConfigDir returns platform-specific SSH configuration directory
+func getSystemSSHConfigDir() string {
+	if runtime.GOOS == "windows" {
+		return getWindowsSSHConfigDir()
+	}
+	return nbssh.UnixSSHConfigDir
+}
+
+func getWindowsSSHConfigDir() string {
+	programData := os.Getenv("PROGRAMDATA")
+	if programData == "" {
+		programData = `C:\ProgramData`
+	}
+	return filepath.Join(programData, nbssh.WindowsSSHConfigDir)
+}
+
+// SetupSSHClientConfig creates SSH client configuration for NetBird peers
+func (m *Manager) SetupSSHClientConfig(peers []PeerSSHInfo) error {
+	if !shouldGenerateSSHConfig(len(peers)) {
+		m.logSkipReason(len(peers))
+		return nil
+	}
+
+	sshConfig, err := m.buildSSHConfig(peers)
+	if err != nil {
+		return fmt.Errorf("build SSH config: %w", err)
+	}
+	return m.writeSSHConfig(sshConfig)
+}
+
+func (m *Manager) logSkipReason(peerCount int) {
+	if isSSHConfigDisabled() {
+		log.Debugf("SSH config management disabled via %s", EnvDisableSSHConfig)
+	} else {
+		log.Infof("SSH config generation skipped: too many peers (%d > %d). Use %s=true to force.",
+			peerCount, MaxPeersForSSHConfig, EnvForceSSHConfig)
+	}
+}
+
+func (m *Manager) buildSSHConfig(peers []PeerSSHInfo) (string, error) {
+	sshConfig := m.buildConfigHeader()
+
+	var allHostPatterns []string
+	for _, peer := range peers {
+		hostPatterns := m.buildHostPatterns(peer)
+		allHostPatterns = append(allHostPatterns, hostPatterns...)
+	}
+
+	if len(allHostPatterns) > 0 {
+		peerConfig, err := m.buildPeerConfig(allHostPatterns)
+		if err != nil {
+			return "", err
+		}
+		sshConfig += peerConfig
+	}
+
+	return sshConfig, nil
+}
+
+func (m *Manager) buildConfigHeader() string {
+	return "# NetBird SSH client configuration\n" +
+		"# Generated automatically - do not edit manually\n" +
+		"#\n" +
+		"# To disable SSH config management, use:\n" +
+		"#   netbird service reconfigure --service-env NB_DISABLE_SSH_CONFIG=true\n" +
+		"#\n\n"
+}
+
+func (m *Manager) buildPeerConfig(allHostPatterns []string) (string, error) {
+	uniquePatterns := make(map[string]bool)
+	var deduplicatedPatterns []string
+	for _, pattern := range allHostPatterns {
+		if !uniquePatterns[pattern] {
+			uniquePatterns[pattern] = true
+			deduplicatedPatterns = append(deduplicatedPatterns, pattern)
+		}
+	}
+
+	execPath, err := m.getNetBirdExecutablePath()
+	if err != nil {
+		return "", fmt.Errorf("get NetBird executable path: %w", err)
+	}
+
+	hostList := strings.Join(deduplicatedPatterns, ",")
+	config := fmt.Sprintf("Match host \"%s\" exec \"%s ssh detect %%h %%p\"\n", hostList, execPath)
+	config += "    PreferredAuthentications password,publickey,keyboard-interactive\n"
+	config += "    PasswordAuthentication yes\n"
+	config += "    PubkeyAuthentication yes\n"
+	config += "    BatchMode no\n"
+	config += fmt.Sprintf("    ProxyCommand %s ssh proxy %%h %%p\n", execPath)
+	config += "    StrictHostKeyChecking no\n"
+
+	if runtime.GOOS == "windows" {
+		config += "    UserKnownHostsFile NUL\n"
+	} else {
+		config += "    UserKnownHostsFile /dev/null\n"
+	}
+
+	config += "    CheckHostIP no\n"
+	config += "    LogLevel ERROR\n\n"
+
+	return config, nil
+}
+
+func (m *Manager) buildHostPatterns(peer PeerSSHInfo) []string {
+	var hostPatterns []string
+	if peer.IP.IsValid() {
+		hostPatterns = append(hostPatterns, peer.IP.String())
+	}
+	if peer.IPv6.IsValid() {
+		hostPatterns = append(hostPatterns, peer.IPv6.String())
+	}
+	// Peer FQDNs and hostnames originate from remote peers, so they must be
+	// validated as plain DNS names before being embedded in the ssh_config
+	// "Match host" pattern list. This prevents injection of arbitrary
+	// ssh_config directives via embedded quotes, whitespace, newlines, the
+	// comma pattern separator, or the "*"/"?" pattern metacharacters.
+	if domain.IsValidDomainNoWildcard(peer.FQDN) {
+		hostPatterns = append(hostPatterns, peer.FQDN)
+	} else if peer.FQDN != "" {
+		log.Warnf("skipping peer FQDN with invalid characters in SSH config: %q", peer.FQDN)
+	}
+	if peer.Hostname != peer.FQDN && domain.IsValidDomainNoWildcard(peer.Hostname) {
+		hostPatterns = append(hostPatterns, peer.Hostname)
+	} else if peer.Hostname != "" && peer.Hostname != peer.FQDN {
+		log.Warnf("skipping peer hostname with invalid characters in SSH config: %q", peer.Hostname)
+	}
+	return hostPatterns
+}
+
+func (m *Manager) writeSSHConfig(sshConfig string) error {
+	sshConfigPath := filepath.Join(m.sshConfigDir, m.sshConfigFile)
+
+	if err := os.MkdirAll(m.sshConfigDir, 0755); err != nil {
+		return fmt.Errorf("create SSH config directory %s: %w", m.sshConfigDir, err)
+	}
+
+	tmp, err := os.CreateTemp(m.sshConfigDir, m.sshConfigFile+".*.tmp")
+	if err != nil {
+		return fmt.Errorf("create temp SSH config: %w", err)
+	}
+	tmpPath := tmp.Name()
+	defer func() {
+		if err := os.Remove(tmpPath); err != nil && !os.IsNotExist(err) {
+			log.Debugf("remove temp SSH config %s: %v", tmpPath, err)
+		}
+	}()
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temp SSH config %s: %w", tmpPath, err)
+	}
+
+	if err := writeFileWithTimeout(tmpPath, []byte(sshConfig), 0644); err != nil {
+		return fmt.Errorf("write SSH config file %s: %w", tmpPath, err)
+	}
+
+	if err := os.Chmod(tmpPath, 0644); err != nil {
+		return fmt.Errorf("chmod SSH config file %s: %w", tmpPath, err)
+	}
+
+	if err := os.Rename(tmpPath, sshConfigPath); err != nil {
+		return fmt.Errorf("rename SSH config %s -> %s: %w", tmpPath, sshConfigPath, err)
+	}
+
+	log.Infof("Created NetBird SSH client config: %s", sshConfigPath)
+	return nil
+}
+
+// RemoveSSHClientConfig removes NetBird SSH configuration
+func (m *Manager) RemoveSSHClientConfig() error {
+	sshConfigPath := filepath.Join(m.sshConfigDir, m.sshConfigFile)
+	err := os.Remove(sshConfigPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove SSH config %s: %w", sshConfigPath, err)
+	}
+	if err == nil {
+		log.Infof("Removed NetBird SSH config: %s", sshConfigPath)
+	}
+	return nil
+}
+
+func (m *Manager) getNetBirdExecutablePath() (string, error) {
+	execPath, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("retrieve executable path: %w", err)
+	}
+
+	realPath, err := filepath.EvalSymlinks(execPath)
+	if err != nil {
+		log.Debugf("symlink resolution failed: %v", err)
+		return execPath, nil
+	}
+
+	return realPath, nil
+}
+
+// GetSSHConfigDir returns the SSH config directory path
+func (m *Manager) GetSSHConfigDir() string {
+	return m.sshConfigDir
+}
+
+// GetSSHConfigFile returns the SSH config file name
+func (m *Manager) GetSSHConfigFile() string {
+	return m.sshConfigFile
+}

client/ssh/config/manager_test.go

@@ -0,0 +1,230 @@
+package config
+
+import (
+	"fmt"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestManager_SetupSSHClientConfig(t *testing.T) {
+	// Create temporary directory for test
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	// Override manager paths to use temp directory
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	// Test SSH config generation with peers
+	peers := []PeerSSHInfo{
+		{
+			Hostname: "peer1",
+			IP:       netip.MustParseAddr("100.125.1.1"),
+			FQDN:     "peer1.nb.internal",
+		},
+		{
+			Hostname: "peer2",
+			IP:       netip.MustParseAddr("100.125.1.2"),
+			FQDN:     "peer2.nb.internal",
+		},
+	}
+
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	// Read generated config
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	content, err := os.ReadFile(configPath)
+	require.NoError(t, err)
+
+	configStr := string(content)
+
+	// Verify the basic SSH config structure exists
+	assert.Contains(t, configStr, "# NetBird SSH client configuration")
+	assert.Contains(t, configStr, "Generated automatically - do not edit manually")
+
+	// Check that peer hostnames are included
+	assert.Contains(t, configStr, "100.125.1.1")
+	assert.Contains(t, configStr, "100.125.1.2")
+	assert.Contains(t, configStr, "peer1.nb.internal")
+	assert.Contains(t, configStr, "peer2.nb.internal")
+
+	// Check platform-specific UserKnownHostsFile
+	if runtime.GOOS == "windows" {
+		assert.Contains(t, configStr, "UserKnownHostsFile NUL")
+	} else {
+		assert.Contains(t, configStr, "UserKnownHostsFile /dev/null")
+	}
+}
+
+func TestGetSystemSSHConfigDir(t *testing.T) {
+	configDir := getSystemSSHConfigDir()
+
+	// Path should not be empty
+	assert.NotEmpty(t, configDir)
+
+	// Should be an absolute path
+	assert.True(t, filepath.IsAbs(configDir))
+
+	// On Unix systems, should start with /etc
+	// On Windows, should contain ProgramData
+	if runtime.GOOS == "windows" {
+		assert.Contains(t, strings.ToLower(configDir), "programdata")
+	} else {
+		assert.Contains(t, configDir, "/etc/ssh")
+	}
+}
+
+func TestManager_PeerLimit(t *testing.T) {
+	// Create temporary directory for test
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	// Override manager paths to use temp directory
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	// Generate many peers (more than limit)
+	var peers []PeerSSHInfo
+	for i := 0; i < MaxPeersForSSHConfig+10; i++ {
+		peers = append(peers, PeerSSHInfo{
+			Hostname: fmt.Sprintf("peer%d", i),
+			IP:       netip.MustParseAddr(fmt.Sprintf("100.125.1.%d", i%254+1)),
+			FQDN:     fmt.Sprintf("peer%d.nb.internal", i),
+		})
+	}
+
+	// Test that SSH config generation is skipped when too many peers
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	// Config should not be created due to peer limit
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	_, err = os.Stat(configPath)
+	assert.True(t, os.IsNotExist(err), "SSH config should not be created with too many peers")
+}
+
+func TestManager_MatchHostFormat(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	peers := []PeerSSHInfo{
+		{Hostname: "peer1", IP: netip.MustParseAddr("100.125.1.1"), FQDN: "peer1.nb.internal"},
+		{Hostname: "peer2", IP: netip.MustParseAddr("100.125.1.2"), FQDN: "peer2.nb.internal"},
+	}
+
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	content, err := os.ReadFile(configPath)
+	require.NoError(t, err)
+	configStr := string(content)
+
+	// Must use "Match host" with comma-separated patterns, not a bare "Host" directive.
+	// A bare "Host" followed by "Match exec" is incorrect per ssh_config(5): the Host block
+	// ends at the next Match keyword, making it a no-op and leaving the Match exec unscoped.
+	assert.NotContains(t, configStr, "\nHost ", "should not use bare Host directive")
+	assert.Contains(t, configStr, "Match host \"100.125.1.1,peer1.nb.internal,peer1,100.125.1.2,peer2.nb.internal,peer2\"",
+		"should use Match host with comma-separated patterns")
+}
+
+func TestManager_HostPatternInjection(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	// A malicious peer FQDN/hostname attempts to break out of the Match host
+	// directive and inject arbitrary ssh_config (a ProxyCommand executing a
+	// command). It must be rejected, not written to the config.
+	peers := []PeerSSHInfo{
+		{
+			Hostname: "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x",
+			IP:       netip.MustParseAddr("100.125.1.1"),
+			FQDN:     "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x.nb.internal",
+		},
+		{Hostname: "peer2", IP: netip.MustParseAddr("100.125.1.2"), FQDN: "peer2.nb.internal"},
+	}
+
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	content, err := os.ReadFile(configPath)
+	require.NoError(t, err)
+	configStr := string(content)
+
+	assert.NotContains(t, configStr, "ProxyCommand touch /tmp/pwned",
+		"injected directive must not appear in generated config")
+	assert.NotContains(t, configStr, "evil",
+		"malicious pattern must be dropped entirely")
+	// The valid peer must still be present, on a single Match host line.
+	assert.Contains(t, configStr, "Match host \"100.125.1.1,100.125.1.2,peer2.nb.internal,peer2\"",
+		"valid peers must survive, injected patterns dropped")
+}
+
+func TestManager_ForcedSSHConfig(t *testing.T) {
+	// Set force environment variable
+	t.Setenv(EnvForceSSHConfig, "true")
+
+	// Create temporary directory for test
+	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
+	require.NoError(t, err)
+	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
+
+	// Override manager paths to use temp directory
+	manager := &Manager{
+		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
+		sshConfigFile: "99-netbird.conf",
+	}
+
+	// Generate many peers (more than limit)
+	var peers []PeerSSHInfo
+	for i := 0; i < MaxPeersForSSHConfig+10; i++ {
+		peers = append(peers, PeerSSHInfo{
+			Hostname: fmt.Sprintf("peer%d", i),
+			IP:       netip.MustParseAddr(fmt.Sprintf("100.125.1.%d", i%254+1)),
+			FQDN:     fmt.Sprintf("peer%d.nb.internal", i),
+		})
+	}
+
+	// Test that SSH config generation is forced despite many peers
+	err = manager.SetupSSHClientConfig(peers)
+	require.NoError(t, err)
+
+	// Config should be created despite peer limit due to force flag
+	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
+	_, err = os.Stat(configPath)
+	require.NoError(t, err, "SSH config should be created when forced")
+
+	// Verify config contains peer hostnames
+	content, err := os.ReadFile(configPath)
+	require.NoError(t, err)
+	configStr := string(content)
+	assert.Contains(t, configStr, "peer0.nb.internal")
+	assert.Contains(t, configStr, "peer1.nb.internal")
+}

client/ssh/config/shutdown_state.go

@@ -0,0 +1,22 @@
+package config
+
+// ShutdownState represents SSH configuration state that needs to be cleaned up.
+type ShutdownState struct {
+	SSHConfigDir  string
+	SSHConfigFile string
+}
+
+// Name returns the state name for the state manager.
+func (s *ShutdownState) Name() string {
+	return "ssh_config_state"
+}
+
+// Cleanup removes SSH client configuration files.
+func (s *ShutdownState) Cleanup() error {
+	manager := &Manager{
+		sshConfigDir:  s.SSHConfigDir,
+		sshConfigFile: s.SSHConfigFile,
+	}
+
+	return manager.RemoveSSHClientConfig()
+}

client/ssh/detection/detection.go

@@ -0,0 +1,99 @@
+package detection
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// ServerIdentifier is the base response for NetBird SSH servers
+	ServerIdentifier = "NetBird-SSH-Server"
+	// ProxyIdentifier is the base response for NetBird SSH proxy
+	ProxyIdentifier = "NetBird-SSH-Proxy"
+	// JWTRequiredMarker is appended to responses when JWT is required
+	JWTRequiredMarker = "NetBird-JWT-Required"
+
+	// DefaultTimeout is the default timeout for SSH server detection
+	DefaultTimeout = 5 * time.Second
+)
+
+type ServerType string
+
+const (
+	ServerTypeNetBirdJWT   ServerType = "netbird-jwt"
+	ServerTypeNetBirdNoJWT ServerType = "netbird-no-jwt"
+	ServerTypeRegular      ServerType = "regular"
+)
+
+// Dialer provides network connection capabilities
+type Dialer interface {
+	DialContext(ctx context.Context, network, address string) (net.Conn, error)
+}
+
+// RequiresJWT checks if the server type requires JWT authentication
+func (s ServerType) RequiresJWT() bool {
+	return s == ServerTypeNetBirdJWT
+}
+
+// ExitCode returns the exit code for the detect command
+func (s ServerType) ExitCode() int {
+	switch s {
+	case ServerTypeNetBirdJWT:
+		return 0
+	case ServerTypeNetBirdNoJWT:
+		return 1
+	case ServerTypeRegular:
+		return 2
+	default:
+		return 2
+	}
+}
+
+// DetectSSHServerType detects SSH server type using the provided dialer
+func DetectSSHServerType(ctx context.Context, dialer Dialer, host string, port int) (ServerType, error) {
+	targetAddr := net.JoinHostPort(host, strconv.Itoa(port))
+
+	conn, err := dialer.DialContext(ctx, "tcp", targetAddr)
+	if err != nil {
+		return ServerTypeRegular, fmt.Errorf("connect to %s: %w", targetAddr, err)
+	}
+	defer conn.Close()
+
+	if deadline, ok := ctx.Deadline(); ok {
+		if err := conn.SetReadDeadline(deadline); err != nil {
+			return ServerTypeRegular, fmt.Errorf("set read deadline: %w", err)
+		}
+	}
+
+	reader := bufio.NewReader(conn)
+	serverBanner, err := reader.ReadString('\n')
+	if err != nil {
+		return ServerTypeRegular, fmt.Errorf("read SSH banner: %w", err)
+	}
+
+	serverBanner = strings.TrimSpace(serverBanner)
+	log.Debugf("SSH server banner: %s", serverBanner)
+
+	if !strings.HasPrefix(serverBanner, "SSH-") {
+		log.Debugf("Invalid SSH banner")
+		return ServerTypeRegular, nil
+	}
+
+	if !strings.Contains(serverBanner, ServerIdentifier) {
+		log.Debugf("Server banner does not contain identifier '%s'", ServerIdentifier)
+		return ServerTypeRegular, nil
+	}
+
+	if strings.Contains(serverBanner, JWTRequiredMarker) {
+		return ServerTypeNetBirdJWT, nil
+	}
+
+	return ServerTypeNetBirdNoJWT, nil
+}

client/ssh/login.go

@@ -1,53 +0,0 @@
-//go:build !js
-
-package ssh
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-	"os"
-	"os/exec"
-	"runtime"
-
-	"github.com/netbirdio/netbird/util"
-)
-
-func isRoot() bool {
-	return os.Geteuid() == 0
-}
-
-func getLoginCmd(user string, remoteAddr net.Addr) (loginPath string, args []string, err error) {
-	if !isRoot() {
-		shell := getUserShell(user)
-		if shell == "" {
-			shell = "/bin/sh"
-		}
-
-		return shell, []string{"-l"}, nil
-	}
-
-	loginPath, err = exec.LookPath("login")
-	if err != nil {
-		return "", nil, err
-	}
-
-	addrPort, err := netip.ParseAddrPort(remoteAddr.String())
-	if err != nil {
-		return "", nil, err
-	}
-
-	switch runtime.GOOS {
-	case "linux":
-		if util.FileExists("/etc/arch-release") && !util.FileExists("/etc/pam.d/remote") {
-			return loginPath, []string{"-f", user, "-p"}, nil
-		}
-		return loginPath, []string{"-f", user, "-h", addrPort.Addr().String(), "-p"}, nil
-	case "darwin":
-		return loginPath, []string{"-fp", "-h", addrPort.Addr().String(), user}, nil
-	case "freebsd":
-		return loginPath, []string{"-f", user, "-h", addrPort.Addr().String(), "-p"}, nil
-	default:
-		return "", nil, fmt.Errorf("unsupported platform: %s", runtime.GOOS)
-	}
-}

client/ssh/lookup.go

@@ -1,14 +0,0 @@
-//go:build !darwin
-// +build !darwin
-
-package ssh
-
-import "os/user"
-
-func userNameLookup(username string) (*user.User, error) {
-	if username == "" || (username == "root" && !isRoot()) {
-		return user.Current()
-	}
-
-	return user.Lookup(username)
-}

client/ssh/lookup_darwin.go

@@ -1,51 +0,0 @@
-//go:build darwin
-// +build darwin
-
-package ssh
-
-import (
-	"bytes"
-	"fmt"
-	"os/exec"
-	"os/user"
-	"strings"
-)
-
-func userNameLookup(username string) (*user.User, error) {
-	if username == "" || (username == "root" && !isRoot()) {
-		return user.Current()
-	}
-
-	var userObject *user.User
-	userObject, err := user.Lookup(username)
-	if err != nil && err.Error() == user.UnknownUserError(username).Error() {
-		return idUserNameLookup(username)
-	} else if err != nil {
-		return nil, err
-	}
-
-	return userObject, nil
-}
-
-func idUserNameLookup(username string) (*user.User, error) {
-	cmd := exec.Command("id", "-P", username)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return nil, fmt.Errorf("error while retrieving user with id -P command, error: %v", err)
-	}
-	colon := ":"
-
-	if !bytes.Contains(out, []byte(username+colon)) {
-		return nil, fmt.Errorf("unable to find user in returned string")
-	}
-	// netbird:********:501:20::0:0:netbird:/Users/netbird:/bin/zsh
-	parts := strings.SplitN(string(out), colon, 10)
-	userObject := &user.User{
-		Username: parts[0],
-		Uid:      parts[2],
-		Gid:      parts[3],
-		Name:     parts[7],
-		HomeDir:  parts[8],
-	}
-	return userObject, nil
-}

client/ssh/proxy/proxy.go

@@ -0,0 +1,627 @@
+package proxy
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	cryptossh "golang.org/x/crypto/ssh"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+	"github.com/netbirdio/netbird/util/netrelay"
+	"github.com/netbirdio/netbird/version"
+)
+
+const (
+	// sshConnectionTimeout is the timeout for SSH TCP connection establishment
+	sshConnectionTimeout = 120 * time.Second
+	// sshHandshakeTimeout is the timeout for SSH handshake completion
+	sshHandshakeTimeout = 30 * time.Second
+
+	jwtAuthErrorMsg = "JWT authentication: %w"
+)
+
+type SSHProxy struct {
+	daemonAddr    string
+	targetHost    string
+	targetPort    int
+	stderr        io.Writer
+	conn          *grpc.ClientConn
+	daemonClient  proto.DaemonServiceClient
+	browserOpener func(string) error
+
+	mu            sync.RWMutex
+	backendClient *cryptossh.Client
+	// jwtToken is set once in runProxySSHServer before any handlers are called,
+	// so concurrent access is safe without additional synchronization.
+	jwtToken string
+
+	forwardedChannelsOnce sync.Once
+}
+
+func New(daemonAddr, targetHost string, targetPort int, stderr io.Writer, browserOpener func(string) error) (*SSHProxy, error) {
+	grpcAddr := strings.TrimPrefix(daemonAddr, "tcp://")
+	grpcConn, err := grpc.NewClient(grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, fmt.Errorf("connect to daemon: %w", err)
+	}
+
+	return &SSHProxy{
+		daemonAddr:    daemonAddr,
+		targetHost:    targetHost,
+		targetPort:    targetPort,
+		stderr:        stderr,
+		conn:          grpcConn,
+		daemonClient:  proto.NewDaemonServiceClient(grpcConn),
+		browserOpener: browserOpener,
+	}, nil
+}
+
+func (p *SSHProxy) Close() error {
+	p.mu.Lock()
+	backendClient := p.backendClient
+	p.backendClient = nil
+	p.mu.Unlock()
+
+	if backendClient != nil {
+		if err := backendClient.Close(); err != nil {
+			log.Debugf("close backend client: %v", err)
+		}
+	}
+
+	if p.conn != nil {
+		return p.conn.Close()
+	}
+	return nil
+}
+
+func (p *SSHProxy) Connect(ctx context.Context) error {
+	hint := profilemanager.GetLoginHint()
+
+	jwtToken, err := nbssh.RequestJWTToken(ctx, p.daemonClient, nil, p.stderr, true, hint, p.browserOpener)
+	if err != nil {
+		return fmt.Errorf(jwtAuthErrorMsg, err)
+	}
+
+	log.Debugf("JWT authentication successful, starting proxy to %s:%d", p.targetHost, p.targetPort)
+	return p.runProxySSHServer(jwtToken)
+}
+
+func (p *SSHProxy) runProxySSHServer(jwtToken string) error {
+	p.jwtToken = jwtToken
+	serverVersion := fmt.Sprintf("%s-%s", detection.ProxyIdentifier, version.NetbirdVersion())
+
+	sshServer := &ssh.Server{
+		Handler: p.handleSSHSession,
+		ChannelHandlers: map[string]ssh.ChannelHandler{
+			"session":      ssh.DefaultSessionHandler,
+			"direct-tcpip": p.directTCPIPHandler,
+		},
+		SubsystemHandlers: map[string]ssh.SubsystemHandler{
+			"sftp": func(s ssh.Session) {
+				p.sftpSubsystemHandler(s, jwtToken)
+			},
+		},
+		RequestHandlers: map[string]ssh.RequestHandler{
+			"tcpip-forward":        p.tcpipForwardHandler,
+			"cancel-tcpip-forward": p.cancelTcpipForwardHandler,
+		},
+		Version: serverVersion,
+	}
+
+	hostKey, err := generateHostKey()
+	if err != nil {
+		return fmt.Errorf("generate host key: %w", err)
+	}
+	sshServer.HostSigners = []ssh.Signer{hostKey}
+
+	conn := &stdioConn{
+		stdin:  os.Stdin,
+		stdout: os.Stdout,
+	}
+
+	sshServer.HandleConn(conn)
+
+	return nil
+}
+
+func (p *SSHProxy) handleSSHSession(session ssh.Session) {
+	ptyReq, winCh, isPty := session.Pty()
+	hasCommand := session.RawCommand() != ""
+
+	sshClient, err := p.getOrCreateBackendClient(session.Context(), session.User())
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "SSH connection to NetBird server failed: %v\n", err)
+		return
+	}
+
+	if !isPty && !hasCommand {
+		p.handleNonInteractiveSession(session, sshClient)
+		return
+	}
+
+	serverSession, err := sshClient.NewSession()
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "create server session: %v\n", err)
+		return
+	}
+	defer func() { _ = serverSession.Close() }()
+
+	serverSession.Stdin = session
+	serverSession.Stdout = session
+	serverSession.Stderr = session.Stderr()
+
+	if isPty {
+		if err := serverSession.RequestPty(ptyReq.Term, ptyReq.Window.Width, ptyReq.Window.Height, nil); err != nil {
+			log.Debugf("PTY request to backend: %v", err)
+		}
+
+		go func() {
+			for win := range winCh {
+				if err := serverSession.WindowChange(win.Height, win.Width); err != nil {
+					log.Debugf("window change: %v", err)
+				}
+			}
+		}()
+	}
+
+	if hasCommand {
+		if err := serverSession.Run(session.RawCommand()); err != nil {
+			log.Debugf("run command: %v", err)
+			p.handleProxyExitCode(session, err)
+		}
+		return
+	}
+
+	if err = serverSession.Shell(); err != nil {
+		log.Debugf("start shell: %v", err)
+		return
+	}
+	if err := serverSession.Wait(); err != nil {
+		log.Debugf("session wait: %v", err)
+		p.handleProxyExitCode(session, err)
+	}
+}
+
+func (p *SSHProxy) handleProxyExitCode(session ssh.Session, err error) {
+	var exitErr *cryptossh.ExitError
+	if errors.As(err, &exitErr) {
+		if err := session.Exit(exitErr.ExitStatus()); err != nil {
+			log.Debugf("set exit status: %v", err)
+		}
+	}
+}
+
+func (p *SSHProxy) handleNonInteractiveSession(session ssh.Session, sshClient *cryptossh.Client) {
+	serverSession, err := sshClient.NewSession()
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "create server session: %v\n", err)
+		return
+	}
+	defer func() { _ = serverSession.Close() }()
+
+	serverSession.Stdin = session
+	serverSession.Stdout = session
+	serverSession.Stderr = session.Stderr()
+
+	if err := serverSession.Shell(); err != nil {
+		log.Debugf("start shell: %v", err)
+		return
+	}
+
+	done := make(chan error, 1)
+	go func() {
+		done <- serverSession.Wait()
+	}()
+
+	select {
+	case <-session.Context().Done():
+		return
+	case err := <-done:
+		if err != nil {
+			log.Debugf("shell session: %v", err)
+			p.handleProxyExitCode(session, err)
+		}
+	}
+}
+
+func generateHostKey() (ssh.Signer, error) {
+	keyPEM, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	if err != nil {
+		return nil, fmt.Errorf("generate ED25519 key: %w", err)
+	}
+
+	signer, err := cryptossh.ParsePrivateKey(keyPEM)
+	if err != nil {
+		return nil, fmt.Errorf("parse private key: %w", err)
+	}
+
+	return signer, nil
+}
+
+type stdioConn struct {
+	stdin  io.Reader
+	stdout io.Writer
+	closed bool
+	mu     sync.Mutex
+}
+
+func (c *stdioConn) Read(b []byte) (n int, err error) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return 0, io.EOF
+	}
+	c.mu.Unlock()
+	return c.stdin.Read(b)
+}
+
+func (c *stdioConn) Write(b []byte) (n int, err error) {
+	c.mu.Lock()
+	if c.closed {
+		c.mu.Unlock()
+		return 0, io.ErrClosedPipe
+	}
+	c.mu.Unlock()
+	return c.stdout.Write(b)
+}
+
+func (c *stdioConn) Close() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.closed = true
+	return nil
+}
+
+func (c *stdioConn) LocalAddr() net.Addr {
+	return &net.UnixAddr{Name: "stdio", Net: "unix"}
+}
+
+func (c *stdioConn) RemoteAddr() net.Addr {
+	return &net.UnixAddr{Name: "stdio", Net: "unix"}
+}
+
+func (c *stdioConn) SetDeadline(_ time.Time) error {
+	return nil
+}
+
+func (c *stdioConn) SetReadDeadline(_ time.Time) error {
+	return nil
+}
+
+func (c *stdioConn) SetWriteDeadline(_ time.Time) error {
+	return nil
+}
+
+// directTCPIPHandler handles local port forwarding (direct-tcpip channel).
+func (p *SSHProxy) directTCPIPHandler(_ *ssh.Server, _ *cryptossh.ServerConn, newChan cryptossh.NewChannel, sshCtx ssh.Context) {
+	var payload struct {
+		DestAddr   string
+		DestPort   uint32
+		OriginAddr string
+		OriginPort uint32
+	}
+	if err := cryptossh.Unmarshal(newChan.ExtraData(), &payload); err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "parse direct-tcpip payload: %v\n", err)
+		_ = newChan.Reject(cryptossh.ConnectionFailed, "invalid payload")
+		return
+	}
+
+	dest := net.JoinHostPort(payload.DestAddr, strconv.Itoa(int(payload.DestPort)))
+	log.Debugf("local port forwarding: %s", dest)
+
+	backendClient, err := p.getOrCreateBackendClient(sshCtx, sshCtx.User())
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "backend connection for port forwarding: %v\n", err)
+		_ = newChan.Reject(cryptossh.ConnectionFailed, "backend connection failed")
+		return
+	}
+
+	backendChan, backendReqs, err := backendClient.OpenChannel("direct-tcpip", newChan.ExtraData())
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "open backend channel for %s: %v\n", dest, err)
+		var openErr *cryptossh.OpenChannelError
+		if errors.As(err, &openErr) {
+			_ = newChan.Reject(openErr.Reason, openErr.Message)
+		} else {
+			_ = newChan.Reject(cryptossh.ConnectionFailed, err.Error())
+		}
+		return
+	}
+	go cryptossh.DiscardRequests(backendReqs)
+
+	clientChan, clientReqs, err := newChan.Accept()
+	if err != nil {
+		log.Debugf("local port forwarding: accept channel: %v", err)
+		_ = backendChan.Close()
+		return
+	}
+	go cryptossh.DiscardRequests(clientReqs)
+
+	netrelay.Relay(sshCtx, clientChan, backendChan, netrelay.Options{Logger: log.NewEntry(log.StandardLogger())})
+}
+
+func (p *SSHProxy) sftpSubsystemHandler(s ssh.Session, jwtToken string) {
+	ctx, cancel := context.WithCancel(s.Context())
+	defer cancel()
+
+	targetAddr := net.JoinHostPort(p.targetHost, strconv.Itoa(p.targetPort))
+
+	sshClient, err := p.dialBackend(ctx, targetAddr, s.User(), jwtToken)
+	if err != nil {
+		_, _ = fmt.Fprintf(s, "SSH connection failed: %v\n", err)
+		_ = s.Exit(1)
+		return
+	}
+	defer func() {
+		if err := sshClient.Close(); err != nil {
+			log.Debugf("close SSH client: %v", err)
+		}
+	}()
+
+	serverSession, err := sshClient.NewSession()
+	if err != nil {
+		_, _ = fmt.Fprintf(s, "create server session: %v\n", err)
+		_ = s.Exit(1)
+		return
+	}
+	defer func() {
+		if err := serverSession.Close(); err != nil {
+			log.Debugf("close server session: %v", err)
+		}
+	}()
+
+	stdin, stdout, err := p.setupSFTPPipes(serverSession)
+	if err != nil {
+		log.Debugf("setup SFTP pipes: %v", err)
+		_ = s.Exit(1)
+		return
+	}
+
+	if err := serverSession.RequestSubsystem("sftp"); err != nil {
+		_, _ = fmt.Fprintf(s, "SFTP subsystem request failed: %v\n", err)
+		_ = s.Exit(1)
+		return
+	}
+
+	p.runSFTPBridge(ctx, s, stdin, stdout, serverSession)
+}
+
+func (p *SSHProxy) setupSFTPPipes(serverSession *cryptossh.Session) (io.WriteCloser, io.Reader, error) {
+	stdin, err := serverSession.StdinPipe()
+	if err != nil {
+		return nil, nil, fmt.Errorf("get stdin pipe: %w", err)
+	}
+
+	stdout, err := serverSession.StdoutPipe()
+	if err != nil {
+		return nil, nil, fmt.Errorf("get stdout pipe: %w", err)
+	}
+
+	return stdin, stdout, nil
+}
+
+func (p *SSHProxy) runSFTPBridge(ctx context.Context, s ssh.Session, stdin io.WriteCloser, stdout io.Reader, serverSession *cryptossh.Session) {
+	copyErrCh := make(chan error, 2)
+
+	go func() {
+		_, err := io.Copy(stdin, s)
+		if err != nil {
+			log.Debugf("SFTP client to server copy: %v", err)
+		}
+		if err := stdin.Close(); err != nil {
+			log.Debugf("close stdin: %v", err)
+		}
+		copyErrCh <- err
+	}()
+
+	go func() {
+		_, err := io.Copy(s, stdout)
+		if err != nil {
+			log.Debugf("SFTP server to client copy: %v", err)
+		}
+		copyErrCh <- err
+	}()
+
+	go func() {
+		<-ctx.Done()
+		if err := serverSession.Close(); err != nil {
+			log.Debugf("force close server session on context cancellation: %v", err)
+		}
+	}()
+
+	for i := 0; i < 2; i++ {
+		if err := <-copyErrCh; err != nil && !errors.Is(err, io.EOF) {
+			log.Debugf("SFTP copy error: %v", err)
+		}
+	}
+
+	if err := serverSession.Wait(); err != nil {
+		log.Debugf("SFTP session ended: %v", err)
+	}
+}
+
+// tcpipForwardHandler handles remote port forwarding (tcpip-forward request).
+func (p *SSHProxy) tcpipForwardHandler(sshCtx ssh.Context, _ *ssh.Server, req *cryptossh.Request) (bool, []byte) {
+	var reqPayload struct {
+		Host string
+		Port uint32
+	}
+	if err := cryptossh.Unmarshal(req.Payload, &reqPayload); err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "parse tcpip-forward payload: %v\n", err)
+		return false, nil
+	}
+
+	log.Debugf("tcpip-forward request for %s:%d", reqPayload.Host, reqPayload.Port)
+
+	backendClient, err := p.getOrCreateBackendClient(sshCtx, sshCtx.User())
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "backend connection for remote port forwarding: %v\n", err)
+		return false, nil
+	}
+
+	ok, payload, err := backendClient.SendRequest(req.Type, req.WantReply, req.Payload)
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "forward tcpip-forward request for %s:%d: %v\n", reqPayload.Host, reqPayload.Port, err)
+		return false, nil
+	}
+
+	if ok {
+		actualPort := reqPayload.Port
+		if reqPayload.Port == 0 && len(payload) >= 4 {
+			actualPort = binary.BigEndian.Uint32(payload)
+		}
+		log.Debugf("remote port forwarding established for %s:%d", reqPayload.Host, actualPort)
+		p.forwardedChannelsOnce.Do(func() {
+			go p.handleForwardedChannels(sshCtx, backendClient)
+		})
+	}
+
+	return ok, payload
+}
+
+// cancelTcpipForwardHandler handles cancel-tcpip-forward request.
+func (p *SSHProxy) cancelTcpipForwardHandler(_ ssh.Context, _ *ssh.Server, req *cryptossh.Request) (bool, []byte) {
+	var reqPayload struct {
+		Host string
+		Port uint32
+	}
+	if err := cryptossh.Unmarshal(req.Payload, &reqPayload); err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "parse cancel-tcpip-forward payload: %v\n", err)
+		return false, nil
+	}
+
+	log.Debugf("cancel-tcpip-forward request for %s:%d", reqPayload.Host, reqPayload.Port)
+
+	backendClient := p.getBackendClient()
+	if backendClient == nil {
+		return false, nil
+	}
+
+	ok, payload, err := backendClient.SendRequest(req.Type, req.WantReply, req.Payload)
+	if err != nil {
+		_, _ = fmt.Fprintf(p.stderr, "cancel-tcpip-forward for %s:%d: %v\n", reqPayload.Host, reqPayload.Port, err)
+		return false, nil
+	}
+
+	return ok, payload
+}
+
+// getOrCreateBackendClient returns the existing backend client or creates a new one.
+func (p *SSHProxy) getOrCreateBackendClient(ctx context.Context, user string) (*cryptossh.Client, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if p.backendClient != nil {
+		return p.backendClient, nil
+	}
+
+	targetAddr := net.JoinHostPort(p.targetHost, strconv.Itoa(p.targetPort))
+	log.Debugf("connecting to backend %s", targetAddr)
+
+	client, err := p.dialBackend(ctx, targetAddr, user, p.jwtToken)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debugf("backend connection established to %s", targetAddr)
+	p.backendClient = client
+	return client, nil
+}
+
+// getBackendClient returns the existing backend client or nil.
+func (p *SSHProxy) getBackendClient() *cryptossh.Client {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.backendClient
+}
+
+// handleForwardedChannels handles forwarded-tcpip channels from the backend for remote port forwarding.
+// When the backend receives incoming connections on the forwarded port, it sends them as
+// "forwarded-tcpip" channels which we need to proxy to the client.
+func (p *SSHProxy) handleForwardedChannels(sshCtx ssh.Context, backendClient *cryptossh.Client) {
+	sshConn, ok := sshCtx.Value(ssh.ContextKeyConn).(*cryptossh.ServerConn)
+	if !ok || sshConn == nil {
+		log.Debugf("no SSH connection in context for forwarded channels")
+		return
+	}
+
+	channelChan := backendClient.HandleChannelOpen("forwarded-tcpip")
+	for {
+		select {
+		case <-sshCtx.Done():
+			return
+		case newChannel, ok := <-channelChan:
+			if !ok {
+				return
+			}
+			go p.handleForwardedChannel(sshCtx, sshConn, newChannel)
+		}
+	}
+}
+
+// handleForwardedChannel handles a single forwarded-tcpip channel from the backend.
+func (p *SSHProxy) handleForwardedChannel(sshCtx ssh.Context, sshConn *cryptossh.ServerConn, newChannel cryptossh.NewChannel) {
+	backendChan, backendReqs, err := newChannel.Accept()
+	if err != nil {
+		log.Debugf("remote port forwarding: accept from backend: %v", err)
+		return
+	}
+	go cryptossh.DiscardRequests(backendReqs)
+
+	clientChan, clientReqs, err := sshConn.OpenChannel("forwarded-tcpip", newChannel.ExtraData())
+	if err != nil {
+		log.Debugf("remote port forwarding: open to client: %v", err)
+		_ = backendChan.Close()
+		return
+	}
+	go cryptossh.DiscardRequests(clientReqs)
+
+	netrelay.Relay(sshCtx, clientChan, backendChan, netrelay.Options{Logger: log.NewEntry(log.StandardLogger())})
+}
+
+func (p *SSHProxy) dialBackend(ctx context.Context, addr, user, jwtToken string) (*cryptossh.Client, error) {
+	config := &cryptossh.ClientConfig{
+		User:            user,
+		Auth:            []cryptossh.AuthMethod{cryptossh.Password(jwtToken)},
+		Timeout:         sshHandshakeTimeout,
+		HostKeyCallback: p.verifyHostKey,
+	}
+
+	dialer := &net.Dialer{
+		Timeout: sshConnectionTimeout,
+	}
+	conn, err := dialer.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("connect to server: %w", err)
+	}
+
+	clientConn, chans, reqs, err := cryptossh.NewClientConn(conn, addr, config)
+	if err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("SSH handshake: %w", err)
+	}
+
+	return cryptossh.NewClient(clientConn, chans, reqs), nil
+}
+
+func (p *SSHProxy) verifyHostKey(hostname string, remote net.Addr, key cryptossh.PublicKey) error {
+	verifier := nbssh.NewDaemonHostKeyVerifier(p.daemonClient)
+	callback := nbssh.CreateHostKeyCallback(verifier)
+	return callback(hostname, remote, key)
+}

client/ssh/proxy/proxy_privileged_test.go

@@ -0,0 +1,423 @@
+//go:build privileged
+
+package proxy
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
+	"github.com/netbirdio/netbird/client/ssh/server"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
+)
+
+func (m *mockDaemon) setJWTToken(token string) {
+	m.impl.jwtToken = token
+}
+
+func TestSSHProxy_Connect(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	// TODO: Windows test times out - user switching and command execution tested on Linux
+	if runtime.GOOS == "windows" {
+		t.Skip("Skipping on Windows - covered by Linux tests")
+	}
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+	defer jwksServer.Close()
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+	hostPubKey, err := nbssh.GeneratePublicKey(hostKey)
+	require.NoError(t, err)
+
+	serverConfig := &server.Config{
+		HostKeyPEM: hostKey,
+		JWT: &server.JWTConfig{
+			Issuer:       issuer,
+			Audiences:    []string{audience},
+			KeysLocation: jwksURL,
+		},
+	}
+	sshServer := server.New(serverConfig)
+	sshServer.SetAllowRootLogin(true)
+
+	// Configure SSH authorization for the test user
+	testUsername := testutil.GetTestUsername(t)
+	testJWTUser := "test-username"
+	testUserHash, err := sshuserhash.HashUserID(testJWTUser)
+	require.NoError(t, err)
+
+	authConfig := &sshauth.Config{
+		UserIDClaim:     sshauth.DefaultUserIDClaim,
+		AuthorizedUsers: []sshuserhash.UserIDHash{testUserHash},
+		MachineUsers: map[string][]uint32{
+			testUsername: {0}, // Index 0 in AuthorizedUsers
+		},
+	}
+	sshServer.UpdateSSHAuth(authConfig)
+
+	sshServerAddr := server.StartTestServer(t, sshServer)
+	defer func() { _ = sshServer.Stop() }()
+
+	mockDaemon := startMockDaemon(t)
+	defer mockDaemon.stop()
+
+	host, portStr, err := net.SplitHostPort(sshServerAddr)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portStr)
+	require.NoError(t, err)
+
+	mockDaemon.setHostKey(host, hostPubKey)
+
+	validToken := generateValidJWT(t, privateKey, issuer, audience, testJWTUser)
+	mockDaemon.setJWTToken(validToken)
+
+	proxyInstance, err := New(mockDaemon.addr, host, port, io.Discard, nil)
+	require.NoError(t, err)
+
+	clientConn, proxyConn := net.Pipe()
+	defer func() { _ = clientConn.Close() }()
+
+	origStdin := os.Stdin
+	origStdout := os.Stdout
+	defer func() {
+		os.Stdin = origStdin
+		os.Stdout = origStdout
+	}()
+
+	stdinReader, stdinWriter, err := os.Pipe()
+	require.NoError(t, err)
+	stdoutReader, stdoutWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	os.Stdin = stdinReader
+	os.Stdout = stdoutWriter
+
+	go func() {
+		_, _ = io.Copy(stdinWriter, proxyConn)
+	}()
+	go func() {
+		_, _ = io.Copy(proxyConn, stdoutReader)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	connectErrCh := make(chan error, 1)
+	go func() {
+		connectErrCh <- proxyInstance.Connect(ctx)
+	}()
+
+	sshConfig := &cryptossh.ClientConfig{
+		User:            testutil.GetTestUsername(t),
+		Auth:            []cryptossh.AuthMethod{},
+		HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+		Timeout:         3 * time.Second,
+	}
+
+	sshClientConn, chans, reqs, err := cryptossh.NewClientConn(clientConn, "test", sshConfig)
+	require.NoError(t, err, "Should connect to proxy server")
+	defer func() { _ = sshClientConn.Close() }()
+
+	sshClient := cryptossh.NewClient(sshClientConn, chans, reqs)
+
+	session, err := sshClient.NewSession()
+	require.NoError(t, err, "Should create session through full proxy to backend")
+
+	outputCh := make(chan []byte, 1)
+	errCh := make(chan error, 1)
+	go func() {
+		output, err := session.Output("echo hello-from-proxy")
+		outputCh <- output
+		errCh <- err
+	}()
+
+	select {
+	case output := <-outputCh:
+		err := <-errCh
+		require.NoError(t, err, "Command should execute successfully through proxy")
+		assert.Contains(t, string(output), "hello-from-proxy", "Should receive command output through proxy")
+	case <-time.After(3 * time.Second):
+		t.Fatal("Command execution timed out")
+	}
+
+	_ = session.Close()
+	_ = sshClient.Close()
+	_ = clientConn.Close()
+	cancel()
+}
+
+// TestSSHProxy_CommandQuoting verifies that the proxy preserves shell quoting
+// when forwarding commands to the backend. This is critical for tools like
+// Ansible that send commands such as:
+//
+//	/bin/sh -c '( umask 77 && mkdir -p ... ) && sleep 0'
+//
+// The single quotes must be preserved so the backend shell receives the
+// subshell expression as a single argument to -c.
+func TestSSHProxy_CommandQuoting(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	sshClient, cleanup := setupProxySSHClient(t)
+	defer cleanup()
+
+	// These commands simulate what the SSH protocol delivers as exec payloads.
+	// When a user types: ssh host '/bin/sh -c "( echo hello )"'
+	// the local shell strips the outer single quotes, and the SSH exec request
+	// contains the raw string: /bin/sh -c "( echo hello )"
+	//
+	// The proxy must forward this string verbatim. Using session.Command()
+	// (shlex.Split + strings.Join) strips the inner double quotes, breaking
+	// the command on the backend.
+	tests := []struct {
+		name    string
+		command string
+		expect  string
+	}{
+		{
+			name:    "subshell_in_double_quotes",
+			command: `/bin/sh -c "( echo from-subshell ) && echo outer"`,
+			expect:  "from-subshell\nouter\n",
+		},
+		{
+			name:    "printf_with_special_chars",
+			command: `/bin/sh -c "printf '%s\n' 'hello world'"`,
+			expect:  "hello world\n",
+		},
+		{
+			name:    "nested_command_substitution",
+			command: `/bin/sh -c "echo $(echo nested)"`,
+			expect:  "nested\n",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			session, err := sshClient.NewSession()
+			require.NoError(t, err)
+			defer func() { _ = session.Close() }()
+
+			var stderrBuf bytes.Buffer
+			session.Stderr = &stderrBuf
+
+			outputCh := make(chan []byte, 1)
+			errCh := make(chan error, 1)
+			go func() {
+				output, err := session.Output(tc.command)
+				outputCh <- output
+				errCh <- err
+			}()
+
+			select {
+			case output := <-outputCh:
+				err := <-errCh
+				if stderrBuf.Len() > 0 {
+					t.Logf("stderr: %s", stderrBuf.String())
+				}
+				require.NoError(t, err, "command should succeed: %s", tc.command)
+				assert.Equal(t, tc.expect, string(output), "output mismatch for: %s", tc.command)
+			case <-time.After(5 * time.Second):
+				t.Fatalf("command timed out: %s", tc.command)
+			}
+		})
+	}
+}
+
+// setupProxySSHClient creates a full proxy test environment and returns
+// an SSH client connected through the proxy to a backend NetBird SSH server.
+func setupProxySSHClient(t *testing.T) (*cryptossh.Client, func()) {
+	t.Helper()
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+	hostPubKey, err := nbssh.GeneratePublicKey(hostKey)
+	require.NoError(t, err)
+
+	serverConfig := &server.Config{
+		HostKeyPEM: hostKey,
+		JWT: &server.JWTConfig{
+			Issuer:       issuer,
+			Audiences:    []string{audience},
+			KeysLocation: jwksURL,
+		},
+	}
+	sshServer := server.New(serverConfig)
+	sshServer.SetAllowRootLogin(true)
+
+	testUsername := testutil.GetTestUsername(t)
+	testJWTUser := "test-username"
+	testUserHash, err := sshuserhash.HashUserID(testJWTUser)
+	require.NoError(t, err)
+
+	authConfig := &sshauth.Config{
+		UserIDClaim:     sshauth.DefaultUserIDClaim,
+		AuthorizedUsers: []sshuserhash.UserIDHash{testUserHash},
+		MachineUsers: map[string][]uint32{
+			testUsername: {0},
+		},
+	}
+	sshServer.UpdateSSHAuth(authConfig)
+
+	sshServerAddr := server.StartTestServer(t, sshServer)
+
+	mockDaemon := startMockDaemon(t)
+
+	host, portStr, err := net.SplitHostPort(sshServerAddr)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portStr)
+	require.NoError(t, err)
+
+	mockDaemon.setHostKey(host, hostPubKey)
+
+	validToken := generateValidJWT(t, privateKey, issuer, audience, testJWTUser)
+	mockDaemon.setJWTToken(validToken)
+
+	proxyInstance, err := New(mockDaemon.addr, host, port, io.Discard, nil)
+	require.NoError(t, err)
+
+	origStdin := os.Stdin
+	origStdout := os.Stdout
+
+	stdinReader, stdinWriter, err := os.Pipe()
+	require.NoError(t, err)
+	stdoutReader, stdoutWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	os.Stdin = stdinReader
+	os.Stdout = stdoutWriter
+
+	clientConn, proxyConn := net.Pipe()
+
+	go func() { _, _ = io.Copy(stdinWriter, proxyConn) }()
+	go func() { _, _ = io.Copy(proxyConn, stdoutReader) }()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+
+	go func() {
+		_ = proxyInstance.Connect(ctx)
+	}()
+
+	sshConfig := &cryptossh.ClientConfig{
+		User:            testutil.GetTestUsername(t),
+		Auth:            []cryptossh.AuthMethod{},
+		HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+		Timeout:         5 * time.Second,
+	}
+
+	sshClientConn, chans, reqs, err := cryptossh.NewClientConn(clientConn, "test", sshConfig)
+	require.NoError(t, err)
+
+	client := cryptossh.NewClient(sshClientConn, chans, reqs)
+
+	cleanupFn := func() {
+		_ = client.Close()
+		_ = clientConn.Close()
+		cancel()
+		os.Stdin = origStdin
+		os.Stdout = origStdout
+		_ = sshServer.Stop()
+		mockDaemon.stop()
+		jwksServer.Close()
+	}
+
+	return client, cleanupFn
+}
+
+func setupJWKSServer(t *testing.T) (*httptest.Server, *rsa.PrivateKey, string) {
+	t.Helper()
+	privateKey, jwksJSON := generateTestJWKS(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if _, err := w.Write(jwksJSON); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+	}))
+
+	return server, privateKey, server.URL
+}
+
+func generateTestJWKS(t *testing.T) (*rsa.PrivateKey, []byte) {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	publicKey := &privateKey.PublicKey
+	n := publicKey.N.Bytes()
+	e := publicKey.E
+
+	jwk := nbjwt.JSONWebKey{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Use: "sig",
+		N:   base64.RawURLEncoding.EncodeToString(n),
+		E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(e)).Bytes()),
+	}
+
+	jwks := nbjwt.Jwks{
+		Keys: []nbjwt.JSONWebKey{jwk},
+	}
+
+	jwksJSON, err := json.Marshal(jwks)
+	require.NoError(t, err)
+
+	return privateKey, jwksJSON
+}
+
+func generateValidJWT(t *testing.T, privateKey *rsa.PrivateKey, issuer, audience string, user string) string {
+	t.Helper()
+	claims := jwt.MapClaims{
+		"iss": issuer,
+		"aud": audience,
+		"sub": user,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	token.Header["kid"] = "test-key-id"
+
+	tokenString, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	return tokenString
+}

client/ssh/proxy/proxy_test.go

@@ -0,0 +1,164 @@
+package proxy
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/proto"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+)
+
+func TestMain(m *testing.M) {
+	if len(os.Args) > 2 && os.Args[1] == "ssh" {
+		if os.Args[2] == "exec" {
+			if len(os.Args) > 3 {
+				cmd := os.Args[3]
+				if cmd == "echo" && len(os.Args) > 4 {
+					fmt.Fprintln(os.Stdout, os.Args[4])
+					os.Exit(0)
+				}
+			}
+			fmt.Fprintf(os.Stderr, "Test binary called as 'ssh exec' with args: %v - preventing infinite recursion\n", os.Args)
+			os.Exit(1)
+		}
+	}
+
+	code := m.Run()
+
+	testutil.CleanupTestUsers()
+
+	os.Exit(code)
+}
+
+func TestSSHProxy_verifyHostKey(t *testing.T) {
+	t.Run("calls daemon to verify host key", func(t *testing.T) {
+		mockDaemon := startMockDaemon(t)
+		defer mockDaemon.stop()
+
+		grpcConn, err := grpc.NewClient(mockDaemon.addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+		require.NoError(t, err)
+		defer func() { _ = grpcConn.Close() }()
+
+		proxy := &SSHProxy{
+			daemonAddr:   mockDaemon.addr,
+			daemonClient: proto.NewDaemonServiceClient(grpcConn),
+		}
+
+		testKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+		require.NoError(t, err)
+		testPubKey, err := nbssh.GeneratePublicKey(testKey)
+		require.NoError(t, err)
+
+		mockDaemon.setHostKey("test-host", testPubKey)
+
+		err = proxy.verifyHostKey("test-host", &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 22}, mustParsePublicKey(t, testPubKey))
+		assert.NoError(t, err)
+	})
+
+	t.Run("rejects unknown host key", func(t *testing.T) {
+		mockDaemon := startMockDaemon(t)
+		defer mockDaemon.stop()
+
+		grpcConn, err := grpc.NewClient(mockDaemon.addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+		require.NoError(t, err)
+		defer func() { _ = grpcConn.Close() }()
+
+		proxy := &SSHProxy{
+			daemonAddr:   mockDaemon.addr,
+			daemonClient: proto.NewDaemonServiceClient(grpcConn),
+		}
+
+		unknownKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+		require.NoError(t, err)
+		unknownPubKey, err := nbssh.GeneratePublicKey(unknownKey)
+		require.NoError(t, err)
+
+		err = proxy.verifyHostKey("unknown-host", &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 22}, mustParsePublicKey(t, unknownPubKey))
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "peer unknown-host not found in network")
+	})
+}
+
+type mockDaemonServer struct {
+	proto.UnimplementedDaemonServiceServer
+	hostKeys map[string][]byte
+	jwtToken string
+}
+
+func (m *mockDaemonServer) GetPeerSSHHostKey(ctx context.Context, req *proto.GetPeerSSHHostKeyRequest) (*proto.GetPeerSSHHostKeyResponse, error) {
+	key, found := m.hostKeys[req.PeerAddress]
+	return &proto.GetPeerSSHHostKeyResponse{
+		Found:      found,
+		SshHostKey: key,
+	}, nil
+}
+
+func (m *mockDaemonServer) RequestJWTAuth(ctx context.Context, req *proto.RequestJWTAuthRequest) (*proto.RequestJWTAuthResponse, error) {
+	return &proto.RequestJWTAuthResponse{
+		CachedToken: m.jwtToken,
+	}, nil
+}
+
+func (m *mockDaemonServer) WaitJWTToken(ctx context.Context, req *proto.WaitJWTTokenRequest) (*proto.WaitJWTTokenResponse, error) {
+	return &proto.WaitJWTTokenResponse{
+		Token: m.jwtToken,
+	}, nil
+}
+
+type mockDaemon struct {
+	addr   string
+	server *grpc.Server
+	impl   *mockDaemonServer
+}
+
+func startMockDaemon(t *testing.T) *mockDaemon {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	impl := &mockDaemonServer{
+		hostKeys: make(map[string][]byte),
+		jwtToken: "test-jwt-token",
+	}
+
+	grpcServer := grpc.NewServer()
+	proto.RegisterDaemonServiceServer(grpcServer, impl)
+
+	go func() {
+		_ = grpcServer.Serve(listener)
+	}()
+
+	return &mockDaemon{
+		addr:   listener.Addr().String(),
+		server: grpcServer,
+		impl:   impl,
+	}
+}
+
+func (m *mockDaemon) setHostKey(addr string, pubKey []byte) {
+	m.impl.hostKeys[addr] = pubKey
+}
+
+func (m *mockDaemon) stop() {
+	if m.server != nil {
+		m.server.Stop()
+	}
+}
+
+func mustParsePublicKey(t *testing.T, pubKeyBytes []byte) cryptossh.PublicKey {
+	t.Helper()
+	pubKey, _, _, _, err := cryptossh.ParseAuthorizedKey(pubKeyBytes)
+	require.NoError(t, err)
+	return pubKey
+}

client/ssh/server.go

@@ -1,280 +0,0 @@
-//go:build !js
-
-package ssh
-
-import (
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"os/exec"
-	"os/user"
-	"runtime"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/creack/pty"
-	"github.com/gliderlabs/ssh"
-	log "github.com/sirupsen/logrus"
-)
-
-// DefaultSSHPort is the default SSH port of the NetBird's embedded SSH server
-const DefaultSSHPort = 44338
-
-// TerminalTimeout is the timeout for terminal session to be ready
-const TerminalTimeout = 10 * time.Second
-
-// TerminalBackoffDelay is the delay between terminal session readiness checks
-const TerminalBackoffDelay = 500 * time.Millisecond
-
-// DefaultSSHServer is a function that creates DefaultServer
-func DefaultSSHServer(hostKeyPEM []byte, addr string) (Server, error) {
-	return newDefaultServer(hostKeyPEM, addr)
-}
-
-// Server is an interface of SSH server
-type Server interface {
-	// Stop stops SSH server.
-	Stop() error
-	// Start starts SSH server. Blocking
-	Start() error
-	// RemoveAuthorizedKey removes SSH key of a given peer from the authorized keys
-	RemoveAuthorizedKey(peer string)
-	// AddAuthorizedKey add a given peer key to server authorized keys
-	AddAuthorizedKey(peer, newKey string) error
-}
-
-// DefaultServer is the embedded NetBird SSH server
-type DefaultServer struct {
-	listener net.Listener
-	// authorizedKeys is ssh pub key indexed by peer WireGuard public key
-	authorizedKeys map[string]ssh.PublicKey
-	mu             sync.Mutex
-	hostKeyPEM     []byte
-	sessions       []ssh.Session
-}
-
-// newDefaultServer creates new server with provided host key
-func newDefaultServer(hostKeyPEM []byte, addr string) (*DefaultServer, error) {
-	ln, err := net.Listen("tcp", addr)
-	if err != nil {
-		return nil, err
-	}
-	allowedKeys := make(map[string]ssh.PublicKey)
-	return &DefaultServer{listener: ln, mu: sync.Mutex{}, hostKeyPEM: hostKeyPEM, authorizedKeys: allowedKeys, sessions: make([]ssh.Session, 0)}, nil
-}
-
-// RemoveAuthorizedKey removes SSH key of a given peer from the authorized keys
-func (srv *DefaultServer) RemoveAuthorizedKey(peer string) {
-	srv.mu.Lock()
-	defer srv.mu.Unlock()
-
-	delete(srv.authorizedKeys, peer)
-}
-
-// AddAuthorizedKey add a given peer key to server authorized keys
-func (srv *DefaultServer) AddAuthorizedKey(peer, newKey string) error {
-	srv.mu.Lock()
-	defer srv.mu.Unlock()
-
-	parsedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(newKey))
-	if err != nil {
-		return err
-	}
-
-	srv.authorizedKeys[peer] = parsedKey
-	return nil
-}
-
-// Stop stops SSH server.
-func (srv *DefaultServer) Stop() error {
-	srv.mu.Lock()
-	defer srv.mu.Unlock()
-	err := srv.listener.Close()
-	if err != nil {
-		return err
-	}
-	for _, session := range srv.sessions {
-		err := session.Close()
-		if err != nil {
-			log.Warnf("failed closing SSH session from %v", err)
-		}
-	}
-
-	return nil
-}
-
-func (srv *DefaultServer) publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
-	srv.mu.Lock()
-	defer srv.mu.Unlock()
-
-	for _, allowed := range srv.authorizedKeys {
-		if ssh.KeysEqual(allowed, key) {
-			return true
-		}
-	}
-
-	return false
-}
-
-func prepareUserEnv(user *user.User, shell string) []string {
-	return []string{
-		fmt.Sprint("SHELL=" + shell),
-		fmt.Sprint("USER=" + user.Username),
-		fmt.Sprint("HOME=" + user.HomeDir),
-	}
-}
-
-func acceptEnv(s string) bool {
-	split := strings.Split(s, "=")
-	if len(split) != 2 {
-		return false
-	}
-	return split[0] == "TERM" || split[0] == "LANG" || strings.HasPrefix(split[0], "LC_")
-}
-
-// sessionHandler handles SSH session post auth
-func (srv *DefaultServer) sessionHandler(session ssh.Session) {
-	srv.mu.Lock()
-	srv.sessions = append(srv.sessions, session)
-	srv.mu.Unlock()
-
-	defer func() {
-		err := session.Close()
-		if err != nil {
-			return
-		}
-	}()
-
-	log.Infof("Establishing SSH session for %s from host %s", session.User(), session.RemoteAddr().String())
-
-	localUser, err := userNameLookup(session.User())
-	if err != nil {
-		_, err = fmt.Fprintf(session, "remote SSH server couldn't find local user %s\n", session.User()) //nolint
-		err = session.Exit(1)
-		if err != nil {
-			return
-		}
-		log.Warnf("failed SSH session from %v, user %s", session.RemoteAddr(), session.User())
-		return
-	}
-
-	ptyReq, winCh, isPty := session.Pty()
-	if isPty {
-		loginCmd, loginArgs, err := getLoginCmd(localUser.Username, session.RemoteAddr())
-		if err != nil {
-			log.Warnf("failed logging-in user %s from remote IP %s", localUser.Username, session.RemoteAddr().String())
-			return
-		}
-		cmd := exec.Command(loginCmd, loginArgs...)
-		go func() {
-			<-session.Context().Done()
-			if cmd.Process == nil {
-				return
-			}
-			err := cmd.Process.Kill()
-			if err != nil {
-				log.Debugf("failed killing SSH process %v", err)
-				return
-			}
-		}()
-		cmd.Dir = localUser.HomeDir
-		cmd.Env = append(cmd.Env, fmt.Sprintf("TERM=%s", ptyReq.Term))
-		cmd.Env = append(cmd.Env, prepareUserEnv(localUser, getUserShell(localUser.Uid))...)
-		for _, v := range session.Environ() {
-			if acceptEnv(v) {
-				cmd.Env = append(cmd.Env, v)
-			}
-		}
-
-		log.Debugf("Login command: %s", cmd.String())
-		file, err := pty.Start(cmd)
-		if err != nil {
-			log.Errorf("failed starting SSH server: %v", err)
-		}
-
-		go func() {
-			for win := range winCh {
-				setWinSize(file, win.Width, win.Height)
-			}
-		}()
-
-		srv.stdInOut(file, session)
-
-		err = cmd.Wait()
-		if err != nil {
-			return
-		}
-	} else {
-		_, err := io.WriteString(session, "only PTY is supported.\n")
-		if err != nil {
-			return
-		}
-		err = session.Exit(1)
-		if err != nil {
-			return
-		}
-	}
-	log.Debugf("SSH session ended")
-}
-
-func (srv *DefaultServer) stdInOut(file *os.File, session ssh.Session) {
-	go func() {
-		// stdin
-		_, err := io.Copy(file, session)
-		if err != nil {
-			_ = session.Exit(1)
-			return
-		}
-	}()
-
-	// AWS Linux 2 machines need some time to open the terminal so we need to wait for it
-	timer := time.NewTimer(TerminalTimeout)
-	for {
-		select {
-		case <-timer.C:
-			_, _ = session.Write([]byte("Reached timeout while opening connection\n"))
-			_ = session.Exit(1)
-			return
-		default:
-			// stdout
-			writtenBytes, err := io.Copy(session, file)
-			if err != nil && writtenBytes != 0 {
-				_ = session.Exit(0)
-				return
-			}
-			time.Sleep(TerminalBackoffDelay)
-		}
-	}
-}
-
-// Start starts SSH server. Blocking
-func (srv *DefaultServer) Start() error {
-	log.Infof("starting SSH server on addr: %s", srv.listener.Addr().String())
-
-	publicKeyOption := ssh.PublicKeyAuth(srv.publicKeyHandler)
-	hostKeyPEM := ssh.HostKeyPEM(srv.hostKeyPEM)
-	err := ssh.Serve(srv.listener, srv.sessionHandler, publicKeyOption, hostKeyPEM)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func getUserShell(userID string) string {
-	if runtime.GOOS == "linux" {
-		output, _ := exec.Command("getent", "passwd", userID).Output()
-		line := strings.SplitN(string(output), ":", 10)
-		if len(line) > 6 {
-			return strings.TrimSpace(line[6])
-		}
-	}
-
-	shell := os.Getenv("SHELL")
-	if shell == "" {
-		shell = "/bin/sh"
-	}
-	return shell
-}

client/ssh/server/command_execution.go

@@ -0,0 +1,205 @@
+package server
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// handleExecution executes an SSH command or shell with privilege validation
+func (s *Server) handleExecution(logger *log.Entry, session ssh.Session, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, winCh <-chan ssh.Window) {
+	hasPty := winCh != nil
+
+	commandType := "command"
+	if hasPty {
+		commandType = "Pty command"
+	}
+
+	logger.Infof("executing %s: %s", commandType, safeLogCommand(session.Command()))
+
+	execCmd, cleanup, err := s.createCommand(logger, privilegeResult, session, hasPty)
+	if err != nil {
+		logger.Errorf("%s creation failed: %v", commandType, err)
+
+		errorMsg := fmt.Sprintf("Cannot create %s - platform may not support user switching", commandType)
+		if hasPty {
+			errorMsg += " with Pty"
+		}
+		errorMsg += "\n"
+
+		if _, writeErr := fmt.Fprint(session.Stderr(), errorMsg); writeErr != nil {
+			logger.Debugf(errWriteSession, writeErr)
+		}
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return
+	}
+
+	if !hasPty {
+		if s.executeCommand(logger, session, execCmd, cleanup) {
+			logger.Debugf("%s execution completed", commandType)
+		}
+		return
+	}
+
+	defer cleanup()
+
+	if s.executeCommandWithPty(logger, session, execCmd, privilegeResult, ptyReq, winCh) {
+		logger.Debugf("%s execution completed", commandType)
+	}
+}
+
+func (s *Server) createCommand(logger *log.Entry, privilegeResult PrivilegeCheckResult, session ssh.Session, hasPty bool) (*exec.Cmd, func(), error) {
+	localUser := privilegeResult.User
+	if localUser == nil {
+		return nil, nil, errors.New("no user in privilege result")
+	}
+
+	// If PTY requested but su doesn't support --pty, skip su and use executor
+	// This ensures PTY functionality is provided (executor runs within our allocated PTY)
+	if hasPty && !s.suSupportsPty {
+		logger.Debugf("PTY requested but su doesn't support --pty, using executor for PTY functionality")
+		cmd, cleanup, err := s.createExecutorCommand(logger, session, localUser, hasPty)
+		if err != nil {
+			return nil, nil, fmt.Errorf("create command with privileges: %w", err)
+		}
+		cmd.Env = s.prepareCommandEnv(logger, localUser, session)
+		return cmd, cleanup, nil
+	}
+
+	// Try su first for system integration (PAM/audit) when privileged
+	cmd, err := s.createSuCommand(logger, session, localUser, hasPty)
+	if err != nil || privilegeResult.UsedFallback {
+		logger.Debugf("su command failed, falling back to executor: %v", err)
+		cmd, cleanup, err := s.createExecutorCommand(logger, session, localUser, hasPty)
+		if err != nil {
+			return nil, nil, fmt.Errorf("create command with privileges: %w", err)
+		}
+		cmd.Env = s.prepareCommandEnv(logger, localUser, session)
+		return cmd, cleanup, nil
+	}
+
+	cmd.Env = s.prepareCommandEnv(logger, localUser, session)
+	return cmd, func() {}, nil
+}
+
+// executeCommand executes the command and handles I/O and exit codes
+func (s *Server) executeCommand(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, cleanup func()) bool {
+	defer cleanup()
+
+	s.setupProcessGroup(execCmd)
+
+	stdinPipe, err := execCmd.StdinPipe()
+	if err != nil {
+		logger.Errorf("create stdin pipe: %v", err)
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+	}
+
+	execCmd.Stdout = session
+	execCmd.Stderr = session.Stderr()
+
+	if execCmd.Dir != "" {
+		if _, err := os.Stat(execCmd.Dir); err != nil {
+			logger.Warnf("working directory does not exist: %s (%v)", execCmd.Dir, err)
+			execCmd.Dir = "/"
+		}
+	}
+
+	if err := execCmd.Start(); err != nil {
+		logger.Errorf("command start failed: %v", err)
+		// no user message for exec failure, just exit
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+	}
+
+	go s.handleCommandIO(logger, stdinPipe, session)
+	return s.waitForCommandCleanup(logger, session, execCmd)
+}
+
+// handleCommandIO manages stdin/stdout copying in a goroutine
+func (s *Server) handleCommandIO(logger *log.Entry, stdinPipe io.WriteCloser, session ssh.Session) {
+	defer func() {
+		if err := stdinPipe.Close(); err != nil {
+			logger.Debugf("stdin pipe close error: %v", err)
+		}
+	}()
+	if _, err := io.Copy(stdinPipe, session); err != nil {
+		logger.Debugf("stdin copy error: %v", err)
+	}
+}
+
+// waitForCommandCleanup waits for command completion with session disconnect handling
+func (s *Server) waitForCommandCleanup(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd) bool {
+	ctx := session.Context()
+	done := make(chan error, 1)
+	go func() {
+		done <- execCmd.Wait()
+	}()
+
+	select {
+	case <-ctx.Done():
+		logger.Debugf("session cancelled, terminating command")
+		s.killProcessGroup(execCmd)
+
+		select {
+		case err := <-done:
+			logger.Tracef("command terminated after session cancellation: %v", err)
+		case <-time.After(5 * time.Second):
+			logger.Warnf("command did not terminate within 5 seconds after session cancellation")
+		}
+
+		if err := session.Exit(130); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+
+	case err := <-done:
+		return s.handleCommandCompletion(logger, session, err)
+	}
+}
+
+// handleCommandCompletion handles command completion
+func (s *Server) handleCommandCompletion(logger *log.Entry, session ssh.Session, err error) bool {
+	if err != nil {
+		logger.Debugf("command execution failed: %v", err)
+		s.handleSessionExit(session, err, logger)
+		return false
+	}
+
+	s.handleSessionExit(session, nil, logger)
+	return true
+}
+
+// handleSessionExit handles command errors and sets appropriate exit codes
+func (s *Server) handleSessionExit(session ssh.Session, err error, logger *log.Entry) {
+	if err == nil {
+		if err := session.Exit(0); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return
+	}
+
+	var exitError *exec.ExitError
+	if errors.As(err, &exitError) {
+		if err := session.Exit(exitError.ExitCode()); err != nil {
+			logSessionExitError(logger, err)
+		}
+	} else {
+		logger.Debugf("non-exit error in command execution: %v", err)
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+	}
+}

client/ssh/server/command_execution_js.go

@@ -0,0 +1,57 @@
+//go:build js
+
+package server
+
+import (
+	"context"
+	"errors"
+	"os/exec"
+	"os/user"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+var errNotSupported = errors.New("SSH server command execution not supported on WASM/JS platform")
+
+// createSuCommand is not supported on JS/WASM
+func (s *Server) createSuCommand(_ *log.Entry, _ ssh.Session, _ *user.User, _ bool) (*exec.Cmd, error) {
+	return nil, errNotSupported
+}
+
+// createExecutorCommand is not supported on JS/WASM
+func (s *Server) createExecutorCommand(_ *log.Entry, _ ssh.Session, _ *user.User, _ bool) (*exec.Cmd, func(), error) {
+	return nil, nil, errNotSupported
+}
+
+// prepareCommandEnv is not supported on JS/WASM
+func (s *Server) prepareCommandEnv(_ *log.Entry, _ *user.User, _ ssh.Session) []string {
+	return nil
+}
+
+// setupProcessGroup is not supported on JS/WASM
+func (s *Server) setupProcessGroup(_ *exec.Cmd) {
+}
+
+// killProcessGroup is not supported on JS/WASM
+func (s *Server) killProcessGroup(*exec.Cmd) {
+}
+
+// detectSuPtySupport always returns false on JS/WASM
+func (s *Server) detectSuPtySupport(context.Context) bool {
+	return false
+}
+
+// detectUtilLinuxLogin always returns false on JS/WASM
+func (s *Server) detectUtilLinuxLogin(context.Context) bool {
+	return false
+}
+
+// executeCommandWithPty is not supported on JS/WASM
+func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, winCh <-chan ssh.Window) bool {
+	logger.Errorf("PTY command execution not supported on JS/WASM")
+	if err := session.Exit(1); err != nil {
+		logSessionExitError(logger, err)
+	}
+	return false
+}

client/ssh/server/command_execution_unix.go

@@ -0,0 +1,364 @@
+//go:build unix
+
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/creack/pty"
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// ptyManager manages Pty file operations with thread safety
+type ptyManager struct {
+	file     *os.File
+	mu       sync.RWMutex
+	closed   bool
+	closeErr error
+	once     sync.Once
+}
+
+func newPtyManager(file *os.File) *ptyManager {
+	return &ptyManager{file: file}
+}
+
+func (pm *ptyManager) Close() error {
+	pm.once.Do(func() {
+		pm.mu.Lock()
+		pm.closed = true
+		pm.closeErr = pm.file.Close()
+		pm.mu.Unlock()
+	})
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+	return pm.closeErr
+}
+
+func (pm *ptyManager) Setsize(ws *pty.Winsize) error {
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+	if pm.closed {
+		return errors.New("pty is closed")
+	}
+	return pty.Setsize(pm.file, ws)
+}
+
+func (pm *ptyManager) File() *os.File {
+	return pm.file
+}
+
+// detectSuPtySupport checks if su supports the --pty flag
+func (s *Server) detectSuPtySupport(ctx context.Context) bool {
+	ctx, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "su", "--help")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Debugf("su --help failed (may not support --help): %v", err)
+		return false
+	}
+
+	supported := strings.Contains(string(output), "--pty")
+	log.Debugf("su --pty support detected: %v", supported)
+	return supported
+}
+
+// detectUtilLinuxLogin checks if login is from util-linux (vs shadow-utils).
+// util-linux login uses vhangup() which requires setsid wrapper to avoid killing parent.
+// See https://bugs.debian.org/1078023 for details.
+func (s *Server) detectUtilLinuxLogin(ctx context.Context) bool {
+	if runtime.GOOS != "linux" {
+		return false
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "login", "--version")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Debugf("login --version failed (likely shadow-utils): %v", err)
+		return false
+	}
+
+	isUtilLinux := strings.Contains(string(output), "util-linux")
+	log.Debugf("util-linux login detected: %v", isUtilLinux)
+	return isUtilLinux
+}
+
+// createSuCommand creates a command using su - for privilege switching.
+func (s *Server) createSuCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, error) {
+	if err := validateUsername(localUser.Username); err != nil {
+		return nil, fmt.Errorf("invalid username %q: %w", localUser.Username, err)
+	}
+
+	suPath, err := exec.LookPath("su")
+	if err != nil {
+		return nil, fmt.Errorf("su command not available: %w", err)
+	}
+
+	args := []string{"-"}
+	if hasPty && s.suSupportsPty {
+		args = append(args, "--pty")
+	}
+	args = append(args, localUser.Username)
+
+	command := session.RawCommand()
+	if command != "" {
+		args = append(args, "-c", command)
+	}
+
+	logger.Debugf("creating su command: %s %v", suPath, args)
+	cmd := exec.CommandContext(session.Context(), suPath, args...)
+	cmd.Dir = localUser.HomeDir
+
+	return cmd, nil
+}
+
+// getShellCommandArgs returns the shell command and arguments for executing a command string.
+func (s *Server) getShellCommandArgs(shell, cmdString string) []string {
+	if cmdString == "" {
+		return []string{shell}
+	}
+	return []string{shell, "-c", cmdString}
+}
+
+// createShellCommand creates an exec.Cmd configured as a login shell by setting argv[0] to "-shellname".
+func (s *Server) createShellCommand(ctx context.Context, shell string, args []string) *exec.Cmd {
+	cmd := exec.CommandContext(ctx, shell, args[1:]...)
+	cmd.Args[0] = "-" + filepath.Base(shell)
+	return cmd
+}
+
+// prepareCommandEnv prepares environment variables for command execution on Unix
+func (s *Server) prepareCommandEnv(_ *log.Entry, localUser *user.User, session ssh.Session) []string {
+	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env = append(env, prepareSSHEnv(session)...)
+	for _, v := range session.Environ() {
+		if acceptEnv(v) {
+			env = append(env, v)
+		}
+	}
+	return env
+}
+
+// executeCommandWithPty executes a command with PTY allocation
+func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, winCh <-chan ssh.Window) bool {
+	termType := ptyReq.Term
+	if termType == "" {
+		termType = "xterm-256color"
+	}
+	execCmd.Env = append(execCmd.Env, fmt.Sprintf("TERM=%s", termType))
+
+	return s.runPtyCommand(logger, session, execCmd, ptyReq, winCh)
+}
+
+func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, winCh <-chan ssh.Window) bool {
+	execCmd, err := s.createPtyCommand(privilegeResult, ptyReq, session)
+	if err != nil {
+		logger.Errorf("Pty command creation failed: %v", err)
+		errorMsg := "User switching failed - login command not available\r\n"
+		if _, writeErr := fmt.Fprint(session.Stderr(), errorMsg); writeErr != nil {
+			logger.Debugf(errWriteSession, writeErr)
+		}
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+	}
+
+	logger.Infof("starting interactive shell: %s", strings.Join(execCmd.Args, " "))
+	return s.runPtyCommand(logger, session, execCmd, ptyReq, winCh)
+}
+
+// runPtyCommand runs a command with PTY management (common code for interactive and command execution)
+func (s *Server) runPtyCommand(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, ptyReq ssh.Pty, winCh <-chan ssh.Window) bool {
+	ptmx, err := s.startPtyCommandWithSize(execCmd, ptyReq)
+	if err != nil {
+		logger.Errorf("Pty start failed: %v", err)
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+	}
+
+	ptyMgr := newPtyManager(ptmx)
+	defer func() {
+		if err := ptyMgr.Close(); err != nil {
+			logger.Debugf("Pty close error: %v", err)
+		}
+	}()
+
+	go s.handlePtyWindowResize(logger, session, ptyMgr, winCh)
+	s.handlePtyIO(logger, session, ptyMgr)
+	s.waitForPtyCompletion(logger, session, execCmd, ptyMgr)
+	return true
+}
+
+func (s *Server) startPtyCommandWithSize(execCmd *exec.Cmd, ptyReq ssh.Pty) (*os.File, error) {
+	winSize := &pty.Winsize{
+		Cols: uint16(ptyReq.Window.Width),
+		Rows: uint16(ptyReq.Window.Height),
+	}
+	if winSize.Cols == 0 {
+		winSize.Cols = 80
+	}
+	if winSize.Rows == 0 {
+		winSize.Rows = 24
+	}
+
+	ptmx, err := pty.StartWithSize(execCmd, winSize)
+	if err != nil {
+		return nil, fmt.Errorf("start Pty: %w", err)
+	}
+
+	return ptmx, nil
+}
+
+func (s *Server) handlePtyWindowResize(logger *log.Entry, session ssh.Session, ptyMgr *ptyManager, winCh <-chan ssh.Window) {
+	for {
+		select {
+		case <-session.Context().Done():
+			return
+		case win, ok := <-winCh:
+			if !ok {
+				return
+			}
+			if err := ptyMgr.Setsize(&pty.Winsize{Rows: uint16(win.Height), Cols: uint16(win.Width)}); err != nil {
+				logger.Debugf("Pty resize to %dx%d: %v", win.Width, win.Height, err)
+			}
+		}
+	}
+}
+
+func (s *Server) handlePtyIO(logger *log.Entry, session ssh.Session, ptyMgr *ptyManager) {
+	ptmx := ptyMgr.File()
+
+	go func() {
+		if _, err := io.Copy(ptmx, session); err != nil {
+			if !errors.Is(err, io.EOF) && !errors.Is(err, syscall.EIO) {
+				logger.Warnf("Pty input copy error: %v", err)
+			}
+		}
+	}()
+
+	go func() {
+		if _, err := io.Copy(session, ptmx); err != nil {
+			if !errors.Is(err, io.EOF) && !errors.Is(err, syscall.EIO) {
+				logger.Warnf("Pty output copy error: %v", err)
+			}
+		}
+	}()
+}
+
+func (s *Server) waitForPtyCompletion(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, ptyMgr *ptyManager) {
+	ctx := session.Context()
+	done := make(chan error, 1)
+	go func() {
+		done <- execCmd.Wait()
+	}()
+
+	select {
+	case <-ctx.Done():
+		s.handlePtySessionCancellation(logger, session, execCmd, ptyMgr, done)
+	case err := <-done:
+		s.handlePtyCommandCompletion(logger, session, ptyMgr, err)
+	}
+}
+
+func (s *Server) handlePtySessionCancellation(logger *log.Entry, session ssh.Session, execCmd *exec.Cmd, ptyMgr *ptyManager, done <-chan error) {
+	logger.Debugf("Pty session cancelled, terminating command")
+	if err := ptyMgr.Close(); err != nil {
+		logger.Debugf("Pty close during session cancellation: %v", err)
+	}
+
+	s.killProcessGroup(execCmd)
+
+	select {
+	case err := <-done:
+		if err != nil {
+			logger.Debugf("Pty command terminated after session cancellation with error: %v", err)
+		} else {
+			logger.Debugf("Pty command terminated after session cancellation")
+		}
+	case <-time.After(5 * time.Second):
+		logger.Warnf("Pty command did not terminate within 5 seconds after session cancellation")
+	}
+
+	if err := session.Exit(130); err != nil {
+		logSessionExitError(logger, err)
+	}
+}
+
+func (s *Server) handlePtyCommandCompletion(logger *log.Entry, session ssh.Session, ptyMgr *ptyManager, err error) {
+	if err != nil {
+		logger.Debugf("Pty command execution failed: %v", err)
+		s.handleSessionExit(session, err, logger)
+	} else {
+		logger.Debugf("Pty command completed successfully")
+		if err := session.Exit(0); err != nil {
+			logSessionExitError(logger, err)
+		}
+	}
+
+	// Close PTY to unblock io.Copy goroutines
+	if err := ptyMgr.Close(); err != nil {
+		logger.Debugf("Pty close after completion: %v", err)
+	}
+}
+
+func (s *Server) setupProcessGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setpgid: true,
+	}
+}
+
+func (s *Server) killProcessGroup(cmd *exec.Cmd) {
+	if cmd.Process == nil {
+		return
+	}
+
+	logger := log.WithField("pid", cmd.Process.Pid)
+	pgid := cmd.Process.Pid
+
+	if err := syscall.Kill(-pgid, syscall.SIGTERM); err != nil {
+		logger.Debugf("kill process group SIGTERM: %v", err)
+		return
+	}
+
+	const gracePeriod = 500 * time.Millisecond
+	const checkInterval = 50 * time.Millisecond
+
+	ticker := time.NewTicker(checkInterval)
+	defer ticker.Stop()
+
+	timeout := time.After(gracePeriod)
+
+	for {
+		select {
+		case <-timeout:
+			if err := syscall.Kill(-pgid, syscall.SIGKILL); err != nil {
+				logger.Debugf("kill process group SIGKILL: %v", err)
+			}
+			return
+		case <-ticker.C:
+			if err := syscall.Kill(-pgid, 0); err != nil {
+				return
+			}
+		}
+	}
+}

client/ssh/server/command_execution_windows.go

@@ -0,0 +1,408 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"strings"
+	"unsafe"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+	"golang.org/x/sys/windows/registry"
+
+	"github.com/netbirdio/netbird/client/ssh/server/winpty"
+)
+
+// getUserEnvironment retrieves the Windows environment for the target user.
+// Follows OpenSSH's resilient approach with graceful degradation on failures.
+func (s *Server) getUserEnvironment(logger *log.Entry, username, domain string) ([]string, error) {
+	userToken, err := s.getUserToken(logger, username, domain)
+	if err != nil {
+		return nil, fmt.Errorf("get user token: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(userToken); err != nil {
+			logger.Debugf("close user token: %v", err)
+		}
+	}()
+
+	return s.getUserEnvironmentWithToken(logger, userToken, username, domain)
+}
+
+// getUserEnvironmentWithToken retrieves the Windows environment using an existing token.
+func (s *Server) getUserEnvironmentWithToken(logger *log.Entry, userToken windows.Handle, username, domain string) ([]string, error) {
+	userProfile, err := s.loadUserProfile(userToken, username, domain)
+	if err != nil {
+		logger.Debugf("failed to load user profile for %s\\%s: %v", domain, username, err)
+		userProfile = fmt.Sprintf("C:\\Users\\%s", username)
+	}
+
+	envMap := make(map[string]string)
+
+	if err := s.loadSystemEnvironment(envMap); err != nil {
+		logger.Debugf("failed to load system environment from registry: %v", err)
+	}
+
+	s.setUserEnvironmentVariables(envMap, userProfile, username, domain)
+
+	var env []string
+	for key, value := range envMap {
+		env = append(env, key+"="+value)
+	}
+
+	return env, nil
+}
+
+// getUserToken creates a user token for the specified user.
+func (s *Server) getUserToken(logger *log.Entry, username, domain string) (windows.Handle, error) {
+	privilegeDropper := NewPrivilegeDropper(WithLogger(logger))
+	token, err := privilegeDropper.createToken(username, domain)
+	if err != nil {
+		return 0, fmt.Errorf("generate S4U user token: %w", err)
+	}
+	return token, nil
+}
+
+// loadUserProfile loads the Windows user profile and returns the profile path.
+func (s *Server) loadUserProfile(userToken windows.Handle, username, domain string) (string, error) {
+	usernamePtr, err := windows.UTF16PtrFromString(username)
+	if err != nil {
+		return "", fmt.Errorf("convert username to UTF-16: %w", err)
+	}
+
+	var domainUTF16 *uint16
+	if domain != "" && domain != "." {
+		domainUTF16, err = windows.UTF16PtrFromString(domain)
+		if err != nil {
+			return "", fmt.Errorf("convert domain to UTF-16: %w", err)
+		}
+	}
+
+	type profileInfo struct {
+		dwSize        uint32
+		dwFlags       uint32
+		lpUserName    *uint16
+		lpProfilePath *uint16
+		lpDefaultPath *uint16
+		lpServerName  *uint16
+		lpPolicyPath  *uint16
+		hProfile      windows.Handle
+	}
+
+	const PI_NOUI = 0x00000001
+
+	profile := profileInfo{
+		dwSize:       uint32(unsafe.Sizeof(profileInfo{})),
+		dwFlags:      PI_NOUI,
+		lpUserName:   usernamePtr,
+		lpServerName: domainUTF16,
+	}
+
+	userenv := windows.NewLazySystemDLL("userenv.dll")
+	loadUserProfileW := userenv.NewProc("LoadUserProfileW")
+
+	ret, _, err := loadUserProfileW.Call(
+		uintptr(userToken),
+		uintptr(unsafe.Pointer(&profile)),
+	)
+
+	if ret == 0 {
+		return "", fmt.Errorf("LoadUserProfileW: %w", err)
+	}
+
+	if profile.lpProfilePath == nil {
+		return "", fmt.Errorf("LoadUserProfileW returned null profile path")
+	}
+
+	profilePath := windows.UTF16PtrToString(profile.lpProfilePath)
+	return profilePath, nil
+}
+
+// loadSystemEnvironment loads system-wide environment variables from registry.
+func (s *Server) loadSystemEnvironment(envMap map[string]string) error {
+	key, err := registry.OpenKey(registry.LOCAL_MACHINE,
+		`SYSTEM\CurrentControlSet\Control\Session Manager\Environment`,
+		registry.QUERY_VALUE)
+	if err != nil {
+		return fmt.Errorf("open system environment registry key: %w", err)
+	}
+	defer func() {
+		if err := key.Close(); err != nil {
+			log.Debugf("close registry key: %v", err)
+		}
+	}()
+
+	return s.readRegistryEnvironment(key, envMap)
+}
+
+// readRegistryEnvironment reads environment variables from a registry key.
+func (s *Server) readRegistryEnvironment(key registry.Key, envMap map[string]string) error {
+	names, err := key.ReadValueNames(0)
+	if err != nil {
+		return fmt.Errorf("read registry value names: %w", err)
+	}
+
+	for _, name := range names {
+		value, valueType, err := key.GetStringValue(name)
+		if err != nil {
+			log.Debugf("failed to read registry value %s: %v", name, err)
+			continue
+		}
+
+		finalValue := s.expandRegistryValue(value, valueType, name)
+		s.setEnvironmentVariable(envMap, name, finalValue)
+	}
+
+	return nil
+}
+
+// expandRegistryValue expands registry values if they contain environment variables.
+func (s *Server) expandRegistryValue(value string, valueType uint32, name string) string {
+	if valueType != registry.EXPAND_SZ {
+		return value
+	}
+
+	sourcePtr := windows.StringToUTF16Ptr(value)
+	expandedBuffer := make([]uint16, 1024)
+	expandedLen, err := windows.ExpandEnvironmentStrings(sourcePtr, &expandedBuffer[0], uint32(len(expandedBuffer)))
+	if err != nil {
+		log.Debugf("failed to expand environment string for %s: %v", name, err)
+		return value
+	}
+
+	// If buffer was too small, retry with larger buffer
+	if expandedLen > uint32(len(expandedBuffer)) {
+		expandedBuffer = make([]uint16, expandedLen)
+		expandedLen, err = windows.ExpandEnvironmentStrings(sourcePtr, &expandedBuffer[0], uint32(len(expandedBuffer)))
+		if err != nil {
+			log.Debugf("failed to expand environment string for %s on retry: %v", name, err)
+			return value
+		}
+	}
+
+	if expandedLen > 0 && expandedLen <= uint32(len(expandedBuffer)) {
+		return windows.UTF16ToString(expandedBuffer[:expandedLen-1])
+	}
+	return value
+}
+
+// setEnvironmentVariable sets an environment variable with special handling for PATH.
+func (s *Server) setEnvironmentVariable(envMap map[string]string, name, value string) {
+	upperName := strings.ToUpper(name)
+
+	if upperName == "PATH" {
+		if existing, exists := envMap["PATH"]; exists && existing != value {
+			envMap["PATH"] = existing + ";" + value
+		} else {
+			envMap["PATH"] = value
+		}
+	} else {
+		envMap[upperName] = value
+	}
+}
+
+// setUserEnvironmentVariables sets critical user-specific environment variables.
+func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfile, username, domain string) {
+	envMap["USERPROFILE"] = userProfile
+
+	if len(userProfile) >= 2 && userProfile[1] == ':' {
+		envMap["HOMEDRIVE"] = userProfile[:2]
+		envMap["HOMEPATH"] = userProfile[2:]
+	}
+
+	envMap["APPDATA"] = filepath.Join(userProfile, "AppData", "Roaming")
+	envMap["LOCALAPPDATA"] = filepath.Join(userProfile, "AppData", "Local")
+
+	tempDir := filepath.Join(userProfile, "AppData", "Local", "Temp")
+	envMap["TEMP"] = tempDir
+	envMap["TMP"] = tempDir
+
+	envMap["USERNAME"] = username
+	if domain != "" && domain != "." {
+		envMap["USERDOMAIN"] = domain
+		envMap["USERDNSDOMAIN"] = domain
+	}
+
+	systemVars := []string{
+		"PROCESSOR_ARCHITECTURE", "PROCESSOR_IDENTIFIER", "PROCESSOR_LEVEL", "PROCESSOR_REVISION",
+		"SYSTEMDRIVE", "SYSTEMROOT", "WINDIR", "COMPUTERNAME", "OS", "PATHEXT",
+		"PROGRAMFILES", "PROGRAMDATA", "ALLUSERSPROFILE", "COMSPEC",
+	}
+
+	for _, sysVar := range systemVars {
+		if sysValue := os.Getenv(sysVar); sysValue != "" {
+			envMap[sysVar] = sysValue
+		}
+	}
+}
+
+// prepareCommandEnv prepares environment variables for command execution on Windows
+func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
+	username, domain := s.parseUsername(localUser.Username)
+	userEnv, err := s.getUserEnvironment(logger, username, domain)
+	if err != nil {
+		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
+		env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+		env = append(env, prepareSSHEnv(session)...)
+		for _, v := range session.Environ() {
+			if acceptEnv(v) {
+				env = append(env, v)
+			}
+		}
+		return env
+	}
+
+	env := userEnv
+	env = append(env, prepareSSHEnv(session)...)
+	for _, v := range session.Environ() {
+		if acceptEnv(v) {
+			env = append(env, v)
+		}
+	}
+	return env
+}
+
+func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, _ <-chan ssh.Window) bool {
+	if privilegeResult.User == nil {
+		logger.Errorf("no user in privilege result")
+		return false
+	}
+
+	shell := getUserShell(privilegeResult.User.Uid)
+	logger.Infof("starting interactive shell: %s", shell)
+
+	s.executeCommandWithPty(logger, session, nil, privilegeResult, ptyReq, nil)
+	return true
+}
+
+// getShellCommandArgs returns the shell command and arguments for executing a command string
+func (s *Server) getShellCommandArgs(shell, cmdString string) []string {
+	if cmdString == "" {
+		return []string{shell, "-NoLogo"}
+	}
+	return []string{shell, "-Command", cmdString}
+}
+
+type PtyExecutionRequest struct {
+	Shell    string
+	Command  string
+	Width    int
+	Height   int
+	Username string
+	Domain   string
+}
+
+func executePtyCommandWithUserToken(logger *log.Entry, session ssh.Session, req PtyExecutionRequest) error {
+	logger.Tracef("executing Windows ConPty command with user switching: shell=%s, command=%s, user=%s\\%s, size=%dx%d",
+		req.Shell, req.Command, req.Domain, req.Username, req.Width, req.Height)
+
+	privilegeDropper := NewPrivilegeDropper(WithLogger(logger))
+	userToken, err := privilegeDropper.createToken(req.Username, req.Domain)
+	if err != nil {
+		return fmt.Errorf("create user token: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(userToken); err != nil {
+			logger.Debugf("close user token: %v", err)
+		}
+	}()
+
+	server := &Server{}
+	userEnv, err := server.getUserEnvironmentWithToken(logger, userToken, req.Username, req.Domain)
+	if err != nil {
+		logger.Debugf("failed to get user environment for %s\\%s, using system environment: %v", req.Domain, req.Username, err)
+		userEnv = os.Environ()
+	}
+
+	workingDir := getUserHomeFromEnv(userEnv)
+	if workingDir == "" {
+		workingDir = fmt.Sprintf(`C:\Users\%s`, req.Username)
+	}
+
+	ptyConfig := winpty.PtyConfig{
+		Shell:      req.Shell,
+		Command:    req.Command,
+		Width:      req.Width,
+		Height:     req.Height,
+		WorkingDir: workingDir,
+	}
+
+	userConfig := winpty.UserConfig{
+		Token:       userToken,
+		Environment: userEnv,
+	}
+
+	logger.Debugf("executePtyCommandWithUserToken: calling winpty execution with working dir: %s", workingDir)
+	return winpty.ExecutePtyWithUserToken(session, ptyConfig, userConfig)
+}
+
+func getUserHomeFromEnv(env []string) string {
+	for _, envVar := range env {
+		if len(envVar) > 12 && envVar[:12] == "USERPROFILE=" {
+			return envVar[12:]
+		}
+	}
+	return ""
+}
+
+func (s *Server) setupProcessGroup(_ *exec.Cmd) {
+	// Windows doesn't support process groups in the same way as Unix
+	// Process creation groups are handled differently
+}
+
+func (s *Server) killProcessGroup(cmd *exec.Cmd) {
+	if cmd.Process == nil {
+		return
+	}
+
+	if err := cmd.Process.Kill(); err != nil {
+		log.Debugf("kill process %d failed: %v", cmd.Process.Pid, err)
+	}
+}
+
+// detectSuPtySupport always returns false on Windows as su is not available
+func (s *Server) detectSuPtySupport(context.Context) bool {
+	return false
+}
+
+// detectUtilLinuxLogin always returns false on Windows
+func (s *Server) detectUtilLinuxLogin(context.Context) bool {
+	return false
+}
+
+// executeCommandWithPty executes a command with PTY allocation on Windows using ConPty
+func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _ *exec.Cmd, privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, _ <-chan ssh.Window) bool {
+	localUser := privilegeResult.User
+	if localUser == nil {
+		logger.Errorf("no user in privilege result")
+		return false
+	}
+
+	username, domain := s.parseUsername(localUser.Username)
+	shell := getUserShell(localUser.Uid)
+
+	req := PtyExecutionRequest{
+		Shell:    shell,
+		Command:  session.RawCommand(),
+		Width:    ptyReq.Window.Width,
+		Height:   ptyReq.Window.Height,
+		Username: username,
+		Domain:   domain,
+	}
+
+	if err := executePtyCommandWithUserToken(logger, session, req); err != nil {
+		logger.Errorf("ConPty execution failed: %v", err)
+		if err := session.Exit(1); err != nil {
+			logSessionExitError(logger, err)
+		}
+		return false
+	}
+
+	logger.Debug("ConPty execution completed")
+	return true
+}

client/ssh/server/compatibility_test.go

@@ -0,0 +1,932 @@
+package server
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+)
+
+func TestMain(m *testing.M) {
+	// On platforms where su doesn't support --pty (macOS, FreeBSD, Windows), the SSH server
+	// spawns an executor subprocess via os.Executable(). During tests, this invokes the test
+	// binary with "ssh exec" args. We handle that here to properly execute commands and
+	// propagate exit codes.
+	if len(os.Args) > 2 && os.Args[1] == "ssh" && os.Args[2] == "exec" {
+		runTestExecutor()
+		return
+	}
+
+	code := m.Run()
+	testutil.CleanupTestUsers()
+	os.Exit(code)
+}
+
+// runTestExecutor emulates the netbird executor for tests.
+// Parses --shell and --cmd args, runs the command, and exits with the correct code.
+func runTestExecutor() {
+	if os.Getenv("_NETBIRD_TEST_EXECUTOR") != "" {
+		fmt.Fprintf(os.Stderr, "executor recursion detected\n")
+		os.Exit(1)
+	}
+	os.Setenv("_NETBIRD_TEST_EXECUTOR", "1")
+
+	shell := "/bin/sh"
+	var command string
+	for i := 3; i < len(os.Args); i++ {
+		switch os.Args[i] {
+		case "--shell":
+			if i+1 < len(os.Args) {
+				shell = os.Args[i+1]
+				i++
+			}
+		case "--cmd":
+			if i+1 < len(os.Args) {
+				command = os.Args[i+1]
+				i++
+			}
+		}
+	}
+
+	var cmd *exec.Cmd
+	if command == "" {
+		cmd = exec.Command(shell)
+	} else {
+		cmd = exec.Command(shell, "-c", command)
+	}
+	cmd.Args[0] = "-" + filepath.Base(shell)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	if err := cmd.Run(); err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			os.Exit(exitErr.ExitCode())
+		}
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
+// TestSSHServerCompatibility tests that our SSH server is compatible with the system SSH client
+func TestSSHServerCompatibility(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping SSH compatibility tests in short mode")
+	}
+
+	// Check if ssh binary is available
+	if !isSSHClientAvailable() {
+		t.Skip("SSH client not available on this system")
+	}
+
+	// Set up SSH server - use our existing key generation for server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Generate OpenSSH-compatible keys for client
+	clientPrivKeyOpenSSH, _, err := generateOpenSSHKey(t)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Create temporary key files for SSH client
+	clientKeyFile, cleanupKey := createTempKeyFileFromBytes(t, clientPrivKeyOpenSSH)
+	defer cleanupKey()
+
+	// Extract host and port from server address
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+
+	// Get appropriate user for SSH connection (handle system accounts)
+	username := testutil.GetTestUsername(t)
+
+	t.Run("basic command execution", func(t *testing.T) {
+		testSSHCommandExecutionWithUser(t, host, portStr, clientKeyFile, username)
+	})
+
+	t.Run("interactive command", func(t *testing.T) {
+		testSSHInteractiveCommand(t, host, portStr, clientKeyFile)
+	})
+
+	t.Run("port forwarding", func(t *testing.T) {
+		testSSHPortForwarding(t, host, portStr, clientKeyFile)
+	})
+}
+
+// testSSHCommandExecutionWithUser tests basic command execution with system SSH client using specified user.
+func testSSHCommandExecutionWithUser(t *testing.T, host, port, keyFile, username string) {
+	cmd := exec.Command("ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		"echo", "hello_world")
+
+	output, err := cmd.CombinedOutput()
+
+	if err != nil {
+		t.Logf("SSH command failed: %v", err)
+		t.Logf("Output: %s", string(output))
+		return
+	}
+
+	assert.Contains(t, string(output), "hello_world", "SSH command should execute successfully")
+}
+
+// testSSHInteractiveCommand tests interactive shell session.
+func testSSHInteractiveCommand(t *testing.T, host, port, keyFile string) {
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host))
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		t.Skipf("Cannot create stdin pipe: %v", err)
+		return
+	}
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		t.Skipf("Cannot create stdout pipe: %v", err)
+		return
+	}
+
+	err = cmd.Start()
+	if err != nil {
+		t.Logf("Cannot start SSH session: %v", err)
+		return
+	}
+
+	go func() {
+		defer func() {
+			if err := stdin.Close(); err != nil {
+				t.Logf("stdin close error: %v", err)
+			}
+		}()
+		time.Sleep(100 * time.Millisecond)
+		if _, err := stdin.Write([]byte("echo interactive_test\n")); err != nil {
+			t.Logf("stdin write error: %v", err)
+		}
+		time.Sleep(100 * time.Millisecond)
+		if _, err := stdin.Write([]byte("exit\n")); err != nil {
+			t.Logf("stdin write error: %v", err)
+		}
+	}()
+
+	output, err := io.ReadAll(stdout)
+	if err != nil {
+		t.Logf("Cannot read SSH output: %v", err)
+	}
+
+	err = cmd.Wait()
+	if err != nil {
+		t.Logf("SSH interactive session error: %v", err)
+		t.Logf("Output: %s", string(output))
+		return
+	}
+
+	assert.Contains(t, string(output), "interactive_test", "Interactive SSH session should work")
+}
+
+// testSSHPortForwarding tests port forwarding compatibility.
+func testSSHPortForwarding(t *testing.T, host, port, keyFile string) {
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	testServer, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer testServer.Close()
+
+	testServerAddr := testServer.Addr().String()
+	expectedResponse := "HTTP/1.1 200 OK\r\nContent-Length: 21\r\n\r\nCompatibility Test OK"
+
+	go func() {
+		for {
+			conn, err := testServer.Accept()
+			if err != nil {
+				return
+			}
+			go func(c net.Conn) {
+				defer func() {
+					if err := c.Close(); err != nil {
+						t.Logf("test server connection close error: %v", err)
+					}
+				}()
+				buf := make([]byte, 1024)
+				if _, err := c.Read(buf); err != nil {
+					t.Logf("Test server read error: %v", err)
+				}
+				if _, err := c.Write([]byte(expectedResponse)); err != nil {
+					t.Logf("Test server write error: %v", err)
+				}
+			}(conn)
+		}
+	}()
+
+	localListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	localAddr := localListener.Addr().String()
+	localListener.Close()
+
+	_, localPort, err := net.SplitHostPort(localAddr)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	forwardSpec := fmt.Sprintf("%s:%s", localPort, testServerAddr)
+	cmd := exec.CommandContext(ctx, "ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-L", forwardSpec,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		"-N",
+		fmt.Sprintf("%s@%s", username, host))
+
+	err = cmd.Start()
+	if err != nil {
+		t.Logf("Cannot start SSH port forwarding: %v", err)
+		return
+	}
+
+	defer func() {
+		if cmd.Process != nil {
+			if err := cmd.Process.Kill(); err != nil {
+				t.Logf("process kill error: %v", err)
+			}
+		}
+		if err := cmd.Wait(); err != nil {
+			t.Logf("process wait after kill: %v", err)
+		}
+	}()
+
+	time.Sleep(500 * time.Millisecond)
+
+	conn, err := net.DialTimeout("tcp", localAddr, 3*time.Second)
+	if err != nil {
+		t.Logf("Cannot connect to forwarded port: %v", err)
+		return
+	}
+	defer func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("forwarded connection close error: %v", err)
+		}
+	}()
+
+	request := "GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"
+	_, err = conn.Write([]byte(request))
+	require.NoError(t, err)
+
+	if err := conn.SetReadDeadline(time.Now().Add(3 * time.Second)); err != nil {
+		log.Debugf("failed to set read deadline: %v", err)
+	}
+	response := make([]byte, len(expectedResponse))
+	n, err := io.ReadFull(conn, response)
+	if err != nil {
+		t.Logf("Cannot read forwarded response: %v", err)
+		return
+	}
+
+	assert.Equal(t, len(expectedResponse), n, "Should read expected number of bytes")
+	assert.Equal(t, expectedResponse, string(response), "Should get correct HTTP response through SSH port forwarding")
+}
+
+// isSSHClientAvailable checks if the ssh binary is available
+func isSSHClientAvailable() bool {
+	_, err := exec.LookPath("ssh")
+	return err == nil
+}
+
+// generateOpenSSHKey generates an ED25519 key in OpenSSH format that the system SSH client can use.
+func generateOpenSSHKey(t *testing.T) ([]byte, []byte, error) {
+	// Check if ssh-keygen is available
+	if _, err := exec.LookPath("ssh-keygen"); err != nil {
+		// Fall back to our existing key generation and try to convert
+		return generateOpenSSHKeyFallback()
+	}
+
+	// Create temporary file for ssh-keygen
+	tempFile, err := os.CreateTemp("", "ssh_keygen_*")
+	if err != nil {
+		return nil, nil, fmt.Errorf("create temp file: %w", err)
+	}
+	keyPath := tempFile.Name()
+	tempFile.Close()
+
+	// Remove the temp file so ssh-keygen can create it
+	if err := os.Remove(keyPath); err != nil {
+		t.Logf("failed to remove key file: %v", err)
+	}
+
+	// Clean up temp files
+	defer func() {
+		if err := os.Remove(keyPath); err != nil {
+			t.Logf("failed to cleanup key file: %v", err)
+		}
+		if err := os.Remove(keyPath + ".pub"); err != nil {
+			t.Logf("failed to cleanup public key file: %v", err)
+		}
+	}()
+
+	// Generate key using ssh-keygen
+	cmd := exec.Command("ssh-keygen", "-t", "ed25519", "-f", keyPath, "-N", "", "-q")
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return nil, nil, fmt.Errorf("ssh-keygen failed: %w, output: %s", err, string(output))
+	}
+
+	// Read private key
+	privKeyBytes, err := os.ReadFile(keyPath)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read private key: %w", err)
+	}
+
+	// Read public key
+	pubKeyBytes, err := os.ReadFile(keyPath + ".pub")
+	if err != nil {
+		return nil, nil, fmt.Errorf("read public key: %w", err)
+	}
+
+	return privKeyBytes, pubKeyBytes, nil
+}
+
+// generateOpenSSHKeyFallback falls back to generating keys using our existing method
+func generateOpenSSHKeyFallback() ([]byte, []byte, error) {
+	// Generate shared.ED25519 key pair using our existing method
+	_, privKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate key: %w", err)
+	}
+
+	// Convert to SSH format
+	sshPrivKey, err := ssh.NewSignerFromKey(privKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("create signer: %w", err)
+	}
+
+	// For the fallback, just use our PKCS#8 format and hope it works
+	// This won't be in OpenSSH format but might still work with some SSH clients
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate fallback key: %w", err)
+	}
+
+	// Get public key in SSH format
+	sshPubKey := ssh.MarshalAuthorizedKey(sshPrivKey.PublicKey())
+
+	return hostKey, sshPubKey, nil
+}
+
+// createTempKeyFileFromBytes creates a temporary SSH private key file from raw bytes
+func createTempKeyFileFromBytes(t *testing.T, keyBytes []byte) (string, func()) {
+	t.Helper()
+
+	tempFile, err := os.CreateTemp("", "ssh_test_key_*")
+	require.NoError(t, err)
+
+	_, err = tempFile.Write(keyBytes)
+	require.NoError(t, err)
+
+	err = tempFile.Close()
+	require.NoError(t, err)
+
+	// Set proper permissions for SSH key (readable by owner only)
+	err = os.Chmod(tempFile.Name(), 0600)
+	require.NoError(t, err)
+
+	cleanup := func() {
+		_ = os.Remove(tempFile.Name())
+	}
+
+	return tempFile.Name(), cleanup
+}
+
+// createTempKeyFile creates a temporary SSH private key file (for backward compatibility)
+func createTempKeyFile(t *testing.T, privateKey []byte) (string, func()) {
+	return createTempKeyFileFromBytes(t, privateKey)
+}
+
+// TestSSHPtyModes tests different PTY allocation modes (-T, -t, -tt flags)
+// This ensures our implementation matches OpenSSH behavior for:
+// - ssh host command        (no PTY - default when no TTY)
+// - ssh -T host command     (explicit no PTY)
+// - ssh -t host command     (force PTY)
+// - ssh -T host             (no PTY shell - our implementation)
+func TestSSHPtyModes(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping SSH PTY mode tests in short mode")
+	}
+
+	if !isSSHClientAvailable() {
+		t.Skip("SSH client not available on this system")
+	}
+
+	if runtime.GOOS == "windows" && testutil.IsCI() {
+		t.Skip("Skipping Windows SSH PTY tests in CI due to S4U authentication issues")
+	}
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	clientPrivKeyOpenSSH, _, err := generateOpenSSHKey(t)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	clientKeyFile, cleanupKey := createTempKeyFileFromBytes(t, clientPrivKeyOpenSSH)
+	defer cleanupKey()
+
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+
+	username := testutil.GetTestUsername(t)
+
+	baseArgs := []string{
+		"-i", clientKeyFile,
+		"-p", portStr,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		"-o", "BatchMode=yes",
+	}
+
+	t.Run("command_default_no_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), fmt.Sprintf("%s@%s", username, host), "echo", "no_pty_default")
+		cmd := exec.Command("ssh", args...)
+
+		output, err := cmd.CombinedOutput()
+		require.NoError(t, err, "Command (default no PTY) failed: %s", output)
+		assert.Contains(t, string(output), "no_pty_default")
+	})
+
+	t.Run("command_explicit_no_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-T", fmt.Sprintf("%s@%s", username, host), "echo", "explicit_no_pty")
+		cmd := exec.Command("ssh", args...)
+
+		output, err := cmd.CombinedOutput()
+		require.NoError(t, err, "Command (-T explicit no PTY) failed: %s", output)
+		assert.Contains(t, string(output), "explicit_no_pty")
+	})
+
+	t.Run("command_force_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-tt", fmt.Sprintf("%s@%s", username, host), "echo", "force_pty")
+		cmd := exec.Command("ssh", args...)
+
+		output, err := cmd.CombinedOutput()
+		require.NoError(t, err, "Command (-tt force PTY) failed: %s", output)
+		assert.Contains(t, string(output), "force_pty")
+	})
+
+	t.Run("shell_explicit_no_pty", func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		args := append(slices.Clone(baseArgs), "-T", fmt.Sprintf("%s@%s", username, host))
+		cmd := exec.CommandContext(ctx, "ssh", args...)
+
+		stdin, err := cmd.StdinPipe()
+		require.NoError(t, err)
+
+		stdout, err := cmd.StdoutPipe()
+		require.NoError(t, err)
+
+		require.NoError(t, cmd.Start(), "Shell (-T no PTY) start failed")
+
+		go func() {
+			defer stdin.Close()
+			time.Sleep(100 * time.Millisecond)
+			_, err := stdin.Write([]byte("echo shell_no_pty_test\n"))
+			assert.NoError(t, err, "write echo command")
+			time.Sleep(100 * time.Millisecond)
+			_, err = stdin.Write([]byte("exit 0\n"))
+			assert.NoError(t, err, "write exit command")
+		}()
+
+		output, _ := io.ReadAll(stdout)
+		err = cmd.Wait()
+
+		require.NoError(t, err, "Shell (-T no PTY) failed: %s", output)
+		assert.Contains(t, string(output), "shell_no_pty_test")
+	})
+
+	t.Run("exit_code_preserved_no_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-T", fmt.Sprintf("%s@%s", username, host), "exit", "42")
+		cmd := exec.Command("ssh", args...)
+
+		err := cmd.Run()
+		require.Error(t, err, "Command should exit with non-zero")
+
+		var exitErr *exec.ExitError
+		require.True(t, errors.As(err, &exitErr), "Should be an exit error: %v", err)
+		assert.Equal(t, 42, exitErr.ExitCode(), "Exit code should be preserved with -T")
+	})
+
+	t.Run("exit_code_preserved_with_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-tt", fmt.Sprintf("%s@%s", username, host), "sh -c 'exit 43'")
+		cmd := exec.Command("ssh", args...)
+
+		err := cmd.Run()
+		require.Error(t, err, "PTY command should exit with non-zero")
+
+		var exitErr *exec.ExitError
+		require.True(t, errors.As(err, &exitErr), "Should be an exit error: %v", err)
+		assert.Equal(t, 43, exitErr.ExitCode(), "Exit code should be preserved with -tt")
+	})
+
+	t.Run("stderr_works_no_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-T", fmt.Sprintf("%s@%s", username, host),
+			"sh -c 'echo stdout_msg; echo stderr_msg >&2'")
+		cmd := exec.Command("ssh", args...)
+
+		var stdout, stderr strings.Builder
+		cmd.Stdout = &stdout
+		cmd.Stderr = &stderr
+
+		require.NoError(t, cmd.Run(), "stderr test failed")
+		assert.Contains(t, stdout.String(), "stdout_msg", "stdout should have stdout_msg")
+		assert.Contains(t, stderr.String(), "stderr_msg", "stderr should have stderr_msg")
+		assert.NotContains(t, stdout.String(), "stderr_msg", "stdout should NOT have stderr_msg")
+	})
+
+	t.Run("stderr_merged_with_pty", func(t *testing.T) {
+		args := append(slices.Clone(baseArgs), "-tt", fmt.Sprintf("%s@%s", username, host),
+			"sh -c 'echo stdout_msg; echo stderr_msg >&2'")
+		cmd := exec.Command("ssh", args...)
+
+		output, err := cmd.CombinedOutput()
+		require.NoError(t, err, "PTY stderr test failed: %s", output)
+		assert.Contains(t, string(output), "stdout_msg")
+		assert.Contains(t, string(output), "stderr_msg")
+	})
+}
+
+// TestSSHServerFeatureCompatibility tests specific SSH features for compatibility
+func TestSSHServerFeatureCompatibility(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping SSH feature compatibility tests in short mode")
+	}
+
+	if runtime.GOOS == "windows" && testutil.IsCI() {
+		t.Skip("Skipping Windows SSH compatibility tests in CI due to S4U authentication issues")
+	}
+
+	if !isSSHClientAvailable() {
+		t.Skip("SSH client not available on this system")
+	}
+
+	// Test various SSH features
+	testCases := []struct {
+		name        string
+		testFunc    func(t *testing.T, host, port, keyFile string)
+		description string
+	}{
+		{
+			name:        "command_with_flags",
+			testFunc:    testCommandWithFlags,
+			description: "Commands with flags should work like standard SSH",
+		},
+		{
+			name:        "environment_variables",
+			testFunc:    testEnvironmentVariables,
+			description: "Environment variables should be available",
+		},
+		{
+			name:        "exit_codes",
+			testFunc:    testExitCodes,
+			description: "Exit codes should be properly handled",
+		},
+	}
+
+	// Set up SSH server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	clientKeyFile, cleanupKey := createTempKeyFile(t, clientPrivKey)
+	defer cleanupKey()
+
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			tc.testFunc(t, host, portStr, clientKeyFile)
+		})
+	}
+}
+
+// testCommandWithFlags tests that commands with flags work properly
+func testCommandWithFlags(t *testing.T, host, port, keyFile string) {
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	// Test ls with flags
+	cmd := exec.Command("ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		"ls", "-la", "/tmp")
+
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("Command with flags failed: %v", err)
+		t.Logf("Output: %s", string(output))
+		return
+	}
+
+	// Should not be empty and should not contain error messages
+	assert.NotEmpty(t, string(output), "ls -la should produce output")
+	assert.NotContains(t, strings.ToLower(string(output)), "command not found", "Command should be executed")
+}
+
+// testEnvironmentVariables tests that environment is properly set up
+func testEnvironmentVariables(t *testing.T, host, port, keyFile string) {
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	cmd := exec.Command("ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		"echo", "$HOME")
+
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("Environment test failed: %v", err)
+		t.Logf("Output: %s", string(output))
+		return
+	}
+
+	// HOME environment variable should be available
+	homeOutput := strings.TrimSpace(string(output))
+	assert.NotEmpty(t, homeOutput, "HOME environment variable should be set")
+	assert.NotEqual(t, "$HOME", homeOutput, "Environment variable should be expanded")
+}
+
+// testExitCodes tests that exit codes are properly handled
+func testExitCodes(t *testing.T, host, port, keyFile string) {
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	// Test successful command (exit code 0)
+	cmd := exec.Command("ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		"true") // always succeeds
+
+	err := cmd.Run()
+	assert.NoError(t, err, "Command with exit code 0 should succeed")
+
+	// Test failing command (exit code 1)
+	cmd = exec.Command("ssh",
+		"-i", keyFile,
+		"-p", port,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		"false") // always fails
+
+	err = cmd.Run()
+	assert.Error(t, err, "Command with exit code 1 should fail")
+
+	// Check if it's the right kind of error
+	if exitError, ok := err.(*exec.ExitError); ok {
+		assert.Equal(t, 1, exitError.ExitCode(), "Exit code should be preserved")
+	}
+}
+
+// TestSSHServerSecurityFeatures tests security-related SSH features
+func TestSSHServerSecurityFeatures(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping SSH security tests in short mode")
+	}
+
+	if !isSSHClientAvailable() {
+		t.Skip("SSH client not available on this system")
+	}
+
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	// Set up SSH server with specific security settings
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	clientKeyFile, cleanupKey := createTempKeyFile(t, clientPrivKey)
+	defer cleanupKey()
+
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+
+	t.Run("key_authentication", func(t *testing.T) {
+		// Test that key authentication works
+		cmd := exec.Command("ssh",
+			"-i", clientKeyFile,
+			"-p", portStr,
+			"-o", "StrictHostKeyChecking=no",
+			"-o", "UserKnownHostsFile=/dev/null",
+			"-o", "ConnectTimeout=5",
+			"-o", "PasswordAuthentication=no",
+			fmt.Sprintf("%s@%s", username, host),
+			"echo", "auth_success")
+
+		output, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Logf("Key authentication failed: %v", err)
+			t.Logf("Output: %s", string(output))
+			return
+		}
+
+		assert.Contains(t, string(output), "auth_success", "Key authentication should work")
+	})
+
+	t.Run("any_key_accepted_in_no_auth_mode", func(t *testing.T) {
+		// Create a different key that shouldn't be accepted
+		wrongKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+		require.NoError(t, err)
+
+		wrongKeyFile, cleanupWrongKey := createTempKeyFile(t, wrongKey)
+		defer cleanupWrongKey()
+
+		// Test that wrong key is rejected
+		cmd := exec.Command("ssh",
+			"-i", wrongKeyFile,
+			"-p", portStr,
+			"-o", "StrictHostKeyChecking=no",
+			"-o", "UserKnownHostsFile=/dev/null",
+			"-o", "ConnectTimeout=5",
+			"-o", "PasswordAuthentication=no",
+			fmt.Sprintf("%s@%s", username, host),
+			"echo", "should_not_work")
+
+		err = cmd.Run()
+		assert.NoError(t, err, "Any key should work in no-auth mode")
+	})
+}
+
+// TestCrossPlatformCompatibility tests cross-platform behavior
+func TestCrossPlatformCompatibility(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping cross-platform compatibility tests in short mode")
+	}
+
+	if !isSSHClientAvailable() {
+		t.Skip("SSH client not available on this system")
+	}
+
+	// Get appropriate user for SSH connection
+	username := testutil.GetTestUsername(t)
+
+	// Set up SSH server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	clientKeyFile, cleanupKey := createTempKeyFile(t, clientPrivKey)
+	defer cleanupKey()
+
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+
+	// Test platform-specific commands
+	var testCommand string
+
+	switch runtime.GOOS {
+	case "windows":
+		testCommand = "echo %OS%"
+	default:
+		testCommand = "uname"
+	}
+
+	cmd := exec.Command("ssh",
+		"-i", clientKeyFile,
+		"-p", portStr,
+		"-o", "StrictHostKeyChecking=no",
+		"-o", "UserKnownHostsFile=/dev/null",
+		"-o", "ConnectTimeout=5",
+		fmt.Sprintf("%s@%s", username, host),
+		testCommand)
+
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("Platform-specific command failed: %v", err)
+		t.Logf("Output: %s", string(output))
+		return
+	}
+
+	outputStr := strings.TrimSpace(string(output))
+	t.Logf("Platform command output: %s", outputStr)
+	assert.NotEmpty(t, outputStr, "Platform-specific command should produce output")
+}

client/ssh/server/executor_unix.go

@@ -0,0 +1,283 @@
+//go:build unix
+
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Exit codes for executor process communication
+const (
+	ExitCodeSuccess           = 0
+	ExitCodePrivilegeDropFail = 10
+	ExitCodeShellExecFail     = 11
+	ExitCodeValidationFail    = 12
+)
+
+// ExecutorConfig holds configuration for the executor process
+type ExecutorConfig struct {
+	UID        uint32
+	GID        uint32
+	Groups     []uint32
+	WorkingDir string
+	Shell      string
+	Command    string
+	PTY        bool
+}
+
+// PrivilegeDropper handles secure privilege dropping in child processes
+type PrivilegeDropper struct {
+	logger *log.Entry
+}
+
+// PrivilegeDropperOption is a functional option for configuring PrivilegeDropper
+type PrivilegeDropperOption func(*PrivilegeDropper)
+
+// NewPrivilegeDropper creates a new privilege dropper
+func NewPrivilegeDropper(opts ...PrivilegeDropperOption) *PrivilegeDropper {
+	pd := &PrivilegeDropper{}
+	for _, opt := range opts {
+		opt(pd)
+	}
+	return pd
+}
+
+// WithLogger sets the logger for the PrivilegeDropper
+func WithLogger(logger *log.Entry) PrivilegeDropperOption {
+	return func(pd *PrivilegeDropper) {
+		pd.logger = logger
+	}
+}
+
+// log returns the logger, falling back to standard logger if none set
+func (pd *PrivilegeDropper) log() *log.Entry {
+	if pd.logger != nil {
+		return pd.logger
+	}
+	return log.NewEntry(log.StandardLogger())
+}
+
+// CreateExecutorCommand creates a command that spawns netbird ssh exec for privilege dropping
+func (pd *PrivilegeDropper) CreateExecutorCommand(ctx context.Context, config ExecutorConfig) (*exec.Cmd, error) {
+	netbirdPath, err := os.Executable()
+	if err != nil {
+		return nil, fmt.Errorf("get netbird executable path: %w", err)
+	}
+
+	if err := pd.validatePrivileges(config.UID, config.GID); err != nil {
+		return nil, fmt.Errorf("invalid privileges: %w", err)
+	}
+
+	args := []string{
+		"ssh", "exec",
+		"--uid", fmt.Sprintf("%d", config.UID),
+		"--gid", fmt.Sprintf("%d", config.GID),
+		"--working-dir", config.WorkingDir,
+		"--shell", config.Shell,
+	}
+
+	for _, group := range config.Groups {
+		args = append(args, "--groups", fmt.Sprintf("%d", group))
+	}
+
+	if config.PTY {
+		args = append(args, "--pty")
+	}
+
+	if config.Command != "" {
+		args = append(args, "--cmd", config.Command)
+	}
+
+	// Log executor args safely - show all args except hide the command value
+	safeArgs := make([]string, len(args))
+	copy(safeArgs, args)
+	for i := 0; i < len(safeArgs)-1; i++ {
+		if safeArgs[i] == "--cmd" {
+			cmdParts := strings.Fields(safeArgs[i+1])
+			safeArgs[i+1] = safeLogCommand(cmdParts)
+			break
+		}
+	}
+	pd.log().Tracef("creating executor command: %s %v", netbirdPath, safeArgs)
+	return exec.CommandContext(ctx, netbirdPath, args...), nil
+}
+
+// DropPrivileges performs privilege dropping with thread locking for security
+func (pd *PrivilegeDropper) DropPrivileges(targetUID, targetGID uint32, supplementaryGroups []uint32) error {
+	if err := pd.validatePrivileges(targetUID, targetGID); err != nil {
+		return fmt.Errorf("invalid privileges: %w", err)
+	}
+
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	originalUID := os.Geteuid()
+	originalGID := os.Getegid()
+
+	if originalUID != int(targetUID) || originalGID != int(targetGID) {
+		if err := pd.setGroupsAndIDs(targetUID, targetGID, supplementaryGroups); err != nil {
+			return fmt.Errorf("set groups and IDs: %w", err)
+		}
+	}
+
+	if err := pd.validatePrivilegeDropSuccess(targetUID, targetGID, originalUID, originalGID); err != nil {
+		return err
+	}
+
+	log.Tracef("successfully dropped privileges to UID=%d, GID=%d", targetUID, targetGID)
+	return nil
+}
+
+// setGroupsAndIDs sets the supplementary groups, GID, and UID
+func (pd *PrivilegeDropper) setGroupsAndIDs(targetUID, targetGID uint32, supplementaryGroups []uint32) error {
+	groups := make([]int, len(supplementaryGroups))
+	for i, g := range supplementaryGroups {
+		groups[i] = int(g)
+	}
+
+	if runtime.GOOS == "darwin" || runtime.GOOS == "freebsd" {
+		if len(groups) == 0 || groups[0] != int(targetGID) {
+			groups = append([]int{int(targetGID)}, groups...)
+		}
+	}
+
+	if err := syscall.Setgroups(groups); err != nil {
+		return fmt.Errorf("setgroups to %v: %w", groups, err)
+	}
+
+	if err := syscall.Setgid(int(targetGID)); err != nil {
+		return fmt.Errorf("setgid to %d: %w", targetGID, err)
+	}
+
+	if err := syscall.Setuid(int(targetUID)); err != nil {
+		return fmt.Errorf("setuid to %d: %w", targetUID, err)
+	}
+
+	return nil
+}
+
+// validatePrivilegeDropSuccess validates that privilege dropping was successful
+func (pd *PrivilegeDropper) validatePrivilegeDropSuccess(targetUID, targetGID uint32, originalUID, originalGID int) error {
+	if err := pd.validatePrivilegeDropReversibility(targetUID, targetGID, originalUID, originalGID); err != nil {
+		return err
+	}
+
+	if err := pd.validateCurrentPrivileges(targetUID, targetGID); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// validatePrivilegeDropReversibility ensures privileges cannot be restored
+func (pd *PrivilegeDropper) validatePrivilegeDropReversibility(targetUID, targetGID uint32, originalUID, originalGID int) error {
+	if originalGID != int(targetGID) {
+		if err := syscall.Setegid(originalGID); err == nil {
+			return fmt.Errorf("privilege drop validation failed: able to restore original GID %d", originalGID)
+		}
+	}
+	if originalUID != int(targetUID) {
+		if err := syscall.Seteuid(originalUID); err == nil {
+			return fmt.Errorf("privilege drop validation failed: able to restore original UID %d", originalUID)
+		}
+	}
+	return nil
+}
+
+// validateCurrentPrivileges validates the current UID and GID match the target
+func (pd *PrivilegeDropper) validateCurrentPrivileges(targetUID, targetGID uint32) error {
+	currentUID := os.Geteuid()
+	if currentUID != int(targetUID) {
+		return fmt.Errorf("privilege drop validation failed: current UID %d, expected %d", currentUID, targetUID)
+	}
+
+	currentGID := os.Getegid()
+	if currentGID != int(targetGID) {
+		return fmt.Errorf("privilege drop validation failed: current GID %d, expected %d", currentGID, targetGID)
+	}
+
+	return nil
+}
+
+// ExecuteWithPrivilegeDrop executes a command with privilege dropping, using exit codes to signal specific failures
+func (pd *PrivilegeDropper) ExecuteWithPrivilegeDrop(ctx context.Context, config ExecutorConfig) {
+	log.Tracef("dropping privileges to UID=%d, GID=%d, groups=%v", config.UID, config.GID, config.Groups)
+
+	// TODO: Implement Pty support for executor path
+	if config.PTY {
+		config.PTY = false
+	}
+
+	if err := pd.DropPrivileges(config.UID, config.GID, config.Groups); err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "privilege drop failed: %v\n", err)
+		os.Exit(ExitCodePrivilegeDropFail)
+	}
+
+	if config.WorkingDir != "" {
+		if err := os.Chdir(config.WorkingDir); err != nil {
+			log.Debugf("failed to change to working directory %s, continuing with current directory: %v", config.WorkingDir, err)
+		}
+	}
+
+	var execCmd *exec.Cmd
+	if config.Command == "" {
+		execCmd = exec.CommandContext(ctx, config.Shell)
+	} else {
+		execCmd = exec.CommandContext(ctx, config.Shell, "-c", config.Command)
+	}
+	execCmd.Args[0] = "-" + filepath.Base(config.Shell)
+	execCmd.Stdin = os.Stdin
+	execCmd.Stdout = os.Stdout
+	execCmd.Stderr = os.Stderr
+
+	if config.Command == "" {
+		log.Tracef("executing login shell: %s", execCmd.Path)
+	} else {
+		cmdParts := strings.Fields(config.Command)
+		safeCmd := safeLogCommand(cmdParts)
+		log.Tracef("executing %s -c %s", execCmd.Path, safeCmd)
+	}
+	if err := execCmd.Run(); err != nil {
+		var exitError *exec.ExitError
+		if errors.As(err, &exitError) {
+			// Normal command exit with non-zero code - not an SSH execution error
+			log.Tracef("command exited with code %d", exitError.ExitCode())
+			os.Exit(exitError.ExitCode())
+		}
+
+		// Actual execution failure (command not found, permission denied, etc.)
+		log.Debugf("command execution failed: %v", err)
+		os.Exit(ExitCodeShellExecFail)
+	}
+
+	os.Exit(ExitCodeSuccess)
+}
+
+// validatePrivileges validates that privilege dropping to the target UID/GID is allowed
+func (pd *PrivilegeDropper) validatePrivileges(uid, gid uint32) error {
+	currentUID := uint32(os.Geteuid())
+	currentGID := uint32(os.Getegid())
+
+	// Allow same-user operations (no privilege dropping needed)
+	if uid == currentUID && gid == currentGID {
+		return nil
+	}
+
+	// Only root can drop privileges to other users
+	if currentUID != 0 {
+		return fmt.Errorf("cannot drop privileges from non-root user (UID %d) to UID %d", currentUID, uid)
+	}
+
+	// Root can drop to any user (including root itself)
+	return nil
+}

client/ssh/server/executor_unix_privileged_test.go

@@ -0,0 +1,66 @@
+//go:build unix && privileged
+
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrivilegeDropper_CreateExecutorCommand(t *testing.T) {
+	pd := NewPrivilegeDropper()
+
+	config := ExecutorConfig{
+		UID:        1000,
+		GID:        1000,
+		Groups:     []uint32{1000, 1001},
+		WorkingDir: "/home/testuser",
+		Shell:      "/bin/bash",
+		Command:    "ls -la",
+	}
+
+	cmd, err := pd.CreateExecutorCommand(context.Background(), config)
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+
+	// Verify the command is calling netbird ssh exec
+	assert.Contains(t, cmd.Args, "ssh")
+	assert.Contains(t, cmd.Args, "exec")
+	assert.Contains(t, cmd.Args, "--uid")
+	assert.Contains(t, cmd.Args, "1000")
+	assert.Contains(t, cmd.Args, "--gid")
+	assert.Contains(t, cmd.Args, "1000")
+	assert.Contains(t, cmd.Args, "--groups")
+	assert.Contains(t, cmd.Args, "1000")
+	assert.Contains(t, cmd.Args, "1001")
+	assert.Contains(t, cmd.Args, "--working-dir")
+	assert.Contains(t, cmd.Args, "/home/testuser")
+	assert.Contains(t, cmd.Args, "--shell")
+	assert.Contains(t, cmd.Args, "/bin/bash")
+	assert.Contains(t, cmd.Args, "--cmd")
+	assert.Contains(t, cmd.Args, "ls -la")
+}
+
+func TestPrivilegeDropper_CreateExecutorCommandInteractive(t *testing.T) {
+	pd := NewPrivilegeDropper()
+
+	config := ExecutorConfig{
+		UID:        1000,
+		GID:        1000,
+		Groups:     []uint32{1000},
+		WorkingDir: "/home/testuser",
+		Shell:      "/bin/bash",
+		Command:    "",
+	}
+
+	cmd, err := pd.CreateExecutorCommand(context.Background(), config)
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+
+	// Verify no command mode (command is empty so no --cmd flag)
+	assert.NotContains(t, cmd.Args, "--cmd")
+	assert.NotContains(t, cmd.Args, "--interactive")
+}

client/ssh/server/executor_unix_test.go

@@ -0,0 +1,207 @@
+//go:build unix
+
+package server
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrivilegeDropper_ValidatePrivileges(t *testing.T) {
+	pd := NewPrivilegeDropper()
+
+	currentUID := uint32(os.Geteuid())
+	currentGID := uint32(os.Getegid())
+
+	tests := []struct {
+		name    string
+		uid     uint32
+		gid     uint32
+		wantErr bool
+	}{
+		{
+			name:    "same user - no privilege drop needed",
+			uid:     currentUID,
+			gid:     currentGID,
+			wantErr: false,
+		},
+		{
+			name:    "non-root to different user should fail",
+			uid:     currentUID + 1,  // Use a different UID to ensure it's actually different
+			gid:     currentGID + 1,  // Use a different GID to ensure it's actually different
+			wantErr: currentUID != 0, // Only fail if current user is not root
+		},
+		{
+			name:    "root can drop to any user",
+			uid:     1000,
+			gid:     1000,
+			wantErr: false,
+		},
+		{
+			name:    "root can stay as root",
+			uid:     0,
+			gid:     0,
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Skip non-root tests when running as root, and root tests when not root
+			if tt.name == "non-root to different user should fail" && currentUID == 0 {
+				t.Skip("Skipping non-root test when running as root")
+			}
+			if (tt.name == "root can drop to any user" || tt.name == "root can stay as root") && currentUID != 0 {
+				t.Skip("Skipping root test when not running as root")
+			}
+
+			err := pd.validatePrivileges(tt.uid, tt.gid)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestPrivilegeDropper_ActualPrivilegeDrop tests actual privilege dropping
+// This test requires root privileges and will be skipped if not running as root
+func TestPrivilegeDropper_ActualPrivilegeDrop(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("This test requires root privileges")
+	}
+
+	// Find a non-root user to test with
+	testUser, err := findNonRootUser()
+	if err != nil {
+		t.Skip("No suitable non-root user found for testing")
+	}
+
+	// Verify the user actually exists by looking it up again
+	_, err = user.LookupId(testUser.Uid)
+	if err != nil {
+		t.Skipf("Test user %s (UID %s) does not exist on this system: %v", testUser.Username, testUser.Uid, err)
+	}
+
+	uid64, err := strconv.ParseUint(testUser.Uid, 10, 32)
+	require.NoError(t, err)
+	targetUID := uint32(uid64)
+
+	gid64, err := strconv.ParseUint(testUser.Gid, 10, 32)
+	require.NoError(t, err)
+	targetGID := uint32(gid64)
+
+	// Test in a child process to avoid affecting the test runner
+	if os.Getenv("TEST_PRIVILEGE_DROP") == "1" {
+		pd := NewPrivilegeDropper()
+
+		// This should succeed
+		err := pd.DropPrivileges(targetUID, targetGID, []uint32{targetGID})
+		require.NoError(t, err)
+
+		// Verify we are now running as the target user
+		currentUID := uint32(os.Geteuid())
+		currentGID := uint32(os.Getegid())
+
+		assert.Equal(t, targetUID, currentUID, "UID should match target")
+		assert.Equal(t, targetGID, currentGID, "GID should match target")
+		assert.NotEqual(t, uint32(0), currentUID, "Should not be running as root")
+		assert.NotEqual(t, uint32(0), currentGID, "Should not be running as root group")
+
+		return
+	}
+
+	// Fork a child process to test privilege dropping
+	cmd := os.Args[0]
+	args := []string{"-test.run=TestPrivilegeDropper_ActualPrivilegeDrop"}
+
+	env := append(os.Environ(), "TEST_PRIVILEGE_DROP=1")
+
+	execCmd := exec.Command(cmd, args...)
+	execCmd.Env = env
+
+	err = execCmd.Run()
+	require.NoError(t, err, "Child process should succeed")
+}
+
+// findNonRootUser finds any non-root user on the system for testing
+func findNonRootUser() (*user.User, error) {
+	// Try common non-root users, but avoid "nobody" on macOS due to negative UID issues
+	commonUsers := []string{"daemon", "bin", "sys", "sync", "games", "man", "lp", "mail", "news", "uucp", "proxy", "www-data", "backup", "list", "irc"}
+
+	for _, username := range commonUsers {
+		if u, err := user.Lookup(username); err == nil {
+			// Parse as signed integer first to handle negative UIDs
+			uid64, err := strconv.ParseInt(u.Uid, 10, 32)
+			if err != nil {
+				continue
+			}
+			// Skip negative UIDs (like nobody=-2 on macOS) and root
+			if uid64 > 0 && uid64 != 0 {
+				return u, nil
+			}
+		}
+	}
+
+	// If no common users found, try to find any regular user with UID > 100
+	// This helps on macOS where regular users start at UID 501
+	allUsers := []string{"vma", "user", "test", "admin"}
+	for _, username := range allUsers {
+		if u, err := user.Lookup(username); err == nil {
+			uid64, err := strconv.ParseInt(u.Uid, 10, 32)
+			if err != nil {
+				continue
+			}
+			if uid64 > 100 { // Regular user
+				return u, nil
+			}
+		}
+	}
+
+	// If no common users found, return an error
+	return nil, fmt.Errorf("no suitable non-root user found on this system")
+}
+
+func TestPrivilegeDropper_ExecuteWithPrivilegeDrop_Validation(t *testing.T) {
+	pd := NewPrivilegeDropper()
+	currentUID := uint32(os.Geteuid())
+
+	if currentUID == 0 {
+		// When running as root, test that root can create commands for any user
+		config := ExecutorConfig{
+			UID:        1000, // Target non-root user
+			GID:        1000,
+			Groups:     []uint32{1000},
+			WorkingDir: "/tmp",
+			Shell:      "/bin/sh",
+			Command:    "echo test",
+		}
+
+		cmd, err := pd.CreateExecutorCommand(context.Background(), config)
+		assert.NoError(t, err, "Root should be able to create commands for any user")
+		assert.NotNil(t, cmd)
+	} else {
+		// When running as non-root, test that we can't drop to a different user
+		config := ExecutorConfig{
+			UID:        0, // Try to target root
+			GID:        0,
+			Groups:     []uint32{0},
+			WorkingDir: "/tmp",
+			Shell:      "/bin/sh",
+			Command:    "echo test",
+		}
+
+		_, err := pd.CreateExecutorCommand(context.Background(), config)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "cannot drop privileges")
+	}
+}

client/ssh/server/executor_windows.go

@@ -0,0 +1,592 @@
+//go:build windows
+
+package server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+const (
+	ExitCodeSuccess           = 0
+	ExitCodeLogonFail         = 10
+	ExitCodeCreateProcessFail = 11
+	ExitCodeWorkingDirFail    = 12
+	ExitCodeShellExecFail     = 13
+	ExitCodeValidationFail    = 14
+)
+
+type WindowsExecutorConfig struct {
+	Username   string
+	Domain     string
+	WorkingDir string
+	Shell      string
+	Command    string
+	Args       []string
+	Pty        bool
+	PtyWidth   int
+	PtyHeight  int
+}
+
+type PrivilegeDropper struct {
+	logger *log.Entry
+}
+
+// PrivilegeDropperOption is a functional option for configuring PrivilegeDropper
+type PrivilegeDropperOption func(*PrivilegeDropper)
+
+func NewPrivilegeDropper(opts ...PrivilegeDropperOption) *PrivilegeDropper {
+	pd := &PrivilegeDropper{}
+	for _, opt := range opts {
+		opt(pd)
+	}
+	return pd
+}
+
+// WithLogger sets the logger for the PrivilegeDropper
+func WithLogger(logger *log.Entry) PrivilegeDropperOption {
+	return func(pd *PrivilegeDropper) {
+		pd.logger = logger
+	}
+}
+
+// log returns the logger, falling back to standard logger if none set
+func (pd *PrivilegeDropper) log() *log.Entry {
+	if pd.logger != nil {
+		return pd.logger
+	}
+	return log.NewEntry(log.StandardLogger())
+}
+
+var (
+	advapi32                    = windows.NewLazyDLL("advapi32.dll")
+	procAllocateLocallyUniqueId = advapi32.NewProc("AllocateLocallyUniqueId")
+)
+
+const (
+	logon32LogonNetwork = 3 // Network logon - no password required for authenticated users
+
+	// Common error messages
+	commandFlag          = "-Command"
+	convertUsernameError = "convert username to UTF16: %w"
+	convertDomainError   = "convert domain to UTF16: %w"
+)
+
+// CreateWindowsExecutorCommand creates a Windows command with privilege dropping.
+// The caller must close the returned token handle after starting the process.
+func (pd *PrivilegeDropper) CreateWindowsExecutorCommand(ctx context.Context, config WindowsExecutorConfig) (*exec.Cmd, windows.Token, error) {
+	if config.Username == "" {
+		return nil, 0, errors.New("username cannot be empty")
+	}
+	if config.Shell == "" {
+		return nil, 0, errors.New("shell cannot be empty")
+	}
+
+	shell := config.Shell
+
+	var shellArgs []string
+	if config.Command != "" {
+		shellArgs = []string{shell, commandFlag, config.Command}
+	} else {
+		shellArgs = []string{shell}
+	}
+
+	pd.log().Tracef("creating Windows direct shell command: %s %v", shellArgs[0], shellArgs)
+
+	cmd, token, err := pd.CreateWindowsProcessAsUser(
+		ctx, shellArgs[0], shellArgs, config.Username, config.Domain, config.WorkingDir)
+	if err != nil {
+		return nil, 0, fmt.Errorf("create Windows process as user: %w", err)
+	}
+
+	return cmd, token, nil
+}
+
+const (
+	// StatusSuccess represents successful LSA operation
+	StatusSuccess = 0
+
+	// KerbS4ULogonType message type for domain users with Kerberos
+	KerbS4ULogonType = 12
+	// Msv10s4ulogontype message type for local users with MSV1_0
+	Msv10s4ulogontype = 12
+
+	// MicrosoftKerberosNameA is the authentication package name for Kerberos
+	MicrosoftKerberosNameA = "Kerberos"
+	// Msv10packagename is the authentication package name for MSV1_0
+	Msv10packagename = "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
+
+	NameSamCompatible = 2
+	NameUserPrincipal = 8
+	NameCanonical     = 7
+
+	maxUPNLen = 1024
+)
+
+// kerbS4ULogon structure for S4U authentication (domain users)
+type kerbS4ULogon struct {
+	MessageType uint32
+	Flags       uint32
+	ClientUpn   unicodeString
+	ClientRealm unicodeString
+}
+
+// msv10s4ulogon structure for S4U authentication (local users)
+type msv10s4ulogon struct {
+	MessageType       uint32
+	Flags             uint32
+	UserPrincipalName unicodeString
+	DomainName        unicodeString
+}
+
+// unicodeString structure
+type unicodeString struct {
+	Length        uint16
+	MaximumLength uint16
+	Buffer        *uint16
+}
+
+// lsaString structure
+type lsaString struct {
+	Length        uint16
+	MaximumLength uint16
+	Buffer        *byte
+}
+
+// tokenSource structure
+type tokenSource struct {
+	SourceName       [8]byte
+	SourceIdentifier windows.LUID
+}
+
+// quotaLimits structure
+type quotaLimits struct {
+	PagedPoolLimit        uint32
+	NonPagedPoolLimit     uint32
+	MinimumWorkingSetSize uint32
+	MaximumWorkingSetSize uint32
+	PagefileLimit         uint32
+	TimeLimit             int64
+}
+
+var (
+	secur32                            = windows.NewLazyDLL("secur32.dll")
+	procLsaRegisterLogonProcess        = secur32.NewProc("LsaRegisterLogonProcess")
+	procLsaLookupAuthenticationPackage = secur32.NewProc("LsaLookupAuthenticationPackage")
+	procLsaLogonUser                   = secur32.NewProc("LsaLogonUser")
+	procLsaFreeReturnBuffer            = secur32.NewProc("LsaFreeReturnBuffer")
+	procLsaDeregisterLogonProcess      = secur32.NewProc("LsaDeregisterLogonProcess")
+	procTranslateNameW                 = secur32.NewProc("TranslateNameW")
+)
+
+// newLsaString creates an LsaString from a Go string
+func newLsaString(s string) lsaString {
+	b := append([]byte(s), 0)
+	return lsaString{
+		Length:        uint16(len(s)),
+		MaximumLength: uint16(len(b)),
+		Buffer:        &b[0],
+	}
+}
+
+// generateS4UUserToken creates a Windows token using S4U authentication
+// This is the exact approach OpenSSH for Windows uses for public key authentication
+func generateS4UUserToken(logger *log.Entry, username, domain string) (windows.Handle, error) {
+	userCpn := buildUserCpn(username, domain)
+
+	pd := NewPrivilegeDropper(WithLogger(logger))
+	isDomainUser := !pd.isLocalUser(domain)
+
+	lsaHandle, err := initializeLsaConnection()
+	if err != nil {
+		return 0, err
+	}
+	defer cleanupLsaConnection(lsaHandle)
+
+	authPackageId, err := lookupAuthenticationPackage(lsaHandle, isDomainUser)
+	if err != nil {
+		return 0, err
+	}
+
+	logonInfo, logonInfoSize, err := prepareS4ULogonStructure(logger, username, domain, isDomainUser)
+	if err != nil {
+		return 0, err
+	}
+
+	return performS4ULogon(logger, lsaHandle, authPackageId, logonInfo, logonInfoSize, userCpn, isDomainUser)
+}
+
+// buildUserCpn constructs the user principal name
+func buildUserCpn(username, domain string) string {
+	if domain != "" && domain != "." {
+		return fmt.Sprintf(`%s\%s`, domain, username)
+	}
+	return username
+}
+
+// initializeLsaConnection establishes connection to LSA
+func initializeLsaConnection() (windows.Handle, error) {
+
+	processName := newLsaString("NetBird")
+	var mode uint32
+	var lsaHandle windows.Handle
+	ret, _, _ := procLsaRegisterLogonProcess.Call(
+		uintptr(unsafe.Pointer(&processName)),
+		uintptr(unsafe.Pointer(&lsaHandle)),
+		uintptr(unsafe.Pointer(&mode)),
+	)
+	if ret != StatusSuccess {
+		return 0, fmt.Errorf("LsaRegisterLogonProcess: 0x%x", ret)
+	}
+
+	return lsaHandle, nil
+}
+
+// cleanupLsaConnection closes the LSA connection
+func cleanupLsaConnection(lsaHandle windows.Handle) {
+	if ret, _, _ := procLsaDeregisterLogonProcess.Call(uintptr(lsaHandle)); ret != StatusSuccess {
+		log.Debugf("LsaDeregisterLogonProcess failed: 0x%x", ret)
+	}
+}
+
+// lookupAuthenticationPackage finds the correct authentication package
+func lookupAuthenticationPackage(lsaHandle windows.Handle, isDomainUser bool) (uint32, error) {
+	var authPackageName lsaString
+	if isDomainUser {
+		authPackageName = newLsaString(MicrosoftKerberosNameA)
+	} else {
+		authPackageName = newLsaString(Msv10packagename)
+	}
+
+	var authPackageId uint32
+	ret, _, _ := procLsaLookupAuthenticationPackage.Call(
+		uintptr(lsaHandle),
+		uintptr(unsafe.Pointer(&authPackageName)),
+		uintptr(unsafe.Pointer(&authPackageId)),
+	)
+	if ret != StatusSuccess {
+		return 0, fmt.Errorf("LsaLookupAuthenticationPackage: 0x%x", ret)
+	}
+
+	return authPackageId, nil
+}
+
+// lookupPrincipalName converts DOMAIN\username to username@domain.fqdn (UPN format)
+func lookupPrincipalName(username, domain string) (string, error) {
+	samAccountName := fmt.Sprintf(`%s\%s`, domain, username)
+	samAccountNameUtf16, err := windows.UTF16PtrFromString(samAccountName)
+	if err != nil {
+		return "", fmt.Errorf("convert SAM account name to UTF-16: %w", err)
+	}
+
+	upnBuf := make([]uint16, maxUPNLen+1)
+	upnSize := uint32(len(upnBuf))
+
+	ret, _, _ := procTranslateNameW.Call(
+		uintptr(unsafe.Pointer(samAccountNameUtf16)),
+		uintptr(NameSamCompatible),
+		uintptr(NameUserPrincipal),
+		uintptr(unsafe.Pointer(&upnBuf[0])),
+		uintptr(unsafe.Pointer(&upnSize)),
+	)
+
+	if ret != 0 {
+		upn := windows.UTF16ToString(upnBuf[:upnSize])
+		log.Debugf("Translated %s to explicit UPN: %s", samAccountName, upn)
+		return upn, nil
+	}
+
+	upnSize = uint32(len(upnBuf))
+	ret, _, _ = procTranslateNameW.Call(
+		uintptr(unsafe.Pointer(samAccountNameUtf16)),
+		uintptr(NameSamCompatible),
+		uintptr(NameCanonical),
+		uintptr(unsafe.Pointer(&upnBuf[0])),
+		uintptr(unsafe.Pointer(&upnSize)),
+	)
+
+	if ret != 0 {
+		canonical := windows.UTF16ToString(upnBuf[:upnSize])
+		slashIdx := strings.IndexByte(canonical, '/')
+		if slashIdx > 0 {
+			fqdn := canonical[:slashIdx]
+			upn := fmt.Sprintf("%s@%s", username, fqdn)
+			log.Debugf("Translated %s to implicit UPN: %s (from canonical: %s)", samAccountName, upn, canonical)
+			return upn, nil
+		}
+	}
+
+	log.Debugf("Could not translate %s to UPN, using SAM format", samAccountName)
+	return samAccountName, nil
+}
+
+// prepareS4ULogonStructure creates the appropriate S4U logon structure
+func prepareS4ULogonStructure(logger *log.Entry, username, domain string, isDomainUser bool) (unsafe.Pointer, uintptr, error) {
+	if isDomainUser {
+		return prepareDomainS4ULogon(logger, username, domain)
+	}
+	return prepareLocalS4ULogon(logger, username)
+}
+
+// prepareDomainS4ULogon creates S4U logon structure for domain users
+func prepareDomainS4ULogon(logger *log.Entry, username, domain string) (unsafe.Pointer, uintptr, error) {
+	upn, err := lookupPrincipalName(username, domain)
+	if err != nil {
+		return nil, 0, fmt.Errorf("lookup principal name: %w", err)
+	}
+
+	logger.Debugf("using KerbS4ULogon for domain user with UPN: %s", upn)
+
+	upnUtf16, err := windows.UTF16FromString(upn)
+	if err != nil {
+		return nil, 0, fmt.Errorf(convertUsernameError, err)
+	}
+
+	structSize := unsafe.Sizeof(kerbS4ULogon{})
+	upnByteSize := len(upnUtf16) * 2
+	logonInfoSize := structSize + uintptr(upnByteSize)
+
+	buffer := make([]byte, logonInfoSize)
+	logonInfo := unsafe.Pointer(&buffer[0])
+
+	s4uLogon := (*kerbS4ULogon)(logonInfo)
+	s4uLogon.MessageType = KerbS4ULogonType
+	s4uLogon.Flags = 0
+
+	upnOffset := structSize
+	upnBuffer := (*uint16)(unsafe.Pointer(uintptr(logonInfo) + upnOffset))
+	copy((*[1025]uint16)(unsafe.Pointer(upnBuffer))[:len(upnUtf16)], upnUtf16)
+
+	s4uLogon.ClientUpn = unicodeString{
+		Length:        uint16((len(upnUtf16) - 1) * 2),
+		MaximumLength: uint16(len(upnUtf16) * 2),
+		Buffer:        upnBuffer,
+	}
+	s4uLogon.ClientRealm = unicodeString{}
+
+	return logonInfo, logonInfoSize, nil
+}
+
+// prepareLocalS4ULogon creates S4U logon structure for local users
+func prepareLocalS4ULogon(logger *log.Entry, username string) (unsafe.Pointer, uintptr, error) {
+	logger.Debugf("using Msv1_0S4ULogon for local user: %s", username)
+
+	usernameUtf16, err := windows.UTF16FromString(username)
+	if err != nil {
+		return nil, 0, fmt.Errorf(convertUsernameError, err)
+	}
+
+	domainUtf16, err := windows.UTF16FromString(".")
+	if err != nil {
+		return nil, 0, fmt.Errorf(convertDomainError, err)
+	}
+
+	structSize := unsafe.Sizeof(msv10s4ulogon{})
+	usernameByteSize := len(usernameUtf16) * 2
+	domainByteSize := len(domainUtf16) * 2
+	logonInfoSize := structSize + uintptr(usernameByteSize) + uintptr(domainByteSize)
+
+	buffer := make([]byte, logonInfoSize)
+	logonInfo := unsafe.Pointer(&buffer[0])
+
+	s4uLogon := (*msv10s4ulogon)(logonInfo)
+	s4uLogon.MessageType = Msv10s4ulogontype
+	s4uLogon.Flags = 0x0
+
+	usernameOffset := structSize
+	usernameBuffer := (*uint16)(unsafe.Pointer(uintptr(logonInfo) + usernameOffset))
+	copy((*[256]uint16)(unsafe.Pointer(usernameBuffer))[:len(usernameUtf16)], usernameUtf16)
+
+	s4uLogon.UserPrincipalName = unicodeString{
+		Length:        uint16((len(usernameUtf16) - 1) * 2),
+		MaximumLength: uint16(len(usernameUtf16) * 2),
+		Buffer:        usernameBuffer,
+	}
+
+	domainOffset := usernameOffset + uintptr(usernameByteSize)
+	domainBuffer := (*uint16)(unsafe.Pointer(uintptr(logonInfo) + domainOffset))
+	copy((*[16]uint16)(unsafe.Pointer(domainBuffer))[:len(domainUtf16)], domainUtf16)
+
+	s4uLogon.DomainName = unicodeString{
+		Length:        uint16((len(domainUtf16) - 1) * 2),
+		MaximumLength: uint16(len(domainUtf16) * 2),
+		Buffer:        domainBuffer,
+	}
+
+	return logonInfo, logonInfoSize, nil
+}
+
+// performS4ULogon executes the S4U logon operation
+func performS4ULogon(logger *log.Entry, lsaHandle windows.Handle, authPackageId uint32, logonInfo unsafe.Pointer, logonInfoSize uintptr, userCpn string, isDomainUser bool) (windows.Handle, error) {
+	var tokenSource tokenSource
+	copy(tokenSource.SourceName[:], "netbird")
+	if ret, _, _ := procAllocateLocallyUniqueId.Call(uintptr(unsafe.Pointer(&tokenSource.SourceIdentifier))); ret == 0 {
+		logger.Debugf("AllocateLocallyUniqueId failed")
+	}
+
+	originName := newLsaString("netbird")
+
+	var profile uintptr
+	var profileSize uint32
+	var logonId windows.LUID
+	var token windows.Handle
+	var quotas quotaLimits
+	var subStatus int32
+
+	ret, _, _ := procLsaLogonUser.Call(
+		uintptr(lsaHandle),
+		uintptr(unsafe.Pointer(&originName)),
+		logon32LogonNetwork,
+		uintptr(authPackageId),
+		uintptr(logonInfo),
+		logonInfoSize,
+		0,
+		uintptr(unsafe.Pointer(&tokenSource)),
+		uintptr(unsafe.Pointer(&profile)),
+		uintptr(unsafe.Pointer(&profileSize)),
+		uintptr(unsafe.Pointer(&logonId)),
+		uintptr(unsafe.Pointer(&token)),
+		uintptr(unsafe.Pointer(&quotas)),
+		uintptr(unsafe.Pointer(&subStatus)),
+	)
+
+	if profile != 0 {
+		if ret, _, _ := procLsaFreeReturnBuffer.Call(profile); ret != StatusSuccess {
+			logger.Debugf("LsaFreeReturnBuffer failed: 0x%x", ret)
+		}
+	}
+
+	if ret != StatusSuccess {
+		return 0, fmt.Errorf("LsaLogonUser S4U for %s: NTSTATUS=0x%x, SubStatus=0x%x", userCpn, ret, subStatus)
+	}
+
+	logger.Debugf("created S4U %s token for user %s",
+		map[bool]string{true: "domain", false: "local"}[isDomainUser], userCpn)
+	return token, nil
+}
+
+// createToken implements NetBird trust-based authentication using S4U
+func (pd *PrivilegeDropper) createToken(username, domain string) (windows.Handle, error) {
+	fullUsername := buildUserCpn(username, domain)
+
+	if err := userExists(fullUsername, username, domain); err != nil {
+		return 0, err
+	}
+
+	isLocalUser := pd.isLocalUser(domain)
+
+	if isLocalUser {
+		return pd.authenticateLocalUser(username, fullUsername)
+	}
+	return pd.authenticateDomainUser(username, domain, fullUsername)
+}
+
+// userExists checks if the target useVerifier exists on the system
+func userExists(fullUsername, username, domain string) error {
+	if _, err := lookupUser(fullUsername); err != nil {
+		log.Debugf("User %s not found: %v", fullUsername, err)
+		if domain != "" && domain != "." {
+			_, err = lookupUser(username)
+		}
+		if err != nil {
+			return fmt.Errorf("target user %s not found: %w", fullUsername, err)
+		}
+	}
+	return nil
+}
+
+// isLocalUser determines if this is a local user vs domain user
+func (pd *PrivilegeDropper) isLocalUser(domain string) bool {
+	hostname, err := os.Hostname()
+	if err != nil {
+		hostname = "localhost"
+	}
+
+	return domain == "" || domain == "." ||
+		strings.EqualFold(domain, hostname)
+}
+
+// authenticateLocalUser handles authentication for local users
+func (pd *PrivilegeDropper) authenticateLocalUser(username, fullUsername string) (windows.Handle, error) {
+	pd.log().Debugf("using S4U authentication for local user %s", fullUsername)
+	token, err := generateS4UUserToken(pd.log(), username, ".")
+	if err != nil {
+		return 0, fmt.Errorf("S4U authentication for local user %s: %w", fullUsername, err)
+	}
+	return token, nil
+}
+
+// authenticateDomainUser handles authentication for domain users
+func (pd *PrivilegeDropper) authenticateDomainUser(username, domain, fullUsername string) (windows.Handle, error) {
+	pd.log().Debugf("using S4U authentication for domain user %s", fullUsername)
+	token, err := generateS4UUserToken(pd.log(), username, domain)
+	if err != nil {
+		return 0, fmt.Errorf("S4U authentication for domain user %s: %w", fullUsername, err)
+	}
+	pd.log().Debugf("successfully created S4U token for domain user %s", fullUsername)
+	return token, nil
+}
+
+// CreateWindowsProcessAsUser creates a process as user with safe argument passing (for SFTP and executables).
+// The caller must close the returned token handle after starting the process.
+func (pd *PrivilegeDropper) CreateWindowsProcessAsUser(ctx context.Context, executablePath string, args []string, username, domain, workingDir string) (*exec.Cmd, windows.Token, error) {
+	token, err := pd.createToken(username, domain)
+	if err != nil {
+		return nil, 0, fmt.Errorf("user authentication: %w", err)
+	}
+
+	defer func() {
+		if err := windows.CloseHandle(token); err != nil {
+			pd.log().Debugf("close impersonation token: %v", err)
+		}
+	}()
+
+	cmd, primaryToken, err := pd.createProcessWithToken(ctx, windows.Token(token), executablePath, args, workingDir)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return cmd, primaryToken, nil
+}
+
+// createProcessWithToken creates process with the specified token and executable path.
+// The caller must close the returned token handle after starting the process.
+func (pd *PrivilegeDropper) createProcessWithToken(ctx context.Context, sourceToken windows.Token, executablePath string, args []string, workingDir string) (*exec.Cmd, windows.Token, error) {
+	cmd := exec.CommandContext(ctx, executablePath, args[1:]...)
+	cmd.Dir = workingDir
+
+	var primaryToken windows.Token
+	err := windows.DuplicateTokenEx(
+		sourceToken,
+		windows.TOKEN_ALL_ACCESS,
+		nil,
+		windows.SecurityIdentification,
+		windows.TokenPrimary,
+		&primaryToken,
+	)
+	if err != nil {
+		return nil, 0, fmt.Errorf("duplicate token to primary token: %w", err)
+	}
+
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Token: syscall.Token(primaryToken),
+	}
+
+	return cmd, primaryToken, nil
+}
+
+// createSuCommand creates a command using su - for privilege switching (Windows stub).
+func (s *Server) createSuCommand(*log.Entry, ssh.Session, *user.User, bool) (*exec.Cmd, error) {
+	return nil, fmt.Errorf("su command not available on Windows")
+}

client/ssh/server/getent_cgo_unix.go

@@ -0,0 +1,24 @@
+//go:build cgo && !osusergo && !windows
+
+package server
+
+import "os/user"
+
+// lookupWithGetent with CGO delegates directly to os/user.Lookup.
+// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
+// the NSS stack natively. If it fails, the user truly doesn't exist and
+// getent would also fail.
+func lookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// currentUserWithGetent with CGO delegates directly to os/user.Current.
+func currentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// groupIdsWithFallback with CGO delegates directly to user.GroupIds.
+// libc's getgrouplist handles NSS groups natively.
+func groupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/ssh/server/getent_nocgo_unix.go

@@ -0,0 +1,74 @@
+//go:build (!cgo || osusergo) && !windows
+
+package server
+
+import (
+	"os"
+	"os/user"
+	"strconv"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
+// Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
+// getent goes through the host's NSS stack.
+func lookupWithGetent(username string) (*user.User, error) {
+	u, err := user.Lookup(username)
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
+
+	u, _, getentErr := runGetent(username)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
+		return nil, stdErr
+	}
+
+	return u, nil
+}
+
+// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
+func currentUserWithGetent() (*user.User, error) {
+	u, err := user.Current()
+	if err == nil {
+		return u, nil
+	}
+
+	stdErr := err
+	uid := strconv.Itoa(os.Getuid())
+	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
+
+	u, _, getentErr := runGetent(uid)
+	if getentErr != nil {
+		return nil, stdErr
+	}
+
+	return u, nil
+}
+
+// groupIdsWithFallback gets group IDs for a user via the id command first,
+// falling back to user.GroupIds().
+// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
+// this intentionally tries `id -G` first because without CGO, user.GroupIds()
+// only reads /etc/group and silently returns incomplete results for NSS users
+// (no error, just missing groups). The id command goes through NSS and returns
+// the full set.
+func groupIdsWithFallback(u *user.User) ([]string, error) {
+	ids, err := runIdGroups(u.Username)
+	if err == nil {
+		return ids, nil
+	}
+
+	log.Debugf("id -G %q failed, falling back to user.GroupIds(): %v", u.Username, err)
+
+	ids, stdErr := u.GroupIds()
+	if stdErr != nil {
+		return nil, stdErr
+	}
+
+	return ids, nil
+}

client/ssh/server/getent_test.go

@@ -0,0 +1,172 @@
+package server
+
+import (
+	"os/user"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLookupWithGetent_CurrentUser(t *testing.T) {
+	// The current user should always be resolvable on any platform
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := lookupWithGetent(current.Username)
+	require.NoError(t, err)
+	assert.Equal(t, current.Username, u.Username)
+	assert.Equal(t, current.Uid, u.Uid)
+	assert.Equal(t, current.Gid, u.Gid)
+}
+
+func TestLookupWithGetent_NonexistentUser(t *testing.T) {
+	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
+	require.Error(t, err, "should fail for nonexistent user")
+}
+
+func TestCurrentUserWithGetent(t *testing.T) {
+	stdUser, err := user.Current()
+	require.NoError(t, err)
+
+	u, err := currentUserWithGetent()
+	require.NoError(t, err)
+	assert.Equal(t, stdUser.Uid, u.Uid)
+	assert.Equal(t, stdUser.Username, u.Username)
+}
+
+func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	groups, err := groupIdsWithFallback(current)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "current user should have at least one group")
+
+	if runtime.GOOS != "windows" {
+		for _, gid := range groups {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			assert.NoError(t, err, "group ID %q should be a valid uint32", gid)
+		}
+	}
+}
+
+func TestGetShellFromGetent_CurrentUser(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		// Windows stub always returns empty, which is correct
+		shell := getShellFromGetent("1000")
+		assert.Empty(t, shell, "Windows stub should return empty")
+		return
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
+	shell := getShellFromGetent(current.Uid)
+	if shell == "" {
+		t.Log("getShellFromGetent returned empty, getent may not be available")
+		return
+	}
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+}
+
+func TestLookupWithGetent_RootUser(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("no root user on Windows")
+	}
+
+	u, err := lookupWithGetent("root")
+	if err != nil {
+		t.Skip("root user not available on this system")
+	}
+	assert.Equal(t, "0", u.Uid, "root should have UID 0")
+}
+
+// TestIntegration_FullLookupChain exercises the complete user lookup chain
+// against the real system, testing that all wrappers (lookupWithGetent,
+// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
+// consistent and correct results when composed together.
+func TestIntegration_FullLookupChain(t *testing.T) {
+	// Step 1: currentUserWithGetent must resolve the running user.
+	current, err := currentUserWithGetent()
+	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
+	require.NotEmpty(t, current.Uid)
+	require.NotEmpty(t, current.Username)
+
+	// Step 2: lookupWithGetent by the same username must return matching identity.
+	byName, err := lookupWithGetent(current.Username)
+	require.NoError(t, err)
+	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
+	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
+	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
+
+	// Step 3: groupIdsWithFallback must return at least the primary GID.
+	groups, err := groupIdsWithFallback(current)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "user must have at least one group")
+
+	foundPrimary := false
+	for _, gid := range groups {
+		if runtime.GOOS != "windows" {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			require.NoError(t, err, "group ID %q must be a valid uint32", gid)
+		}
+		if gid == current.Gid {
+			foundPrimary = true
+		}
+	}
+	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
+
+	// Step 4: getShellFromGetent should either return a valid shell path or empty
+	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
+	if runtime.GOOS != "windows" {
+		shell := getShellFromGetent(current.Uid)
+		if shell != "" {
+			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+		}
+	}
+}
+
+// TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
+// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
+// testing the handoff between the two functions as used by the SSH server.
+func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// Simulate the SSH server flow: lookup user, then get their groups.
+	resolved, err := lookupWithGetent(current.Username)
+	require.NoError(t, err)
+
+	groups, err := groupIdsWithFallback(resolved)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "resolved user must have groups")
+
+	// On Unix, all returned GIDs must be valid numeric values.
+	// On Windows, group IDs are SIDs (e.g., "S-1-5-32-544").
+	if runtime.GOOS != "windows" {
+		for _, gid := range groups {
+			_, err := strconv.ParseUint(gid, 10, 32)
+			assert.NoError(t, err, "group ID %q should be numeric", gid)
+		}
+	}
+}
+
+// TestIntegration_ShellLookupChain tests the full shell resolution chain
+// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
+func TestIntegration_ShellLookupChain(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Unix shell lookup not applicable on Windows")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	// getUserShell is the top-level function used by the SSH server.
+	shell := getUserShell(current.Uid)
+	require.NotEmpty(t, shell, "getUserShell must always return a shell")
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+}

client/ssh/server/getent_unix.go

@@ -0,0 +1,127 @@
+//go:build !windows
+
+package server
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strings"
+	"time"
+)
+
+const getentTimeout = 5 * time.Second
+
+// getShellFromGetent gets a user's login shell via getent by UID.
+// This is needed even with CGO because getShellFromPasswd reads /etc/passwd
+// directly and won't find NSS-provided users there.
+func getShellFromGetent(userID string) string {
+	_, shell, err := runGetent(userID)
+	if err != nil {
+		return ""
+	}
+	return shell
+}
+
+// runGetent executes `getent passwd <query>` and returns the user and login shell.
+func runGetent(query string) (*user.User, string, error) {
+	if !validateGetentInput(query) {
+		return nil, "", fmt.Errorf("invalid getent input: %q", query)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", "passwd", query).Output()
+	if err != nil {
+		return nil, "", fmt.Errorf("getent passwd %s: %w", query, err)
+	}
+
+	return parseGetentPasswd(string(out))
+}
+
+// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+func parseGetentPasswd(output string) (*user.User, string, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 6 {
+		return nil, "", fmt.Errorf("unexpected getent output (need 6+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" || fields[3] == "" {
+		return nil, "", fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	var shell string
+	if len(fields) >= 7 {
+		shell = fields[6]
+	}
+
+	return &user.User{
+		Username: fields[0],
+		Uid:      fields[2],
+		Gid:      fields[3],
+		Name:     fields[4],
+		HomeDir:  fields[5],
+	}, shell, nil
+}
+
+// validateGetentInput checks that the input is safe to pass to getent or id.
+// Allows POSIX usernames, numeric UIDs, and common NSS extensions
+// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
+// rejected so the input can never be parsed as a command-line flag.
+func validateGetentInput(input string) bool {
+	maxLen := 32
+	if runtime.GOOS == "linux" {
+		maxLen = 256
+	}
+
+	if len(input) == 0 || len(input) > maxLen {
+		return false
+	}
+
+	if input[0] == '-' {
+		return false
+	}
+
+	for _, r := range input {
+		if isAllowedGetentChar(r) {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+func isAllowedGetentChar(r rune) bool {
+	if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' {
+		return true
+	}
+	switch r {
+	case '.', '_', '-', '@', '+', '$':
+		return true
+	}
+	return false
+}
+
+// runIdGroups runs `id -G <username>` and returns the space-separated group IDs.
+func runIdGroups(username string) ([]string, error) {
+	if !validateGetentInput(username) {
+		return nil, fmt.Errorf("invalid username for id command: %q", username)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "id", "-G", username).Output()
+	if err != nil {
+		return nil, fmt.Errorf("id -G %s: %w", username, err)
+	}
+
+	trimmed := strings.TrimSpace(string(out))
+	if trimmed == "" {
+		return nil, fmt.Errorf("id -G %s: empty output", username)
+	}
+	return strings.Fields(trimmed), nil
+}

client/ssh/server/getent_unix_test.go

@@ -0,0 +1,413 @@
+//go:build !windows
+
+package server
+
+import (
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseGetentPasswd(t *testing.T) {
+	tests := []struct {
+		name        string
+		input       string
+		wantUser    *user.User
+		wantShell   string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:  "standard entry",
+			input: "alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash\n",
+			wantUser: &user.User{
+				Username: "alice",
+				Uid:      "1001",
+				Gid:      "1001",
+				Name:     "Alice Smith",
+				HomeDir:  "/home/alice",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "root entry",
+			input: "root:x:0:0:root:/root:/bin/bash",
+			wantUser: &user.User{
+				Username: "root",
+				Uid:      "0",
+				Gid:      "0",
+				Name:     "root",
+				HomeDir:  "/root",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "empty gecos field",
+			input: "svc:x:999:999::/var/lib/svc:/usr/sbin/nologin",
+			wantUser: &user.User{
+				Username: "svc",
+				Uid:      "999",
+				Gid:      "999",
+				Name:     "",
+				HomeDir:  "/var/lib/svc",
+			},
+			wantShell: "/usr/sbin/nologin",
+		},
+		{
+			name:  "gecos with commas",
+			input: "john:x:1002:1002:John Doe,Room 101,555-1234,555-4321:/home/john:/bin/zsh",
+			wantUser: &user.User{
+				Username: "john",
+				Uid:      "1002",
+				Gid:      "1002",
+				Name:     "John Doe,Room 101,555-1234,555-4321",
+				HomeDir:  "/home/john",
+			},
+			wantShell: "/bin/zsh",
+		},
+		{
+			name:  "remote user with large UID",
+			input: "remoteuser:*:50001:50001:Remote User:/home/remoteuser:/bin/bash\n",
+			wantUser: &user.User{
+				Username: "remoteuser",
+				Uid:      "50001",
+				Gid:      "50001",
+				Name:     "Remote User",
+				HomeDir:  "/home/remoteuser",
+			},
+			wantShell: "/bin/bash",
+		},
+		{
+			name:  "no shell field (only 6 fields)",
+			input: "minimal:x:1000:1000::/home/minimal",
+			wantUser: &user.User{
+				Username: "minimal",
+				Uid:      "1000",
+				Gid:      "1000",
+				Name:     "",
+				HomeDir:  "/home/minimal",
+			},
+			wantShell: "",
+		},
+		{
+			name:        "too few fields",
+			input:       "bad:x:1000",
+			wantErr:     true,
+			errContains: "need 6+ fields",
+		},
+		{
+			name:        "empty username",
+			input:       ":x:1000:1000::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty UID",
+			input:       "test:x::1000::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty GID",
+			input:       "test:x:1000:::/home/test:/bin/bash",
+			wantErr:     true,
+			errContains: "missing required fields",
+		},
+		{
+			name:        "empty input",
+			input:       "",
+			wantErr:     true,
+			errContains: "need 6+ fields",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			u, shell, err := parseGetentPasswd(tt.input)
+			if tt.wantErr {
+				require.Error(t, err)
+				if tt.errContains != "" {
+					assert.Contains(t, err.Error(), tt.errContains)
+				}
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantUser.Username, u.Username, "username")
+			assert.Equal(t, tt.wantUser.Uid, u.Uid, "UID")
+			assert.Equal(t, tt.wantUser.Gid, u.Gid, "GID")
+			assert.Equal(t, tt.wantUser.Name, u.Name, "name/gecos")
+			assert.Equal(t, tt.wantUser.HomeDir, u.HomeDir, "home directory")
+			assert.Equal(t, tt.wantShell, shell, "shell")
+		})
+	}
+}
+
+func TestValidateGetentInput(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"normal username", "alice", true},
+		{"numeric UID", "1001", true},
+		{"dots and underscores", "alice.bob_test", true},
+		{"hyphen", "alice-bob", true},
+		{"leading hyphen rejected", "-i", false},
+		{"leading double hyphen rejected", "--no-idn", false},
+		{"lone hyphen rejected", "-", false},
+		{"kerberos principal", "user@REALM", true},
+		{"samba machine account", "MACHINE$", true},
+		{"NIS compat", "+user", true},
+		{"empty", "", false},
+		{"null byte", "alice\x00bob", false},
+		{"newline", "alice\nbob", false},
+		{"tab", "alice\tbob", false},
+		{"control char", "alice\x01bob", false},
+		{"DEL char", "alice\x7fbob", false},
+		{"space rejected", "alice bob", false},
+		{"semicolon rejected", "alice;bob", false},
+		{"backtick rejected", "alice`bob", false},
+		{"pipe rejected", "alice|bob", false},
+		{"33 chars exceeds non-linux max", makeLongString(33), runtime.GOOS == "linux"},
+		{"256 chars at linux max", makeLongString(256), runtime.GOOS == "linux"},
+		{"257 chars exceeds all limits", makeLongString(257), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, validateGetentInput(tt.input))
+		})
+	}
+}
+
+func makeLongString(n int) string {
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = 'a'
+	}
+	return string(b)
+}
+
+func TestRunGetent_RootUser(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	u, shell, err := runGetent("root")
+	require.NoError(t, err)
+	assert.Equal(t, "root", u.Username)
+	assert.Equal(t, "0", u.Uid)
+	assert.Equal(t, "0", u.Gid)
+	assert.NotEmpty(t, shell, "root should have a shell")
+}
+
+func TestRunGetent_ByUID(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	u, _, err := runGetent("0")
+	require.NoError(t, err)
+	assert.Equal(t, "root", u.Username)
+	assert.Equal(t, "0", u.Uid)
+}
+
+func TestRunGetent_NonexistentUser(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
+	assert.Error(t, err)
+}
+
+func TestRunGetent_InvalidInput(t *testing.T) {
+	_, _, err := runGetent("")
+	assert.Error(t, err)
+
+	_, _, err = runGetent("user\x00name")
+	assert.Error(t, err)
+}
+
+func TestRunGetent_NotAvailable(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err == nil {
+		t.Skip("getent is available, can't test missing case")
+	}
+
+	_, _, err := runGetent("root")
+	assert.Error(t, err, "should fail when getent is not installed")
+}
+
+func TestRunIdGroups_CurrentUser(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	groups, err := runIdGroups(current.Username)
+	require.NoError(t, err)
+	require.NotEmpty(t, groups, "current user should have at least one group")
+
+	for _, gid := range groups {
+		_, err := strconv.ParseUint(gid, 10, 32)
+		assert.NoError(t, err, "group ID %q should be a valid uint32", gid)
+	}
+}
+
+func TestRunIdGroups_NonexistentUser(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	_, err := runIdGroups("nonexistent_user_xyzzy_12345")
+	assert.Error(t, err)
+}
+
+func TestRunIdGroups_InvalidInput(t *testing.T) {
+	_, err := runIdGroups("")
+	assert.Error(t, err)
+
+	_, err = runIdGroups("user\x00name")
+	assert.Error(t, err)
+}
+
+func TestGetentResultsMatchStdlib(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	getentUser, _, err := runGetent(current.Username)
+	require.NoError(t, err)
+
+	assert.Equal(t, current.Username, getentUser.Username, "username should match")
+	assert.Equal(t, current.Uid, getentUser.Uid, "UID should match")
+	assert.Equal(t, current.Gid, getentUser.Gid, "GID should match")
+	assert.Equal(t, current.HomeDir, getentUser.HomeDir, "home directory should match")
+}
+
+func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	getentUser, _, err := runGetent(current.Uid)
+	require.NoError(t, err)
+
+	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
+	assert.Equal(t, current.Uid, getentUser.Uid, "UID should match")
+}
+
+func TestIdGroupsMatchStdlib(t *testing.T) {
+	if _, err := exec.LookPath("id"); err != nil {
+		t.Skip("id not available on this system")
+	}
+
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	stdGroups, err := current.GroupIds()
+	if err != nil {
+		t.Skip("os/user.GroupIds() not working, likely CGO_ENABLED=0")
+	}
+
+	idGroups, err := runIdGroups(current.Username)
+	require.NoError(t, err)
+
+	// Deduplicate both lists: id -G can return duplicates (e.g., root in Docker)
+	// and ElementsMatch treats duplicates as distinct.
+	assert.ElementsMatch(t, uniqueStrings(stdGroups), uniqueStrings(idGroups), "id -G should return same groups as os/user")
+}
+
+func uniqueStrings(ss []string) []string {
+	seen := make(map[string]struct{}, len(ss))
+	out := make([]string, 0, len(ss))
+	for _, s := range ss {
+		if _, ok := seen[s]; ok {
+			continue
+		}
+		seen[s] = struct{}{}
+		out = append(out, s)
+	}
+	return out
+}
+
+// TestGetShellFromPasswd_CurrentUser verifies that getShellFromPasswd correctly
+// reads the current user's shell from /etc/passwd by comparing it against what
+// getent reports (which goes through NSS).
+func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
+	current, err := user.Current()
+	require.NoError(t, err)
+
+	shell := getShellFromPasswd(current.Uid)
+	if shell == "" {
+		t.Skip("current user not found in /etc/passwd (may be an NSS-only user)")
+	}
+
+	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
+
+	if _, err := exec.LookPath("getent"); err == nil {
+		_, getentShell, getentErr := runGetent(current.Uid)
+		if getentErr == nil && getentShell != "" {
+			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
+		}
+	}
+}
+
+// TestGetShellFromPasswd_RootUser verifies that getShellFromPasswd can read
+// root's shell from /etc/passwd. Root is guaranteed to be in /etc/passwd on
+// any standard Unix system.
+func TestGetShellFromPasswd_RootUser(t *testing.T) {
+	shell := getShellFromPasswd("0")
+	require.NotEmpty(t, shell, "root (UID 0) must be in /etc/passwd")
+	assert.True(t, shell[0] == '/', "root shell should be an absolute path, got %q", shell)
+}
+
+// TestGetShellFromPasswd_NonexistentUID verifies that getShellFromPasswd
+// returns empty for a UID that doesn't exist in /etc/passwd.
+func TestGetShellFromPasswd_NonexistentUID(t *testing.T) {
+	shell := getShellFromPasswd("4294967294")
+	assert.Empty(t, shell, "nonexistent UID should return empty shell")
+}
+
+// TestGetShellFromPasswd_MatchesGetentForKnownUsers reads /etc/passwd directly
+// and cross-validates every entry against getent to ensure parseGetentPasswd
+// and getShellFromPasswd agree on shell values.
+func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
+	if _, err := exec.LookPath("getent"); err != nil {
+		t.Skip("getent not available")
+	}
+
+	// Pick a few well-known system UIDs that are virtually always in /etc/passwd.
+	uids := []string{"0"} // root
+
+	current, err := user.Current()
+	require.NoError(t, err)
+	uids = append(uids, current.Uid)
+
+	for _, uid := range uids {
+		passwdShell := getShellFromPasswd(uid)
+		if passwdShell == "" {
+			continue
+		}
+
+		_, getentShell, err := runGetent(uid)
+		if err != nil {
+			continue
+		}
+
+		assert.Equal(t, getentShell, passwdShell, "shell mismatch for UID %s", uid)
+	}
+}

client/ssh/server/getent_windows.go

@@ -0,0 +1,26 @@
+//go:build windows
+
+package server
+
+import "os/user"
+
+// lookupWithGetent on Windows just delegates to os/user.Lookup.
+// Windows does not use NSS/getent; its user lookup works without CGO.
+func lookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// currentUserWithGetent on Windows just delegates to os/user.Current.
+func currentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// getShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
+func getShellFromGetent(_ string) string {
+	return ""
+}
+
+// groupIdsWithFallback on Windows just delegates to u.GroupIds().
+func groupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/ssh/server/jwt_test.go

@@ -0,0 +1,753 @@
+package server
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
+	"github.com/netbirdio/netbird/client/ssh/client"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+	"github.com/netbirdio/netbird/client/ssh/testutil"
+	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
+)
+
+func TestJWTEnforcement(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping JWT enforcement tests in short mode")
+	}
+
+	// Set up SSH server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	t.Run("blocks_without_jwt", func(t *testing.T) {
+		jwtConfig := &JWTConfig{
+			Issuer:       "test-issuer",
+			Audiences:    []string{"test-audience"},
+			KeysLocation: "test-keys",
+		}
+		serverConfig := &Config{
+			HostKeyPEM: hostKey,
+			JWT:        jwtConfig,
+		}
+		server := New(serverConfig)
+		server.SetAllowRootLogin(true)
+
+		serverAddr := StartTestServer(t, server)
+		defer func() { require.NoError(t, server.Stop()) }()
+
+		host, portStr, err := net.SplitHostPort(serverAddr)
+		require.NoError(t, err)
+		port, err := strconv.Atoi(portStr)
+		require.NoError(t, err)
+		dialer := &net.Dialer{}
+		serverType, err := detection.DetectSSHServerType(context.Background(), dialer, host, port)
+		if err != nil {
+			t.Logf("Detection failed: %v", err)
+		}
+		t.Logf("Detected server type: %s", serverType)
+
+		config := &cryptossh.ClientConfig{
+			User:            testutil.GetTestUsername(t),
+			Auth:            []cryptossh.AuthMethod{},
+			HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+			Timeout:         2 * time.Second,
+		}
+
+		_, err = cryptossh.Dial("tcp", net.JoinHostPort(host, portStr), config)
+		assert.Error(t, err, "SSH connection should fail when JWT is required but not provided")
+	})
+
+	t.Run("allows_when_disabled", func(t *testing.T) {
+		serverConfigNoJWT := &Config{
+			HostKeyPEM: hostKey,
+			JWT:        nil,
+		}
+		serverNoJWT := New(serverConfigNoJWT)
+		require.False(t, serverNoJWT.jwtEnabled, "JWT should be disabled without config")
+		serverNoJWT.SetAllowRootLogin(true)
+
+		serverAddrNoJWT := StartTestServer(t, serverNoJWT)
+		defer func() { require.NoError(t, serverNoJWT.Stop()) }()
+
+		hostNoJWT, portStrNoJWT, err := net.SplitHostPort(serverAddrNoJWT)
+		require.NoError(t, err)
+		portNoJWT, err := strconv.Atoi(portStrNoJWT)
+		require.NoError(t, err)
+
+		dialer := &net.Dialer{}
+		serverType, err := detection.DetectSSHServerType(context.Background(), dialer, hostNoJWT, portNoJWT)
+		require.NoError(t, err)
+		assert.Equal(t, detection.ServerTypeNetBirdNoJWT, serverType)
+		assert.False(t, serverType.RequiresJWT())
+
+		client, err := connectWithNetBirdClient(t, hostNoJWT, portNoJWT)
+		require.NoError(t, err)
+		defer client.Close()
+	})
+
+}
+
+// setupJWKSServer creates a test HTTP server serving JWKS and returns the server, private key, and URL
+func setupJWKSServer(t *testing.T) (*httptest.Server, *rsa.PrivateKey, string) {
+	privateKey, jwksJSON := generateTestJWKS(t)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if _, err := w.Write(jwksJSON); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+	}))
+
+	return server, privateKey, server.URL
+}
+
+// generateTestJWKS creates a test RSA key pair and returns private key and JWKS JSON
+func generateTestJWKS(t *testing.T) (*rsa.PrivateKey, []byte) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	publicKey := &privateKey.PublicKey
+	n := publicKey.N.Bytes()
+	e := publicKey.E
+
+	jwk := nbjwt.JSONWebKey{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Use: "sig",
+		N:   base64RawURLEncode(n),
+		E:   base64RawURLEncode(big.NewInt(int64(e)).Bytes()),
+	}
+
+	jwks := nbjwt.Jwks{
+		Keys: []nbjwt.JSONWebKey{jwk},
+	}
+
+	jwksJSON, err := json.Marshal(jwks)
+	require.NoError(t, err)
+
+	return privateKey, jwksJSON
+}
+
+func base64RawURLEncode(data []byte) string {
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
+// generateValidJWT creates a valid JWT token for testing
+func generateValidJWT(t *testing.T, privateKey *rsa.PrivateKey, issuer, audience string) string {
+	claims := jwt.MapClaims{
+		"iss": issuer,
+		"aud": audience,
+		"sub": "test-user",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	token.Header["kid"] = "test-key-id"
+
+	tokenString, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	return tokenString
+}
+
+// connectWithNetBirdClient connects to SSH server using NetBird's SSH client
+func connectWithNetBirdClient(t *testing.T, host string, port int) (*client.Client, error) {
+	t.Helper()
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
+
+	ctx := context.Background()
+	return client.Dial(ctx, addr, testutil.GetTestUsername(t), client.DialOptions{
+		InsecureSkipVerify: true,
+	})
+}
+
+// TestJWTDetection tests that server detection correctly identifies JWT-enabled servers
+func TestJWTDetection(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping JWT detection test in short mode")
+	}
+
+	jwksServer, _, jwksURL := setupJWKSServer(t)
+	defer jwksServer.Close()
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	jwtConfig := &JWTConfig{
+		Issuer:       issuer,
+		Audiences:    []string{audience},
+		KeysLocation: jwksURL,
+	}
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        jwtConfig,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() { require.NoError(t, server.Stop()) }()
+
+	host, portStr, err := net.SplitHostPort(serverAddr)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portStr)
+	require.NoError(t, err)
+
+	dialer := &net.Dialer{}
+	serverType, err := detection.DetectSSHServerType(context.Background(), dialer, host, port)
+	require.NoError(t, err)
+	assert.Equal(t, detection.ServerTypeNetBirdJWT, serverType)
+	assert.True(t, serverType.RequiresJWT())
+}
+
+func TestJWTFailClose(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping JWT fail-close tests in short mode")
+	}
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+	defer jwksServer.Close()
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name        string
+		tokenClaims jwt.MapClaims
+	}{
+		{
+			name: "blocks_token_missing_iat",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"aud": audience,
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+			},
+		},
+		{
+			name: "blocks_token_missing_sub",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"aud": audience,
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			},
+		},
+		{
+			name: "blocks_token_missing_iss",
+			tokenClaims: jwt.MapClaims{
+				"aud": audience,
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			},
+		},
+		{
+			name: "blocks_token_missing_aud",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			},
+		},
+		{
+			name: "blocks_token_wrong_issuer",
+			tokenClaims: jwt.MapClaims{
+				"iss": "wrong-issuer",
+				"aud": audience,
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			},
+		},
+		{
+			name: "blocks_token_wrong_audience",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"aud": "wrong-audience",
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Unix(),
+			},
+		},
+		{
+			name: "blocks_expired_token",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"aud": audience,
+				"sub": "test-user",
+				"exp": time.Now().Add(-time.Hour).Unix(),
+				"iat": time.Now().Add(-2 * time.Hour).Unix(),
+			},
+		},
+		{
+			name: "blocks_token_exceeding_max_age",
+			tokenClaims: jwt.MapClaims{
+				"iss": issuer,
+				"aud": audience,
+				"sub": "test-user",
+				"exp": time.Now().Add(time.Hour).Unix(),
+				"iat": time.Now().Add(-2 * time.Hour).Unix(),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			jwtConfig := &JWTConfig{
+				Issuer:       issuer,
+				Audiences:    []string{audience},
+				KeysLocation: jwksURL,
+				MaxTokenAge:  3600,
+			}
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        jwtConfig,
+			}
+			server := New(serverConfig)
+			server.SetAllowRootLogin(true)
+
+			serverAddr := StartTestServer(t, server)
+			defer func() { require.NoError(t, server.Stop()) }()
+
+			host, portStr, err := net.SplitHostPort(serverAddr)
+			require.NoError(t, err)
+
+			token := jwt.NewWithClaims(jwt.SigningMethodRS256, tc.tokenClaims)
+			token.Header["kid"] = "test-key-id"
+			tokenString, err := token.SignedString(privateKey)
+			require.NoError(t, err)
+
+			config := &cryptossh.ClientConfig{
+				User: testutil.GetTestUsername(t),
+				Auth: []cryptossh.AuthMethod{
+					cryptossh.Password(tokenString),
+				},
+				HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+				Timeout:         2 * time.Second,
+			}
+
+			conn, err := cryptossh.Dial("tcp", net.JoinHostPort(host, portStr), config)
+			if conn != nil {
+				defer func() {
+					if err := conn.Close(); err != nil {
+						t.Logf("close connection: %v", err)
+					}
+				}()
+			}
+
+			assert.Error(t, err, "Authentication should fail (fail-close)")
+		})
+	}
+}
+
+// TestJWTAuthentication tests JWT authentication with valid/invalid tokens and enforcement for various connection types
+func TestJWTAuthentication(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping JWT authentication tests in short mode")
+	}
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+	defer jwksServer.Close()
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name          string
+		token         string
+		wantAuthOK    bool
+		setupServer   func(*Server)
+		testOperation func(*testing.T, *cryptossh.Client, string) error
+		wantOpSuccess bool
+	}{
+		{
+			name:       "allows_shell_with_jwt",
+			token:      "valid",
+			wantAuthOK: true,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+				return session.Shell()
+			},
+			wantOpSuccess: true,
+		},
+		{
+			name:       "rejects_invalid_token",
+			token:      "invalid",
+			wantAuthOK: false,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				output, err := session.CombinedOutput("echo test")
+				if err != nil {
+					t.Logf("Command output: %s", string(output))
+					return err
+				}
+				return nil
+			},
+			wantOpSuccess: false,
+		},
+		{
+			name:       "blocks_shell_without_jwt",
+			token:      "",
+			wantAuthOK: false,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				output, err := session.CombinedOutput("echo test")
+				if err != nil {
+					t.Logf("Command output: %s", string(output))
+					return err
+				}
+				return nil
+			},
+			wantOpSuccess: false,
+		},
+		{
+			name:       "blocks_command_without_jwt",
+			token:      "",
+			wantAuthOK: false,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				output, err := session.CombinedOutput("ls")
+				if err != nil {
+					t.Logf("Command output: %s", string(output))
+					return err
+				}
+				return nil
+			},
+			wantOpSuccess: false,
+		},
+		{
+			name:       "allows_sftp_with_jwt",
+			token:      "valid",
+			wantAuthOK: true,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+				s.SetAllowSFTP(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				session.Stdout = io.Discard
+				session.Stderr = io.Discard
+				return session.RequestSubsystem("sftp")
+			},
+			wantOpSuccess: true,
+		},
+		{
+			name:       "blocks_sftp_without_jwt",
+			token:      "",
+			wantAuthOK: false,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+				s.SetAllowSFTP(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				session.Stdout = io.Discard
+				session.Stderr = io.Discard
+				err = session.RequestSubsystem("sftp")
+				if err == nil {
+					err = session.Wait()
+				}
+				return err
+			},
+			wantOpSuccess: false,
+		},
+		{
+			name:       "allows_port_forward_with_jwt",
+			token:      "valid",
+			wantAuthOK: true,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+				s.SetAllowRemotePortForwarding(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				ln, err := conn.Listen("tcp", "127.0.0.1:0")
+				if ln != nil {
+					defer ln.Close()
+				}
+				return err
+			},
+			wantOpSuccess: true,
+		},
+		{
+			name:       "blocks_port_forward_without_jwt",
+			token:      "",
+			wantAuthOK: false,
+			setupServer: func(s *Server) {
+				s.SetAllowRootLogin(true)
+				s.SetAllowLocalPortForwarding(true)
+			},
+			testOperation: func(t *testing.T, conn *cryptossh.Client, _ string) error {
+				ln, err := conn.Listen("tcp", "127.0.0.1:0")
+				if ln != nil {
+					defer ln.Close()
+				}
+				return err
+			},
+			wantOpSuccess: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// TODO: Skip port forwarding tests on Windows - user switching not supported
+			// These features are tested on Linux/Unix platforms
+			if runtime.GOOS == "windows" &&
+				(tc.name == "allows_port_forward_with_jwt" ||
+					tc.name == "blocks_port_forward_without_jwt") {
+				t.Skip("Skipping port forwarding test on Windows - covered by Linux tests")
+			}
+
+			jwtConfig := &JWTConfig{
+				Issuer:       issuer,
+				Audiences:    []string{audience},
+				KeysLocation: jwksURL,
+			}
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        jwtConfig,
+			}
+			server := New(serverConfig)
+			if tc.setupServer != nil {
+				tc.setupServer(server)
+			}
+
+			// Always set up authorization for test-user to ensure tests fail at JWT validation stage
+			testUserHash, err := sshuserhash.HashUserID("test-user")
+			require.NoError(t, err)
+
+			// Get current OS username for machine user mapping
+			currentUser := testutil.GetTestUsername(t)
+
+			authConfig := &sshauth.Config{
+				UserIDClaim:     sshauth.DefaultUserIDClaim,
+				AuthorizedUsers: []sshuserhash.UserIDHash{testUserHash},
+				MachineUsers: map[string][]uint32{
+					currentUser: {0}, // Allow test-user (index 0) to access current OS user
+				},
+			}
+			server.UpdateSSHAuth(authConfig)
+
+			serverAddr := StartTestServer(t, server)
+			defer func() { require.NoError(t, server.Stop()) }()
+
+			host, portStr, err := net.SplitHostPort(serverAddr)
+			require.NoError(t, err)
+
+			var authMethods []cryptossh.AuthMethod
+			switch tc.token {
+			case "valid":
+				token := generateValidJWT(t, privateKey, issuer, audience)
+				authMethods = []cryptossh.AuthMethod{
+					cryptossh.Password(token),
+				}
+			case "invalid":
+				invalidToken := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.invalid"
+				authMethods = []cryptossh.AuthMethod{
+					cryptossh.Password(invalidToken),
+				}
+			}
+
+			config := &cryptossh.ClientConfig{
+				User:            testutil.GetTestUsername(t),
+				Auth:            authMethods,
+				HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+				Timeout:         2 * time.Second,
+			}
+
+			conn, err := cryptossh.Dial("tcp", net.JoinHostPort(host, portStr), config)
+			if tc.wantAuthOK {
+				require.NoError(t, err, "JWT authentication should succeed")
+			} else if err != nil {
+				t.Logf("Connection failed as expected: %v", err)
+				return
+			}
+			if conn != nil {
+				defer func() {
+					if err := conn.Close(); err != nil {
+						t.Logf("close connection: %v", err)
+					}
+				}()
+			}
+
+			err = tc.testOperation(t, conn, serverAddr)
+			if tc.wantOpSuccess {
+				require.NoError(t, err, "Operation should succeed")
+			} else {
+				assert.Error(t, err, "Operation should fail")
+			}
+		})
+	}
+}
+
+// TestJWTMultipleAudiences tests JWT validation with multiple audiences (dashboard and CLI).
+func TestJWTMultipleAudiences(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping JWT multiple audiences tests in short mode")
+	}
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+	defer jwksServer.Close()
+
+	const (
+		issuer            = "https://test-issuer.example.com"
+		dashboardAudience = "dashboard-audience"
+		cliAudience       = "cli-audience"
+	)
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name       string
+		audience   string
+		wantAuthOK bool
+	}{
+		{
+			name:       "accepts_dashboard_audience",
+			audience:   dashboardAudience,
+			wantAuthOK: true,
+		},
+		{
+			name:       "accepts_cli_audience",
+			audience:   cliAudience,
+			wantAuthOK: true,
+		},
+		{
+			name:       "rejects_unknown_audience",
+			audience:   "unknown-audience",
+			wantAuthOK: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			jwtConfig := &JWTConfig{
+				Issuer:       issuer,
+				Audiences:    []string{dashboardAudience, cliAudience},
+				KeysLocation: jwksURL,
+			}
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        jwtConfig,
+			}
+			server := New(serverConfig)
+			server.SetAllowRootLogin(true)
+
+			testUserHash, err := sshuserhash.HashUserID("test-user")
+			require.NoError(t, err)
+
+			currentUser := testutil.GetTestUsername(t)
+			authConfig := &sshauth.Config{
+				UserIDClaim:     sshauth.DefaultUserIDClaim,
+				AuthorizedUsers: []sshuserhash.UserIDHash{testUserHash},
+				MachineUsers: map[string][]uint32{
+					currentUser: {0},
+				},
+			}
+			server.UpdateSSHAuth(authConfig)
+
+			serverAddr := StartTestServer(t, server)
+			defer func() { require.NoError(t, server.Stop()) }()
+
+			host, portStr, err := net.SplitHostPort(serverAddr)
+			require.NoError(t, err)
+
+			token := generateValidJWT(t, privateKey, issuer, tc.audience)
+			config := &cryptossh.ClientConfig{
+				User: testutil.GetTestUsername(t),
+				Auth: []cryptossh.AuthMethod{
+					cryptossh.Password(token),
+				},
+				HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+				Timeout:         2 * time.Second,
+			}
+
+			conn, err := cryptossh.Dial("tcp", net.JoinHostPort(host, portStr), config)
+			if tc.wantAuthOK {
+				require.NoError(t, err, "JWT authentication should succeed for audience %s", tc.audience)
+				defer func() {
+					if err := conn.Close(); err != nil {
+						t.Logf("close connection: %v", err)
+					}
+				}()
+
+				session, err := conn.NewSession()
+				require.NoError(t, err)
+				defer session.Close()
+
+				err = session.Shell()
+				require.NoError(t, err, "Shell should work with valid audience")
+			} else {
+				assert.Error(t, err, "JWT authentication should fail for unknown audience")
+			}
+		})
+	}
+}

client/ssh/server/port_forwarding.go

@@ -0,0 +1,384 @@
+// Package server implements port forwarding for the SSH server.
+//
+// Security note: Port forwarding runs in the main server process without privilege separation.
+// The attack surface is primarily io.Copy through well-tested standard library code, making it
+// lower risk than shell execution which uses privilege-separated child processes. We enforce
+// user-level port restrictions: non-privileged users cannot bind to ports < 1024.
+package server
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net"
+	"runtime"
+	"strconv"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/util/netrelay"
+)
+
+const privilegedPortThreshold = 1024
+
+// sessionKey uniquely identifies an SSH session
+type sessionKey string
+
+// forwardKey uniquely identifies a port forwarding listener
+type forwardKey string
+
+// tcpipForwardMsg represents the structure for tcpip-forward SSH requests
+type tcpipForwardMsg struct {
+	Host string
+	Port uint32
+}
+
+// SetAllowLocalPortForwarding configures local port forwarding
+func (s *Server) SetAllowLocalPortForwarding(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowLocalPortForwarding = allow
+}
+
+// SetAllowRemotePortForwarding configures remote port forwarding
+func (s *Server) SetAllowRemotePortForwarding(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRemotePortForwarding = allow
+}
+
+// configurePortForwarding sets up port forwarding callbacks
+func (s *Server) configurePortForwarding(server *ssh.Server) {
+	allowLocal := s.allowLocalPortForwarding
+	allowRemote := s.allowRemotePortForwarding
+
+	server.LocalPortForwardingCallback = func(ctx ssh.Context, dstHost string, dstPort uint32) bool {
+		logger := s.getRequestLogger(ctx)
+		if !allowLocal {
+			logger.Warnf("local port forwarding denied for %s: disabled", net.JoinHostPort(dstHost, strconv.Itoa(int(dstPort))))
+			return false
+		}
+
+		if err := s.checkPortForwardingPrivileges(ctx, "local", dstPort); err != nil {
+			logger.Warnf("local port forwarding denied for %s: %v", net.JoinHostPort(dstHost, strconv.Itoa(int(dstPort))), err)
+			return false
+		}
+
+		return true
+	}
+
+	server.ReversePortForwardingCallback = func(ctx ssh.Context, bindHost string, bindPort uint32) bool {
+		logger := s.getRequestLogger(ctx)
+		if !allowRemote {
+			logger.Warnf("remote port forwarding denied for %s: disabled", net.JoinHostPort(bindHost, strconv.Itoa(int(bindPort))))
+			return false
+		}
+
+		if err := s.checkPortForwardingPrivileges(ctx, "remote", bindPort); err != nil {
+			logger.Warnf("remote port forwarding denied for %s: %v", net.JoinHostPort(bindHost, strconv.Itoa(int(bindPort))), err)
+			return false
+		}
+
+		return true
+	}
+
+	log.Debugf("SSH server configured with local_forwarding=%v, remote_forwarding=%v", allowLocal, allowRemote)
+}
+
+// checkPortForwardingPrivileges validates privilege requirements for port forwarding operations.
+// For remote port forwarding (binding), it enforces that non-privileged users cannot bind to
+// ports below 1024, mirroring the restriction they would face if binding directly.
+//
+// Note: FeatureSupportsUserSwitch is true because we accept requests from any authenticated user,
+// though we don't actually switch users - port forwarding runs in the server process. The resolved
+// user is used for privileged port access checks.
+func (s *Server) checkPortForwardingPrivileges(ctx ssh.Context, forwardType string, port uint32) error {
+	if ctx == nil {
+		return fmt.Errorf("%s port forwarding denied: no context", forwardType)
+	}
+
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         ctx.User(),
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               forwardType + " port forwarding",
+	})
+
+	if !result.Allowed {
+		return result.Error
+	}
+
+	if err := s.checkPrivilegedPortAccess(forwardType, port, result); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// checkPrivilegedPortAccess enforces that non-privileged users cannot bind to privileged ports.
+// This applies to remote port forwarding where the server binds a port on behalf of the user.
+// On Windows, there is no privileged port restriction, so this check is skipped.
+func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, result PrivilegeCheckResult) error {
+	if runtime.GOOS == "windows" {
+		return nil
+	}
+
+	isBindOperation := forwardType == "remote" || forwardType == "tcpip-forward"
+	if !isBindOperation {
+		return nil
+	}
+
+	// Port 0 means "pick any available port", which will be >= 1024
+	if port == 0 || port >= privilegedPortThreshold {
+		return nil
+	}
+
+	if result.User != nil && isPrivilegedUsername(result.User.Username) {
+		return nil
+	}
+
+	username := "unknown"
+	if result.User != nil {
+		username = result.User.Username
+	}
+	return fmt.Errorf("user %s cannot bind to privileged port %d (requires root)", username, port)
+}
+
+// tcpipForwardHandler handles tcpip-forward requests for remote port forwarding.
+func (s *Server) tcpipForwardHandler(ctx ssh.Context, _ *ssh.Server, req *cryptossh.Request) (bool, []byte) {
+	logger := s.getRequestLogger(ctx)
+
+	if !s.isRemotePortForwardingAllowed() {
+		logger.Warnf("tcpip-forward request denied: remote port forwarding disabled")
+		return false, nil
+	}
+
+	payload, err := s.parseTcpipForwardRequest(req)
+	if err != nil {
+		logger.Errorf("tcpip-forward unmarshal error: %v", err)
+		return false, nil
+	}
+
+	if err := s.checkPortForwardingPrivileges(ctx, "tcpip-forward", payload.Port); err != nil {
+		logger.Warnf("tcpip-forward denied: %v", err)
+		return false, nil
+	}
+
+	sshConn, err := s.getSSHConnection(ctx)
+	if err != nil {
+		logger.Warnf("tcpip-forward request denied: %v", err)
+		return false, nil
+	}
+
+	return s.setupDirectForward(ctx, logger, sshConn, payload)
+}
+
+// cancelTcpipForwardHandler handles cancel-tcpip-forward requests.
+func (s *Server) cancelTcpipForwardHandler(ctx ssh.Context, _ *ssh.Server, req *cryptossh.Request) (bool, []byte) {
+	logger := s.getRequestLogger(ctx)
+
+	var payload tcpipForwardMsg
+	if err := cryptossh.Unmarshal(req.Payload, &payload); err != nil {
+		logger.Errorf("cancel-tcpip-forward unmarshal error: %v", err)
+		return false, nil
+	}
+
+	hostPort := net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port)))
+	key := forwardKey(hostPort)
+	if s.removeRemoteForwardListener(key) {
+		forwardAddr := "-R " + hostPort
+		s.removeConnectionPortForward(ctx.RemoteAddr(), forwardAddr)
+		logger.Infof("remote port forwarding cancelled: %s", hostPort)
+		return true, nil
+	}
+
+	logger.Warnf("cancel-tcpip-forward failed: no listener found for %s", net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port))))
+	return false, nil
+}
+
+// handleRemoteForwardListener handles incoming connections for remote port forwarding.
+func (s *Server) handleRemoteForwardListener(ctx ssh.Context, ln net.Listener, host string, port uint32) {
+	logger := s.getRequestLogger(ctx)
+
+	defer func() {
+		if err := ln.Close(); err != nil {
+			logger.Debugf("remote forward listener close error for %s: %v", net.JoinHostPort(host, strconv.Itoa(int(port))), err)
+		}
+	}()
+
+	acceptChan := make(chan acceptResult, 1)
+
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			select {
+			case acceptChan <- acceptResult{conn: conn, err: err}:
+				if err != nil {
+					return
+				}
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+
+	for {
+		select {
+		case result := <-acceptChan:
+			if result.err != nil {
+				logger.Debugf("remote forward accept error: %v", result.err)
+				return
+			}
+			go s.handleRemoteForwardConnection(ctx, result.conn, host, port)
+		case <-ctx.Done():
+			logger.Debugf("remote forward listener shutting down for %s", net.JoinHostPort(host, strconv.Itoa(int(port))))
+			return
+		}
+	}
+}
+
+// getRequestLogger creates a logger with session/conn and jwt_user context
+func (s *Server) getRequestLogger(ctx ssh.Context) *log.Entry {
+	sessionKey := s.findSessionKeyByContext(ctx)
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if state, exists := s.sessions[sessionKey]; exists {
+		logger := log.WithField("session", sessionKey)
+		if state.jwtUsername != "" {
+			logger = logger.WithField("jwt_user", state.jwtUsername)
+		}
+		return logger
+	}
+
+	if ctx.RemoteAddr() != nil {
+		if connState, exists := s.connections[connKey(ctx.RemoteAddr().String())]; exists {
+			return s.connLogger(connState)
+		}
+	}
+
+	remoteAddr := "unknown"
+	if ctx.RemoteAddr() != nil {
+		remoteAddr = ctx.RemoteAddr().String()
+	}
+	return log.WithField("session", fmt.Sprintf("%s@%s", ctx.User(), remoteAddr))
+}
+
+// isRemotePortForwardingAllowed checks if remote port forwarding is enabled
+func (s *Server) isRemotePortForwardingAllowed() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.allowRemotePortForwarding
+}
+
+// parseTcpipForwardRequest parses the SSH request payload
+func (s *Server) parseTcpipForwardRequest(req *cryptossh.Request) (*tcpipForwardMsg, error) {
+	var payload tcpipForwardMsg
+	err := cryptossh.Unmarshal(req.Payload, &payload)
+	return &payload, err
+}
+
+// getSSHConnection extracts SSH connection from context
+func (s *Server) getSSHConnection(ctx ssh.Context) (*cryptossh.ServerConn, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("no context")
+	}
+	sshConnValue := ctx.Value(ssh.ContextKeyConn)
+	if sshConnValue == nil {
+		return nil, fmt.Errorf("no SSH connection in context")
+	}
+	sshConn, ok := sshConnValue.(*cryptossh.ServerConn)
+	if !ok || sshConn == nil {
+		return nil, fmt.Errorf("invalid SSH connection in context")
+	}
+	return sshConn, nil
+}
+
+// setupDirectForward sets up a direct port forward
+func (s *Server) setupDirectForward(ctx ssh.Context, logger *log.Entry, sshConn *cryptossh.ServerConn, payload *tcpipForwardMsg) (bool, []byte) {
+	bindAddr := net.JoinHostPort(payload.Host, strconv.FormatUint(uint64(payload.Port), 10))
+
+	ln, err := net.Listen("tcp", bindAddr)
+	if err != nil {
+		logger.Errorf("tcpip-forward listen failed on %s: %v", bindAddr, err)
+		return false, nil
+	}
+
+	actualPort := payload.Port
+	if payload.Port == 0 {
+		tcpAddr := ln.Addr().(*net.TCPAddr)
+		actualPort = uint32(tcpAddr.Port)
+		logger.Debugf("tcpip-forward allocated port %d for %s", actualPort, payload.Host)
+	}
+
+	key := forwardKey(net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port))))
+	s.storeRemoteForwardListener(key, ln)
+
+	forwardAddr := "-R " + net.JoinHostPort(payload.Host, strconv.Itoa(int(actualPort)))
+	s.addConnectionPortForward(ctx.User(), ctx.RemoteAddr(), forwardAddr)
+	go s.handleRemoteForwardListener(ctx, ln, payload.Host, actualPort)
+
+	response := make([]byte, 4)
+	binary.BigEndian.PutUint32(response, actualPort)
+
+	logger.Infof("remote port forwarding established: %s", net.JoinHostPort(payload.Host, strconv.Itoa(int(actualPort))))
+	return true, response
+}
+
+// acceptResult holds the result of a listener Accept() call
+type acceptResult struct {
+	conn net.Conn
+	err  error
+}
+
+// handleRemoteForwardConnection handles a single remote port forwarding connection
+func (s *Server) handleRemoteForwardConnection(ctx ssh.Context, conn net.Conn, host string, port uint32) {
+	logger := s.getRequestLogger(ctx)
+
+	sshConn, ok := ctx.Value(ssh.ContextKeyConn).(*cryptossh.ServerConn)
+	if !ok || sshConn == nil {
+		logger.Debugf("remote forward: no SSH connection in context")
+		_ = conn.Close()
+		return
+	}
+
+	remoteAddr, ok := conn.RemoteAddr().(*net.TCPAddr)
+	if !ok {
+		logger.Warnf("remote forward: non-TCP connection type: %T", conn.RemoteAddr())
+		_ = conn.Close()
+		return
+	}
+
+	channel, err := s.openForwardChannel(sshConn, host, port, remoteAddr)
+	if err != nil {
+		logger.Debugf("open forward channel for %s: %v", net.JoinHostPort(host, strconv.Itoa(int(port))), err)
+		_ = conn.Close()
+		return
+	}
+
+	netrelay.Relay(ctx, conn, channel, netrelay.Options{Logger: logger})
+}
+
+// openForwardChannel creates an SSH forwarded-tcpip channel
+func (s *Server) openForwardChannel(sshConn *cryptossh.ServerConn, host string, port uint32, remoteAddr *net.TCPAddr) (cryptossh.Channel, error) {
+	payload := struct {
+		ConnectedAddress  string
+		ConnectedPort     uint32
+		OriginatorAddress string
+		OriginatorPort    uint32
+	}{
+		ConnectedAddress:  host,
+		ConnectedPort:     port,
+		OriginatorAddress: remoteAddr.IP.String(),
+		OriginatorPort:    uint32(remoteAddr.Port),
+	}
+
+	channel, reqs, err := sshConn.OpenChannel("forwarded-tcpip", cryptossh.Marshal(&payload))
+	if err != nil {
+		return nil, fmt.Errorf("open SSH channel: %w", err)
+	}
+
+	go cryptossh.DiscardRequests(reqs)
+	return channel, nil
+}

client/ssh/server/server.go

@@ -0,0 +1,966 @@
+package server
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gliderlabs/ssh"
+	gojwt "github.com/golang-jwt/jwt/v5"
+	log "github.com/sirupsen/logrus"
+	cryptossh "golang.org/x/crypto/ssh"
+	"golang.org/x/exp/maps"
+	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/auth/jwt"
+	"github.com/netbirdio/netbird/util/netrelay"
+	"github.com/netbirdio/netbird/version"
+)
+
+// DefaultSSHPort is the default SSH port of the NetBird's embedded SSH server
+const DefaultSSHPort = 22
+
+// InternalSSHPort is the port SSH server listens on and is redirected to
+const InternalSSHPort = 22022
+
+const (
+	errWriteSession = "write session error: %v"
+	errExitSession  = "exit session error: %v"
+
+	msgPrivilegedUserDisabled = "privileged user login is disabled"
+
+	cmdInteractiveShell = "<interactive shell>"
+	cmdPortForwarding   = "<port forwarding>"
+	cmdSFTP             = "<sftp>"
+	cmdNonInteractive   = "<idle>"
+
+	// DefaultJWTMaxTokenAge is the default maximum age for JWT tokens accepted by the SSH server.
+	// Set to 10 minutes to accommodate identity providers like Azure Entra ID
+	// that backdate the iat claim by up to 5 minutes.
+	DefaultJWTMaxTokenAge = 10 * 60
+)
+
+// directTCPIPDialTimeout bounds how long relayDirectTCPIP waits on a dial to
+// the forwarded destination before rejecting the SSH channel.
+const directTCPIPDialTimeout = 30 * time.Second
+
+var (
+	ErrPrivilegedUserDisabled = errors.New(msgPrivilegedUserDisabled)
+	ErrUserNotFound           = errors.New("user not found")
+)
+
+// PrivilegedUserError represents an error when privileged user login is disabled
+type PrivilegedUserError struct {
+	Username string
+}
+
+func (e *PrivilegedUserError) Error() string {
+	return fmt.Sprintf("%s for user: %s", msgPrivilegedUserDisabled, e.Username)
+}
+
+func (e *PrivilegedUserError) Is(target error) bool {
+	return target == ErrPrivilegedUserDisabled
+}
+
+// UserNotFoundError represents an error when a user cannot be found
+type UserNotFoundError struct {
+	Username string
+	Cause    error
+}
+
+func (e *UserNotFoundError) Error() string {
+	if e.Cause != nil {
+		return fmt.Sprintf("user %s not found: %v", e.Username, e.Cause)
+	}
+	return fmt.Sprintf("user %s not found", e.Username)
+}
+
+func (e *UserNotFoundError) Is(target error) bool {
+	return target == ErrUserNotFound
+}
+
+func (e *UserNotFoundError) Unwrap() error {
+	return e.Cause
+}
+
+// logSessionExitError logs session exit errors, ignoring EOF (normal close) errors
+func logSessionExitError(logger *log.Entry, err error) {
+	if err != nil && !errors.Is(err, io.EOF) {
+		logger.Warnf(errExitSession, err)
+	}
+}
+
+// safeLogCommand returns a safe representation of the command for logging.
+func safeLogCommand(cmd []string) string {
+	if len(cmd) == 0 {
+		return cmdInteractiveShell
+	}
+	if len(cmd) == 1 {
+		return cmd[0]
+	}
+	return fmt.Sprintf("%s [%d args]", cmd[0], len(cmd)-1)
+}
+
+// connState tracks the state of an SSH connection for port forwarding and status display.
+type connState struct {
+	username     string
+	remoteAddr   net.Addr
+	portForwards []string
+	jwtUsername  string
+}
+
+// authKey uniquely identifies an authentication attempt by username and remote address.
+// Used to temporarily store JWT username between passwordHandler and sessionHandler.
+type authKey string
+
+// connKey uniquely identifies an SSH connection by its remote address.
+// Used to track authenticated connections for status display and port forwarding.
+type connKey string
+
+func newAuthKey(username string, remoteAddr net.Addr) authKey {
+	return authKey(fmt.Sprintf("%s@%s", username, remoteAddr.String()))
+}
+
+// sessionState tracks an active SSH session (shell, command, or subsystem like SFTP).
+type sessionState struct {
+	session     ssh.Session
+	sessionType string
+	jwtUsername string
+}
+
+type Server struct {
+	sshServer      *ssh.Server
+	listener       net.Listener
+	extraListeners []net.Listener
+	mu             sync.RWMutex
+	hostKeyPEM     []byte
+
+	// sessions tracks active SSH sessions (shell, command, SFTP).
+	// These are created when a client opens a session channel and requests shell/exec/subsystem.
+	sessions map[sessionKey]*sessionState
+
+	// pendingAuthJWT temporarily stores JWT username during the auth→session handoff.
+	// Populated in passwordHandler, consumed in sessionHandler/sftpSubsystemHandler.
+	pendingAuthJWT map[authKey]string
+
+	// connections tracks all SSH connections by their remote address.
+	// Populated at authentication time, stores JWT username and port forwards for status display.
+	connections map[connKey]*connState
+
+	allowLocalPortForwarding  bool
+	allowRemotePortForwarding bool
+	allowRootLogin            bool
+	allowSFTP                 bool
+	jwtEnabled                bool
+
+	netstackNet *netstack.Net
+
+	wgAddress wgaddr.Address
+
+	remoteForwardListeners map[forwardKey]net.Listener
+
+	jwtValidator *jwt.Validator
+	jwtExtractor *jwt.ClaimsExtractor
+	jwtConfig    *JWTConfig
+
+	authorizer *sshauth.Authorizer
+
+	suSupportsPty    bool
+	loginIsUtilLinux bool
+}
+
+type JWTConfig struct {
+	Issuer       string
+	KeysLocation string
+	MaxTokenAge  int64
+	Audiences    []string
+}
+
+// Config contains all SSH server configuration options
+type Config struct {
+	// JWT authentication configuration. If nil, JWT authentication is disabled
+	JWT *JWTConfig
+
+	// HostKey is the SSH server host key in PEM format
+	HostKeyPEM []byte
+}
+
+// SessionInfo contains information about an active SSH session
+type SessionInfo struct {
+	Username      string
+	RemoteAddress string
+	Command       string
+	JWTUsername   string
+	PortForwards  []string
+}
+
+// New creates an SSH server instance with the provided host key and optional JWT configuration
+// If jwtConfig is nil, JWT authentication is disabled
+func New(config *Config) *Server {
+	s := &Server{
+		mu:                     sync.RWMutex{},
+		hostKeyPEM:             config.HostKeyPEM,
+		sessions:               make(map[sessionKey]*sessionState),
+		pendingAuthJWT:         make(map[authKey]string),
+		remoteForwardListeners: make(map[forwardKey]net.Listener),
+		connections:            make(map[connKey]*connState),
+		jwtEnabled:             config.JWT != nil,
+		jwtConfig:              config.JWT,
+		authorizer:             sshauth.NewAuthorizer(), // Initialize with empty config
+	}
+
+	return s
+}
+
+// Start runs the SSH server
+func (s *Server) Start(ctx context.Context, addr netip.AddrPort) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.sshServer != nil {
+		return errors.New("SSH server is already running")
+	}
+
+	s.suSupportsPty = s.detectSuPtySupport(ctx)
+	s.loginIsUtilLinux = s.detectUtilLinuxLogin(ctx)
+
+	ln, addrDesc, err := s.createListener(ctx, addr)
+	if err != nil {
+		return fmt.Errorf("create listener: %w", err)
+	}
+
+	sshServer, err := s.createSSHServer(ln.Addr())
+	if err != nil {
+		s.closeListener(ln)
+		return fmt.Errorf("create SSH server: %w", err)
+	}
+
+	s.listener = ln
+	s.sshServer = sshServer
+	log.Infof("SSH server started on %s", addrDesc)
+
+	go func() {
+		if err := sshServer.Serve(ln); err != nil && !errors.Is(err, ssh.ErrServerClosed) {
+			log.Errorf("SSH server error: %v", err)
+		}
+	}()
+	return nil
+}
+
+// AddListener starts serving SSH on an additional address (e.g. IPv6).
+// Must be called after Start.
+func (s *Server) AddListener(ctx context.Context, addr netip.AddrPort) error {
+	s.mu.Lock()
+	srv := s.sshServer
+	if srv == nil {
+		s.mu.Unlock()
+		return errors.New("SSH server is not running")
+	}
+
+	ln, addrDesc, err := s.createListener(ctx, addr)
+	if err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("create listener: %w", err)
+	}
+
+	s.extraListeners = append(s.extraListeners, ln)
+	s.mu.Unlock()
+
+	log.Infof("SSH server also listening on %s", addrDesc)
+
+	go func() {
+		if err := srv.Serve(ln); err != nil && !errors.Is(err, ssh.ErrServerClosed) {
+			log.Errorf("SSH server error on %s: %v", addrDesc, err)
+		}
+	}()
+	return nil
+}
+
+func (s *Server) createListener(ctx context.Context, addr netip.AddrPort) (net.Listener, string, error) {
+	if s.netstackNet != nil {
+		ln, err := s.netstackNet.ListenTCPAddrPort(addr)
+		if err != nil {
+			return nil, "", fmt.Errorf("listen on netstack: %w", err)
+		}
+		return ln, fmt.Sprintf("netstack %s", addr), nil
+	}
+
+	tcpAddr := net.TCPAddrFromAddrPort(addr)
+	lc := net.ListenConfig{}
+	ln, err := lc.Listen(ctx, "tcp", tcpAddr.String())
+	if err != nil {
+		return nil, "", fmt.Errorf("listen: %w", err)
+	}
+	return ln, addr.String(), nil
+}
+
+func (s *Server) closeListener(ln net.Listener) {
+	if ln == nil {
+		return
+	}
+	if err := ln.Close(); err != nil {
+		log.Debugf("listener close error: %v", err)
+	}
+}
+
+// Stop closes the SSH server
+func (s *Server) Stop() error {
+	s.mu.Lock()
+	sshServer := s.sshServer
+	if sshServer == nil {
+		s.mu.Unlock()
+		return nil
+	}
+	s.sshServer = nil
+	s.listener = nil
+	extraListeners := s.extraListeners
+	s.extraListeners = nil
+	s.mu.Unlock()
+
+	// Close outside the lock: session handlers need s.mu for unregisterSession.
+	if err := sshServer.Close(); err != nil {
+		log.Debugf("close SSH server: %v", err)
+	}
+
+	for _, ln := range extraListeners {
+		if err := ln.Close(); err != nil {
+			log.Debugf("close extra SSH listener: %v", err)
+		}
+	}
+
+	s.mu.Lock()
+	maps.Clear(s.sessions)
+	maps.Clear(s.pendingAuthJWT)
+	maps.Clear(s.connections)
+
+	for _, listener := range s.remoteForwardListeners {
+		if err := listener.Close(); err != nil {
+			log.Debugf("close remote forward listener: %v", err)
+		}
+	}
+	maps.Clear(s.remoteForwardListeners)
+	s.mu.Unlock()
+
+	return nil
+}
+
+// Addr returns the address the SSH server is listening on, or nil if the server is not running
+func (s *Server) Addr() net.Addr {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if s.listener == nil {
+		return nil
+	}
+
+	return s.listener.Addr()
+}
+
+// GetStatus returns the current status of the SSH server and active sessions.
+func (s *Server) GetStatus() (enabled bool, sessions []SessionInfo) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	enabled = s.sshServer != nil
+	reportedAddrs := make(map[string]bool)
+
+	for _, state := range s.sessions {
+		info := s.buildSessionInfo(state)
+		reportedAddrs[info.RemoteAddress] = true
+		sessions = append(sessions, info)
+	}
+
+	// Add authenticated connections without sessions (e.g., -N or port-forwarding only)
+	for key, connState := range s.connections {
+		remoteAddr := string(key)
+		if reportedAddrs[remoteAddr] {
+			continue
+		}
+		cmd := cmdNonInteractive
+		if len(connState.portForwards) > 0 {
+			cmd = cmdPortForwarding
+		}
+		sessions = append(sessions, SessionInfo{
+			Username:      connState.username,
+			RemoteAddress: remoteAddr,
+			Command:       cmd,
+			JWTUsername:   connState.jwtUsername,
+			PortForwards:  connState.portForwards,
+		})
+	}
+
+	return enabled, sessions
+}
+
+func (s *Server) buildSessionInfo(state *sessionState) SessionInfo {
+	session := state.session
+	cmd := state.sessionType
+	if cmd == "" {
+		cmd = safeLogCommand(session.Command())
+	}
+
+	remoteAddr := session.RemoteAddr().String()
+	info := SessionInfo{
+		Username:      session.User(),
+		RemoteAddress: remoteAddr,
+		Command:       cmd,
+		JWTUsername:   state.jwtUsername,
+	}
+
+	connState, exists := s.connections[connKey(remoteAddr)]
+	if !exists {
+		return info
+	}
+
+	info.PortForwards = connState.portForwards
+	if len(connState.portForwards) > 0 && (cmd == cmdInteractiveShell || cmd == cmdNonInteractive) {
+		info.Command = cmdPortForwarding
+	}
+
+	return info
+}
+
+// SetNetstackNet sets the netstack network for userspace networking
+func (s *Server) SetNetstackNet(net *netstack.Net) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.netstackNet = net
+}
+
+// SetNetworkValidation configures network-based connection filtering
+func (s *Server) SetNetworkValidation(addr wgaddr.Address) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.wgAddress = addr
+}
+
+// UpdateSSHAuth updates the SSH fine-grained access control configuration
+// This should be called when network map updates include new SSH auth configuration
+func (s *Server) UpdateSSHAuth(config *sshauth.Config) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Reset JWT validator/extractor to pick up new userIDClaim
+	s.jwtValidator = nil
+	s.jwtExtractor = nil
+
+	s.authorizer.Update(config)
+}
+
+// ensureJWTValidator initializes the JWT validator and extractor if not already initialized
+func (s *Server) ensureJWTValidator() error {
+	s.mu.RLock()
+	if s.jwtValidator != nil && s.jwtExtractor != nil {
+		s.mu.RUnlock()
+		return nil
+	}
+	config := s.jwtConfig
+	authorizer := s.authorizer
+	s.mu.RUnlock()
+
+	if config == nil {
+		return fmt.Errorf("JWT config not set")
+	}
+
+	if len(config.Audiences) == 0 {
+		return fmt.Errorf("JWT config has no audiences configured")
+	}
+
+	log.Debugf("Initializing JWT validator (issuer: %s, audiences: %v)", config.Issuer, config.Audiences)
+	validator := jwt.NewValidator(
+		config.Issuer,
+		config.Audiences,
+		config.KeysLocation,
+		true,
+	)
+
+	// Use custom userIDClaim from authorizer if available
+	extractorOptions := []jwt.ClaimsExtractorOption{
+		jwt.WithAudience(config.Audiences[0]),
+	}
+	if authorizer.GetUserIDClaim() != "" {
+		extractorOptions = append(extractorOptions, jwt.WithUserIDClaim(authorizer.GetUserIDClaim()))
+		log.Debugf("Using custom user ID claim: %s", authorizer.GetUserIDClaim())
+	}
+
+	extractor := jwt.NewClaimsExtractor(extractorOptions...)
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.jwtValidator != nil && s.jwtExtractor != nil {
+		return nil
+	}
+
+	s.jwtValidator = validator
+	s.jwtExtractor = extractor
+
+	log.Infof("JWT validator initialized successfully")
+	return nil
+}
+
+func (s *Server) validateJWTToken(tokenString string) (*gojwt.Token, error) {
+	s.mu.RLock()
+	jwtValidator := s.jwtValidator
+	jwtConfig := s.jwtConfig
+	s.mu.RUnlock()
+
+	if jwtValidator == nil {
+		return nil, fmt.Errorf("JWT validator not initialized")
+	}
+
+	token, err := jwtValidator.ValidateAndParse(context.Background(), tokenString)
+	if err != nil {
+		if jwtConfig != nil {
+			if claims, parseErr := s.parseTokenWithoutValidation(tokenString); parseErr == nil {
+				return nil, fmt.Errorf("validate token (expected issuer=%s, audiences=%v, actual issuer=%v, audience=%v): %w",
+					jwtConfig.Issuer, jwtConfig.Audiences, claims["iss"], claims["aud"], err)
+			}
+		}
+		return nil, fmt.Errorf("validate token: %w", err)
+	}
+
+	if err := s.checkTokenAge(token, jwtConfig); err != nil {
+		return nil, err
+	}
+
+	return token, nil
+}
+
+func (s *Server) checkTokenAge(token *gojwt.Token, jwtConfig *JWTConfig) error {
+	if jwtConfig == nil {
+		return nil
+	}
+
+	maxTokenAge := jwtConfig.MaxTokenAge
+	if maxTokenAge <= 0 {
+		maxTokenAge = DefaultJWTMaxTokenAge
+	}
+
+	claims, ok := token.Claims.(gojwt.MapClaims)
+	if !ok {
+		userID := extractUserID(token)
+		return fmt.Errorf("token has invalid claims format (user=%s)", userID)
+	}
+
+	iat, ok := claims["iat"].(float64)
+	if !ok {
+		userID := extractUserID(token)
+		return fmt.Errorf("token missing iat claim (user=%s)", userID)
+	}
+
+	issuedAt := time.Unix(int64(iat), 0)
+	tokenAge := time.Since(issuedAt)
+	maxAge := time.Duration(maxTokenAge) * time.Second
+	if tokenAge > maxAge {
+		userID := getUserIDFromClaims(claims)
+		return fmt.Errorf("token expired for user=%s: age=%v, max=%v", userID, tokenAge, maxAge)
+	}
+
+	return nil
+}
+
+func (s *Server) extractAndValidateUser(token *gojwt.Token) (*auth.UserAuth, error) {
+	s.mu.RLock()
+	jwtExtractor := s.jwtExtractor
+	s.mu.RUnlock()
+
+	if jwtExtractor == nil {
+		userID := extractUserID(token)
+		return nil, fmt.Errorf("JWT extractor not initialized (user=%s)", userID)
+	}
+
+	userAuth, err := jwtExtractor.ToUserAuth(token)
+	if err != nil {
+		userID := extractUserID(token)
+		return nil, fmt.Errorf("extract user from token (user=%s): %w", userID, err)
+	}
+
+	if !s.hasSSHAccess(&userAuth) {
+		return nil, fmt.Errorf("user %s does not have SSH access permissions", userAuth.UserId)
+	}
+
+	return &userAuth, nil
+}
+
+func (s *Server) hasSSHAccess(userAuth *auth.UserAuth) bool {
+	return userAuth.UserId != ""
+}
+
+func extractUserID(token *gojwt.Token) string {
+	if token == nil {
+		return "unknown"
+	}
+	claims, ok := token.Claims.(gojwt.MapClaims)
+	if !ok {
+		return "unknown"
+	}
+	return getUserIDFromClaims(claims)
+}
+
+func getUserIDFromClaims(claims gojwt.MapClaims) string {
+	if sub, ok := claims["sub"].(string); ok && sub != "" {
+		return sub
+	}
+	if userID, ok := claims["user_id"].(string); ok && userID != "" {
+		return userID
+	}
+	if email, ok := claims["email"].(string); ok && email != "" {
+		return email
+	}
+	return "unknown"
+}
+
+func (s *Server) parseTokenWithoutValidation(tokenString string) (map[string]interface{}, error) {
+	parts := strings.Split(tokenString, ".")
+	if len(parts) != 3 {
+		return nil, fmt.Errorf("invalid token format")
+	}
+
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("decode payload: %w", err)
+	}
+
+	var claims map[string]interface{}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return nil, fmt.Errorf("parse claims: %w", err)
+	}
+
+	return claims, nil
+}
+
+func (s *Server) passwordHandler(ctx ssh.Context, password string) bool {
+	osUsername := ctx.User()
+	remoteAddr := ctx.RemoteAddr()
+	logger := s.getRequestLogger(ctx)
+
+	if err := s.ensureJWTValidator(); err != nil {
+		logger.Errorf("JWT validator initialization failed: %v", err)
+		return false
+	}
+
+	token, err := s.validateJWTToken(password)
+	if err != nil {
+		logger.Warnf("JWT authentication failed: %v", err)
+		return false
+	}
+
+	userAuth, err := s.extractAndValidateUser(token)
+	if err != nil {
+		logger.Warnf("user validation failed: %v", err)
+		return false
+	}
+
+	logger = logger.WithField("jwt_user", userAuth.UserId)
+
+	s.mu.RLock()
+	authorizer := s.authorizer
+	s.mu.RUnlock()
+
+	msg, err := authorizer.Authorize(userAuth.UserId, osUsername)
+	if err != nil {
+		logger.Warnf("SSH auth denied: %v", err)
+		return false
+	}
+
+	logger.Infof("SSH auth %s", msg)
+
+	key := newAuthKey(osUsername, remoteAddr)
+	remoteAddrStr := ctx.RemoteAddr().String()
+	s.mu.Lock()
+	s.pendingAuthJWT[key] = userAuth.UserId
+	s.connections[connKey(remoteAddrStr)] = &connState{
+		username:    ctx.User(),
+		remoteAddr:  ctx.RemoteAddr(),
+		jwtUsername: userAuth.UserId,
+	}
+	s.mu.Unlock()
+
+	return true
+}
+
+func (s *Server) addConnectionPortForward(username string, remoteAddr net.Addr, forwardAddr string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	key := connKey(remoteAddr.String())
+	if state, exists := s.connections[key]; exists {
+		if !slices.Contains(state.portForwards, forwardAddr) {
+			state.portForwards = append(state.portForwards, forwardAddr)
+		}
+		return
+	}
+
+	// Connection not in connections (non-JWT auth path)
+	s.connections[key] = &connState{
+		username:     username,
+		remoteAddr:   remoteAddr,
+		portForwards: []string{forwardAddr},
+		jwtUsername:  s.pendingAuthJWT[newAuthKey(username, remoteAddr)],
+	}
+}
+
+func (s *Server) removeConnectionPortForward(remoteAddr net.Addr, forwardAddr string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	state, exists := s.connections[connKey(remoteAddr.String())]
+	if !exists {
+		return
+	}
+
+	state.portForwards = slices.DeleteFunc(state.portForwards, func(addr string) bool {
+		return addr == forwardAddr
+	})
+}
+
+// trackedConn wraps a net.Conn to detect when it closes
+type trackedConn struct {
+	net.Conn
+	server     *Server
+	remoteAddr string
+	onceClose  sync.Once
+}
+
+func (c *trackedConn) Close() error {
+	err := c.Conn.Close()
+	c.onceClose.Do(func() {
+		c.server.handleConnectionClose(c.remoteAddr)
+	})
+	return err
+}
+
+func (s *Server) handleConnectionClose(remoteAddr string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	key := connKey(remoteAddr)
+	state, exists := s.connections[key]
+	if exists && len(state.portForwards) > 0 {
+		s.connLogger(state).Info("port forwarding connection closed")
+	}
+	delete(s.connections, key)
+}
+
+func (s *Server) connLogger(state *connState) *log.Entry {
+	logger := log.WithField("session", fmt.Sprintf("%s@%s", state.username, state.remoteAddr))
+	if state.jwtUsername != "" {
+		logger = logger.WithField("jwt_user", state.jwtUsername)
+	}
+	return logger
+}
+
+func (s *Server) findSessionKeyByContext(ctx ssh.Context) sessionKey {
+	if ctx == nil {
+		return "unknown"
+	}
+
+	sshConn := ctx.Value(ssh.ContextKeyConn)
+	if sshConn == nil {
+		return "unknown"
+	}
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	for sessionKey, state := range s.sessions {
+		if state.session.Context().Value(ssh.ContextKeyConn) == sshConn {
+			return sessionKey
+		}
+	}
+
+	if ctx.User() != "" && ctx.RemoteAddr() != nil {
+		return sessionKey(fmt.Sprintf("%s@%s", ctx.User(), ctx.RemoteAddr().String()))
+	}
+
+	return "unknown"
+}
+
+func (s *Server) connectionValidator(_ ssh.Context, conn net.Conn) net.Conn {
+	s.mu.RLock()
+	wgAddr := s.wgAddress
+	s.mu.RUnlock()
+
+	if !wgAddr.Network.IsValid() || !wgAddr.IP.IsValid() {
+		return conn
+	}
+
+	remoteAddr := conn.RemoteAddr()
+	tcpAddr, ok := remoteAddr.(*net.TCPAddr)
+	if !ok {
+		log.Warnf("SSH connection rejected: non-TCP address %s", remoteAddr)
+		return nil
+	}
+
+	remoteIP, ok := netip.AddrFromSlice(tcpAddr.IP)
+	if !ok {
+		log.Warnf("SSH connection rejected: invalid remote IP %s", tcpAddr.IP)
+		return nil
+	}
+	remoteIP = remoteIP.Unmap()
+
+	// Block connections from our own IP (prevent local apps from connecting to ourselves)
+	if remoteIP == wgAddr.IP || wgAddr.IPv6.IsValid() && remoteIP == wgAddr.IPv6 {
+		log.Warnf("SSH connection rejected from own IP %s", remoteIP)
+		return nil
+	}
+
+	inV4 := wgAddr.Network.Contains(remoteIP)
+	inV6 := wgAddr.IPv6Net.IsValid() && wgAddr.IPv6Net.Contains(remoteIP)
+	if !inV4 && !inV6 {
+		log.Warnf("SSH connection rejected from non-NetBird IP %s", remoteIP)
+		return nil
+	}
+
+	log.Infof("SSH connection from NetBird peer %s allowed", tcpAddr)
+	return &trackedConn{
+		Conn:       conn,
+		server:     s,
+		remoteAddr: conn.RemoteAddr().String(),
+	}
+}
+
+func (s *Server) createSSHServer(addr net.Addr) (*ssh.Server, error) {
+	if err := enableUserSwitching(); err != nil {
+		log.Warnf("failed to enable user switching: %v", err)
+	}
+
+	serverVersion := fmt.Sprintf("%s-%s", detection.ServerIdentifier, version.NetbirdVersion())
+	if s.jwtEnabled {
+		serverVersion += " " + detection.JWTRequiredMarker
+	}
+
+	server := &ssh.Server{
+		Addr:    addr.String(),
+		Handler: s.sessionHandler,
+		SubsystemHandlers: map[string]ssh.SubsystemHandler{
+			"sftp": s.sftpSubsystemHandler,
+		},
+		HostSigners: []ssh.Signer{},
+		ChannelHandlers: map[string]ssh.ChannelHandler{
+			"session":      ssh.DefaultSessionHandler,
+			"direct-tcpip": s.directTCPIPHandler,
+		},
+		RequestHandlers: map[string]ssh.RequestHandler{
+			"tcpip-forward":        s.tcpipForwardHandler,
+			"cancel-tcpip-forward": s.cancelTcpipForwardHandler,
+		},
+		ConnCallback: s.connectionValidator,
+		Version:      serverVersion,
+	}
+
+	if s.jwtEnabled {
+		server.PasswordHandler = s.passwordHandler
+	}
+
+	hostKeyPEM := ssh.HostKeyPEM(s.hostKeyPEM)
+	if err := server.SetOption(hostKeyPEM); err != nil {
+		return nil, fmt.Errorf("set host key: %w", err)
+	}
+
+	s.configurePortForwarding(server)
+	return server, nil
+}
+
+func (s *Server) storeRemoteForwardListener(key forwardKey, ln net.Listener) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.remoteForwardListeners[key] = ln
+}
+
+func (s *Server) removeRemoteForwardListener(key forwardKey) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	ln, exists := s.remoteForwardListeners[key]
+	if !exists {
+		return false
+	}
+
+	delete(s.remoteForwardListeners, key)
+	if err := ln.Close(); err != nil {
+		log.Debugf("remote forward listener close error: %v", err)
+	}
+
+	return true
+}
+
+func (s *Server) directTCPIPHandler(srv *ssh.Server, conn *cryptossh.ServerConn, newChan cryptossh.NewChannel, ctx ssh.Context) {
+	logger := s.getRequestLogger(ctx)
+
+	var payload struct {
+		Host           string
+		Port           uint32
+		OriginatorAddr string
+		OriginatorPort uint32
+	}
+
+	if err := cryptossh.Unmarshal(newChan.ExtraData(), &payload); err != nil {
+		if err := newChan.Reject(cryptossh.ConnectionFailed, "parse payload"); err != nil {
+			logger.Debugf("channel reject error: %v", err)
+		}
+		return
+	}
+
+	s.mu.RLock()
+	allowLocal := s.allowLocalPortForwarding
+	s.mu.RUnlock()
+
+	if !allowLocal {
+		logger.Warnf("local port forwarding denied for %s: disabled", net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port))))
+		_ = newChan.Reject(cryptossh.Prohibited, "local port forwarding disabled")
+		return
+	}
+
+	if err := s.checkPortForwardingPrivileges(ctx, "local", payload.Port); err != nil {
+		logger.Warnf("local port forwarding denied for %s: %v", net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port))), err)
+		_ = newChan.Reject(cryptossh.Prohibited, "insufficient privileges")
+		return
+	}
+
+	hostPort := net.JoinHostPort(payload.Host, strconv.Itoa(int(payload.Port)))
+	forwardAddr := "-L " + hostPort
+	s.addConnectionPortForward(ctx.User(), ctx.RemoteAddr(), forwardAddr)
+	logger.Infof("local port forwarding: %s", hostPort)
+
+	s.relayDirectTCPIP(ctx, newChan, payload.Host, int(payload.Port), logger)
+}
+
+// relayDirectTCPIP is a netrelay-based replacement for gliderlabs'
+// DirectTCPIPHandler. The upstream handler closes both sides on the first
+// EOF; netrelay.Relay propagates CloseWrite so each direction drains on its
+// own terms.
+func (s *Server) relayDirectTCPIP(ctx ssh.Context, newChan cryptossh.NewChannel, host string, port int, logger *log.Entry) {
+	dest := net.JoinHostPort(host, strconv.Itoa(port))
+
+	dialer := net.Dialer{Timeout: directTCPIPDialTimeout}
+	dconn, err := dialer.DialContext(ctx, "tcp", dest)
+	if err != nil {
+		_ = newChan.Reject(cryptossh.ConnectionFailed, err.Error())
+		return
+	}
+
+	ch, reqs, err := newChan.Accept()
+	if err != nil {
+		_ = dconn.Close()
+		return
+	}
+	go cryptossh.DiscardRequests(reqs)
+
+	netrelay.Relay(ctx, dconn, ch, netrelay.Options{Logger: logger})
+}

client/ssh/server/server_config_test.go

@@ -0,0 +1,554 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os/user"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/ssh"
+	sshclient "github.com/netbirdio/netbird/client/ssh/client"
+)
+
+func TestServer_RootLoginRestriction(t *testing.T) {
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		allowRoot   bool
+		username    string
+		expectError bool
+		description string
+	}{
+		{
+			name:        "root login allowed",
+			allowRoot:   true,
+			username:    "root",
+			expectError: false,
+			description: "Root login should succeed when allowed",
+		},
+		{
+			name:        "root login denied",
+			allowRoot:   false,
+			username:    "root",
+			expectError: true,
+			description: "Root login should fail when disabled",
+		},
+		{
+			name:        "regular user login always allowed",
+			allowRoot:   false,
+			username:    "testuser",
+			expectError: false,
+			description: "Regular user login should work regardless of root setting",
+		},
+	}
+
+	// Add Windows Administrator tests if on Windows
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			name        string
+			allowRoot   bool
+			username    string
+			expectError bool
+			description string
+		}{
+			{
+				name:        "Administrator login allowed",
+				allowRoot:   true,
+				username:    "Administrator",
+				expectError: false,
+				description: "Administrator login should succeed when allowed",
+			},
+			{
+				name:        "Administrator login denied",
+				allowRoot:   false,
+				username:    "Administrator",
+				expectError: true,
+				description: "Administrator login should fail when disabled",
+			},
+			{
+				name:        "administrator login denied (lowercase)",
+				allowRoot:   false,
+				username:    "administrator",
+				expectError: true,
+				description: "administrator login should fail when disabled (case insensitive)",
+			},
+		}...)
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Mock privileged environment to test root access controls
+			// Set up mock users based on platform
+			mockUsers := map[string]*user.User{
+				"root":     createTestUser("root", "0", "0", "/root"),
+				"testuser": createTestUser("testuser", "1000", "1000", "/home/testuser"),
+			}
+
+			// Add Windows-specific users for Administrator tests
+			if runtime.GOOS == "windows" {
+				mockUsers["Administrator"] = createTestUser("Administrator", "500", "544", "C:\\Users\\Administrator")
+				mockUsers["administrator"] = createTestUser("administrator", "500", "544", "C:\\Users\\administrator")
+			}
+
+			cleanup := setupTestDependencies(
+				createTestUser("root", "0", "0", "/root"), // Running as root
+				nil,
+				runtime.GOOS,
+				0, // euid 0 (root)
+				mockUsers,
+				nil,
+			)
+			defer cleanup()
+
+			// Create server with specific configuration
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        nil,
+			}
+			server := New(serverConfig)
+			server.SetAllowRootLogin(tt.allowRoot)
+
+			// Test the userNameLookup method directly
+			user, err := server.userNameLookup(tt.username)
+
+			if tt.expectError {
+				assert.Error(t, err, tt.description)
+				if tt.username == "root" || strings.ToLower(tt.username) == "administrator" {
+					// Check for appropriate error message based on platform capabilities
+					errorMsg := err.Error()
+					// Either privileged user restriction OR user switching limitation
+					hasPrivilegedError := strings.Contains(errorMsg, "privileged user")
+					hasSwitchingError := strings.Contains(errorMsg, "cannot switch") || strings.Contains(errorMsg, "user switching not supported")
+					assert.True(t, hasPrivilegedError || hasSwitchingError,
+						"Expected privileged user or user switching error, got: %s", errorMsg)
+				}
+			} else {
+				if tt.username == "root" || strings.ToLower(tt.username) == "administrator" {
+					// For privileged users, we expect either success or a different error
+					// (like user not found), but not the "login disabled" error
+					if err != nil {
+						assert.NotContains(t, err.Error(), "privileged user login is disabled")
+					}
+				} else {
+					// For regular users, lookup should generally succeed or fall back gracefully
+					// Note: may return current user as fallback
+					assert.NotNil(t, user)
+				}
+			}
+		})
+	}
+}
+
+func TestServer_PortForwardingRestriction(t *testing.T) {
+	// Test that the port forwarding callbacks properly respect configuration flags
+	// This is a unit test of the callback logic, not a full integration test
+
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name                  string
+		allowLocalForwarding  bool
+		allowRemoteForwarding bool
+		description           string
+	}{
+		{
+			name:                  "all forwarding allowed",
+			allowLocalForwarding:  true,
+			allowRemoteForwarding: true,
+			description:           "Both local and remote forwarding should be allowed",
+		},
+		{
+			name:                  "local forwarding disabled",
+			allowLocalForwarding:  false,
+			allowRemoteForwarding: true,
+			description:           "Local forwarding should be denied when disabled",
+		},
+		{
+			name:                  "remote forwarding disabled",
+			allowLocalForwarding:  true,
+			allowRemoteForwarding: false,
+			description:           "Remote forwarding should be denied when disabled",
+		},
+		{
+			name:                  "all forwarding disabled",
+			allowLocalForwarding:  false,
+			allowRemoteForwarding: false,
+			description:           "Both forwarding types should be denied when disabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create server with specific configuration
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        nil,
+			}
+			server := New(serverConfig)
+			server.SetAllowLocalPortForwarding(tt.allowLocalForwarding)
+			server.SetAllowRemotePortForwarding(tt.allowRemoteForwarding)
+
+			// We need to access the internal configuration to simulate the callback tests
+			// Since the callbacks are created inside the Start method, we'll test the logic directly
+
+			// Test the configuration values are set correctly
+			server.mu.RLock()
+			allowLocal := server.allowLocalPortForwarding
+			allowRemote := server.allowRemotePortForwarding
+			server.mu.RUnlock()
+
+			assert.Equal(t, tt.allowLocalForwarding, allowLocal, "Local forwarding configuration should be set correctly")
+			assert.Equal(t, tt.allowRemoteForwarding, allowRemote, "Remote forwarding configuration should be set correctly")
+
+			// Simulate the callback logic
+			localResult := allowLocal   // This would be the callback return value
+			remoteResult := allowRemote // This would be the callback return value
+
+			assert.Equal(t, tt.allowLocalForwarding, localResult,
+				"Local port forwarding callback should return correct value")
+			assert.Equal(t, tt.allowRemoteForwarding, remoteResult,
+				"Remote port forwarding callback should return correct value")
+		})
+	}
+}
+
+func TestServer_PrivilegedPortAccess(t *testing.T) {
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+	}
+	server := New(serverConfig)
+	server.SetAllowRemotePortForwarding(true)
+
+	tests := []struct {
+		name          string
+		forwardType   string
+		port          uint32
+		username      string
+		expectError   bool
+		errorMsg      string
+		skipOnWindows bool
+	}{
+		{
+			name:          "non-root user remote forward privileged port",
+			forwardType:   "remote",
+			port:          80,
+			username:      "testuser",
+			expectError:   true,
+			errorMsg:      "cannot bind to privileged port",
+			skipOnWindows: true,
+		},
+		{
+			name:          "non-root user tcpip-forward privileged port",
+			forwardType:   "tcpip-forward",
+			port:          443,
+			username:      "testuser",
+			expectError:   true,
+			errorMsg:      "cannot bind to privileged port",
+			skipOnWindows: true,
+		},
+		{
+			name:        "non-root user remote forward unprivileged port",
+			forwardType: "remote",
+			port:        8080,
+			username:    "testuser",
+			expectError: false,
+		},
+		{
+			name:        "non-root user remote forward port 0",
+			forwardType: "remote",
+			port:        0,
+			username:    "testuser",
+			expectError: false,
+		},
+		{
+			name:        "root user remote forward privileged port",
+			forwardType: "remote",
+			port:        22,
+			username:    "root",
+			expectError: false,
+		},
+		{
+			name:        "local forward privileged port allowed for non-root",
+			forwardType: "local",
+			port:        80,
+			username:    "testuser",
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.skipOnWindows && runtime.GOOS == "windows" {
+				t.Skip("Windows does not have privileged port restrictions")
+			}
+
+			result := PrivilegeCheckResult{
+				Allowed: true,
+				User:    &user.User{Username: tt.username},
+			}
+
+			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
+
+			if tt.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errorMsg)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestServer_PortConflictHandling(t *testing.T) {
+	// Test that multiple sessions requesting the same local port are handled naturally by the OS
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowRootLogin(true)
+
+	serverAddr := StartTestServer(t, server)
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Get a free port for testing
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	testPort := ln.Addr().(*net.TCPAddr).Port
+	err = ln.Close()
+	require.NoError(t, err)
+
+	// Connect first client
+	ctx1, cancel1 := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel1()
+
+	client1, err := sshclient.Dial(ctx1, serverAddr, currentUser.Username, sshclient.DialOptions{
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+	defer func() {
+		err := client1.Close()
+		assert.NoError(t, err)
+	}()
+
+	// Connect second client
+	ctx2, cancel2 := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel2()
+
+	client2, err := sshclient.Dial(ctx2, serverAddr, currentUser.Username, sshclient.DialOptions{
+		InsecureSkipVerify: true,
+	})
+	require.NoError(t, err)
+	defer func() {
+		err := client2.Close()
+		assert.NoError(t, err)
+	}()
+
+	// First client binds to the test port
+	localAddr1 := fmt.Sprintf("127.0.0.1:%d", testPort)
+	remoteAddr := "127.0.0.1:80"
+
+	// Start first client's port forwarding
+	done1 := make(chan error, 1)
+	go func() {
+		// This should succeed and hold the port
+		err := client1.LocalPortForward(ctx1, localAddr1, remoteAddr)
+		done1 <- err
+	}()
+
+	// Give first client time to bind
+	time.Sleep(200 * time.Millisecond)
+
+	// Second client tries to bind to same port
+	localAddr2 := fmt.Sprintf("127.0.0.1:%d", testPort)
+
+	shortCtx, shortCancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer shortCancel()
+
+	err = client2.LocalPortForward(shortCtx, localAddr2, remoteAddr)
+	// Second client should fail due to "address already in use"
+	assert.Error(t, err, "Second client should fail to bind to same port")
+	if err != nil {
+		// The error should indicate the address is already in use
+		errMsg := strings.ToLower(err.Error())
+		if runtime.GOOS == "windows" {
+			assert.Contains(t, errMsg, "only one usage of each socket address",
+				"Error should indicate port conflict")
+		} else {
+			assert.Contains(t, errMsg, "address already in use",
+				"Error should indicate port conflict")
+		}
+	}
+
+	// Cancel first client's context and wait for it to finish
+	cancel1()
+	select {
+	case err1 := <-done1:
+		// Should get context cancelled or deadline exceeded
+		assert.Error(t, err1, "First client should exit when context cancelled")
+	case <-time.After(2 * time.Second):
+		t.Error("First client did not exit within timeout")
+	}
+}
+
+func TestServer_IsPrivilegedUser(t *testing.T) {
+
+	tests := []struct {
+		username    string
+		expected    bool
+		description string
+	}{
+		{
+			username:    "root",
+			expected:    true,
+			description: "root should be considered privileged",
+		},
+		{
+			username:    "regular",
+			expected:    false,
+			description: "regular user should not be privileged",
+		},
+		{
+			username:    "",
+			expected:    false,
+			description: "empty username should not be privileged",
+		},
+	}
+
+	// Add Windows-specific tests
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    true,
+				description: "Administrator should be considered privileged on Windows",
+			},
+			{
+				username:    "administrator",
+				expected:    true,
+				description: "administrator should be considered privileged on Windows (case insensitive)",
+			},
+		}...)
+	} else {
+		// On non-Windows systems, Administrator should not be privileged
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    false,
+				description: "Administrator should not be privileged on non-Windows systems",
+			},
+		}...)
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			result := isPrivilegedUsername(tt.username)
+			assert.Equal(t, tt.expected, result, tt.description)
+		})
+	}
+}
+
+func TestServer_NonPtyShellSession(t *testing.T) {
+	// Test that non-PTY shell sessions (ssh -T) work regardless of port forwarding settings.
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name                  string
+		allowLocalForwarding  bool
+		allowRemoteForwarding bool
+	}{
+		{
+			name:                  "shell_with_local_forwarding_enabled",
+			allowLocalForwarding:  true,
+			allowRemoteForwarding: false,
+		},
+		{
+			name:                  "shell_with_remote_forwarding_enabled",
+			allowLocalForwarding:  false,
+			allowRemoteForwarding: true,
+		},
+		{
+			name:                  "shell_with_both_forwarding_enabled",
+			allowLocalForwarding:  true,
+			allowRemoteForwarding: true,
+		},
+		{
+			name:                  "shell_with_forwarding_disabled",
+			allowLocalForwarding:  false,
+			allowRemoteForwarding: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			serverConfig := &Config{
+				HostKeyPEM: hostKey,
+				JWT:        nil,
+			}
+			server := New(serverConfig)
+			server.SetAllowRootLogin(true)
+			server.SetAllowLocalPortForwarding(tt.allowLocalForwarding)
+			server.SetAllowRemotePortForwarding(tt.allowRemoteForwarding)
+
+			serverAddr := StartTestServer(t, server)
+			defer func() {
+				_ = server.Stop()
+			}()
+
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+
+			client, err := sshclient.Dial(ctx, serverAddr, currentUser.Username, sshclient.DialOptions{
+				InsecureSkipVerify: true,
+			})
+			require.NoError(t, err)
+			defer func() {
+				_ = client.Close()
+			}()
+
+			// Execute without PTY and no command - simulates ssh -T (shell without PTY)
+			// Should always succeed regardless of port forwarding settings
+			_, err = client.ExecuteCommand(ctx, "")
+			assert.NoError(t, err, "Non-PTY shell session should be allowed")
+		})
+	}
+}

client/ssh/server/server_test.go

@@ -0,0 +1,443 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/netip"
+	"os/user"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+)
+
+func TestServer_StartStop(t *testing.T) {
+	key, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: key,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+
+	err = server.Stop()
+	assert.NoError(t, err)
+}
+
+func TestSSHServerIntegration(t *testing.T) {
+	// Generate host key for server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Generate client key pair
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server with random port
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+
+	// Start server in background
+	serverAddr := "127.0.0.1:0"
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		// Get a free port
+		ln, err := net.Listen("tcp", serverAddr)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		actualAddr := ln.Addr().String()
+		if err := ln.Close(); err != nil {
+			errChan <- fmt.Errorf("close temp listener: %w", err)
+			return
+		}
+
+		addrPort, _ := netip.ParseAddrPort(actualAddr)
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+		started <- actualAddr
+	}()
+
+	select {
+	case actualAddr := <-started:
+		serverAddr = actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Parse client private key
+	signer, err := cryptossh.ParsePrivateKey(clientPrivKey)
+	require.NoError(t, err)
+
+	// Parse server host key for verification
+	hostPrivParsed, err := cryptossh.ParsePrivateKey(hostKey)
+	require.NoError(t, err)
+	hostPubKey := hostPrivParsed.PublicKey()
+
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user for test")
+
+	// Create SSH client config
+	config := &cryptossh.ClientConfig{
+		User: currentUser.Username,
+		Auth: []cryptossh.AuthMethod{
+			cryptossh.PublicKeys(signer),
+		},
+		HostKeyCallback: cryptossh.FixedHostKey(hostPubKey),
+		Timeout:         3 * time.Second,
+	}
+
+	// Connect to SSH server
+	client, err := cryptossh.Dial("tcp", serverAddr, config)
+	require.NoError(t, err)
+	defer func() {
+		if err := client.Close(); err != nil {
+			t.Logf("close client: %v", err)
+		}
+	}()
+
+	// Test creating a session
+	session, err := client.NewSession()
+	require.NoError(t, err)
+	defer func() {
+		if err := session.Close(); err != nil {
+			t.Logf("close session: %v", err)
+		}
+	}()
+
+	// Note: Since we don't have a real shell environment in tests,
+	// we can't test actual command execution, but we can verify
+	// the connection and authentication work
+	t.Log("SSH connection and authentication successful")
+}
+
+func TestSSHServerMultipleConnections(t *testing.T) {
+	// Generate host key for server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Generate client key pair
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+
+	// Start server
+	serverAddr := "127.0.0.1:0"
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		ln, err := net.Listen("tcp", serverAddr)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		actualAddr := ln.Addr().String()
+		if err := ln.Close(); err != nil {
+			errChan <- fmt.Errorf("close temp listener: %w", err)
+			return
+		}
+
+		addrPort, _ := netip.ParseAddrPort(actualAddr)
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+		started <- actualAddr
+	}()
+
+	select {
+	case actualAddr := <-started:
+		serverAddr = actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Parse client private key
+	signer, err := cryptossh.ParsePrivateKey(clientPrivKey)
+	require.NoError(t, err)
+
+	// Parse server host key
+	hostPrivParsed, err := cryptossh.ParsePrivateKey(hostKey)
+	require.NoError(t, err)
+	hostPubKey := hostPrivParsed.PublicKey()
+
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user for test")
+
+	config := &cryptossh.ClientConfig{
+		User: currentUser.Username,
+		Auth: []cryptossh.AuthMethod{
+			cryptossh.PublicKeys(signer),
+		},
+		HostKeyCallback: cryptossh.FixedHostKey(hostPubKey),
+		Timeout:         3 * time.Second,
+	}
+
+	// Test multiple concurrent connections
+	const numConnections = 5
+	results := make(chan error, numConnections)
+
+	for i := 0; i < numConnections; i++ {
+		go func(id int) {
+			client, err := cryptossh.Dial("tcp", serverAddr, config)
+			if err != nil {
+				results <- fmt.Errorf("connection %d failed: %w", id, err)
+				return
+			}
+			defer func() {
+				_ = client.Close() // Ignore error in test goroutine
+			}()
+
+			session, err := client.NewSession()
+			if err != nil {
+				results <- fmt.Errorf("session %d failed: %w", id, err)
+				return
+			}
+			defer func() {
+				_ = session.Close() // Ignore error in test goroutine
+			}()
+
+			results <- nil
+		}(i)
+	}
+
+	// Wait for all connections to complete
+	for i := 0; i < numConnections; i++ {
+		select {
+		case err := <-results:
+			assert.NoError(t, err)
+		case <-time.After(10 * time.Second):
+			t.Fatalf("Connection %d timed out", i)
+		}
+	}
+}
+
+func TestSSHServerNoAuthMode(t *testing.T) {
+	// Generate host key for server
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+
+	// Start server
+	serverAddr := "127.0.0.1:0"
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		ln, err := net.Listen("tcp", serverAddr)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		actualAddr := ln.Addr().String()
+		if err := ln.Close(); err != nil {
+			errChan <- fmt.Errorf("close temp listener: %w", err)
+			return
+		}
+
+		addrPort, _ := netip.ParseAddrPort(actualAddr)
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+		started <- actualAddr
+	}()
+
+	select {
+	case actualAddr := <-started:
+		serverAddr = actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Generate a client private key for SSH protocol (server doesn't check it)
+	clientPrivKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+	clientSigner, err := cryptossh.ParsePrivateKey(clientPrivKey)
+	require.NoError(t, err)
+
+	// Parse server host key
+	hostPrivParsed, err := cryptossh.ParsePrivateKey(hostKey)
+	require.NoError(t, err)
+	hostPubKey := hostPrivParsed.PublicKey()
+
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user for test")
+
+	// Try to connect with client key
+	config := &cryptossh.ClientConfig{
+		User: currentUser.Username,
+		Auth: []cryptossh.AuthMethod{
+			cryptossh.PublicKeys(clientSigner),
+		},
+		HostKeyCallback: cryptossh.FixedHostKey(hostPubKey),
+		Timeout:         3 * time.Second,
+	}
+
+	// This should succeed in no-auth mode (server doesn't verify keys)
+	conn, err := cryptossh.Dial("tcp", serverAddr, config)
+	assert.NoError(t, err, "Connection should succeed in no-auth mode")
+	if conn != nil {
+		assert.NoError(t, conn.Close())
+	}
+}
+
+func TestSSHServerStartStopCycle(t *testing.T) {
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	serverAddr := "127.0.0.1:0"
+
+	// Test multiple start/stop cycles
+	for i := 0; i < 3; i++ {
+		t.Logf("Start/stop cycle %d", i+1)
+
+		started := make(chan string, 1)
+		errChan := make(chan error, 1)
+
+		go func() {
+			ln, err := net.Listen("tcp", serverAddr)
+			if err != nil {
+				errChan <- err
+				return
+			}
+			actualAddr := ln.Addr().String()
+			if err := ln.Close(); err != nil {
+				errChan <- fmt.Errorf("close temp listener: %w", err)
+				return
+			}
+
+			addrPort, _ := netip.ParseAddrPort(actualAddr)
+			if err := server.Start(context.Background(), addrPort); err != nil {
+				errChan <- err
+				return
+			}
+			started <- actualAddr
+		}()
+
+		select {
+		case <-started:
+		case err := <-errChan:
+			t.Fatalf("Cycle %d: Server failed to start: %v", i+1, err)
+		case <-time.After(5 * time.Second):
+			t.Fatalf("Cycle %d: Server start timeout", i+1)
+		}
+
+		err = server.Stop()
+		require.NoError(t, err, "Cycle %d: Stop should succeed", i+1)
+	}
+}
+
+func TestSSHServer_WindowsShellHandling(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping Windows shell test in short mode")
+	}
+
+	server := &Server{}
+
+	if runtime.GOOS == "windows" {
+		// Test Windows cmd.exe shell behavior
+		args := server.getShellCommandArgs("cmd.exe", "echo test")
+		assert.Equal(t, "cmd.exe", args[0])
+		assert.Equal(t, "-Command", args[1])
+		assert.Equal(t, "echo test", args[2])
+
+		// Test PowerShell behavior
+		args = server.getShellCommandArgs("powershell.exe", "echo test")
+		assert.Equal(t, "powershell.exe", args[0])
+		assert.Equal(t, "-Command", args[1])
+		assert.Equal(t, "echo test", args[2])
+	} else {
+		args := server.getShellCommandArgs("/bin/sh", "echo test")
+		assert.Equal(t, "/bin/sh", args[0])
+		assert.Equal(t, "-c", args[1])
+		assert.Equal(t, "echo test", args[2])
+
+		args = server.getShellCommandArgs("/bin/sh", "")
+		assert.Equal(t, "/bin/sh", args[0])
+		assert.Len(t, args, 1)
+	}
+}
+
+func TestSSHServer_PortForwardingConfiguration(t *testing.T) {
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+
+	serverConfig1 := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server1 := New(serverConfig1)
+
+	serverConfig2 := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server2 := New(serverConfig2)
+
+	assert.False(t, server1.allowLocalPortForwarding, "Local port forwarding should be disabled by default for security")
+	assert.False(t, server1.allowRemotePortForwarding, "Remote port forwarding should be disabled by default for security")
+
+	server2.SetAllowLocalPortForwarding(true)
+	server2.SetAllowRemotePortForwarding(true)
+
+	assert.True(t, server2.allowLocalPortForwarding, "Local port forwarding should be enabled when explicitly set")
+	assert.True(t, server2.allowRemotePortForwarding, "Remote port forwarding should be enabled when explicitly set")
+}

client/ssh/server/session_handlers.go

@@ -0,0 +1,139 @@
+package server
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// associateJWTUsername extracts pending JWT username for the session and associates it with the session state.
+// Returns the JWT username (empty if none) for logging purposes.
+func (s *Server) associateJWTUsername(sess ssh.Session, sessionKey sessionKey) string {
+	key := newAuthKey(sess.User(), sess.RemoteAddr())
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	jwtUsername := s.pendingAuthJWT[key]
+	if jwtUsername == "" {
+		return ""
+	}
+
+	if state, exists := s.sessions[sessionKey]; exists {
+		state.jwtUsername = jwtUsername
+	}
+	delete(s.pendingAuthJWT, key)
+	return jwtUsername
+}
+
+// sessionHandler handles SSH sessions
+func (s *Server) sessionHandler(session ssh.Session) {
+	sessionKey := s.registerSession(session, "")
+	jwtUsername := s.associateJWTUsername(session, sessionKey)
+
+	logger := log.WithField("session", sessionKey)
+	if jwtUsername != "" {
+		logger = logger.WithField("jwt_user", jwtUsername)
+	}
+	logger.Info("SSH session started")
+	sessionStart := time.Now()
+
+	defer s.unregisterSession(sessionKey)
+	defer func() {
+		duration := time.Since(sessionStart).Round(time.Millisecond)
+		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
+			logger.Warnf("close session after %v: %v", duration, err)
+		}
+		logger.Infof("SSH session closed after %v", duration)
+	}()
+
+	privilegeResult, err := s.userPrivilegeCheck(session.User())
+	if err != nil {
+		s.handlePrivError(logger, session, err)
+		return
+	}
+
+	ptyReq, winCh, isPty := session.Pty()
+	hasCommand := session.RawCommand() != ""
+
+	if isPty && !hasCommand {
+		// ssh <host> - PTY interactive session (login)
+		s.handlePtyLogin(logger, session, privilegeResult, ptyReq, winCh)
+	} else {
+		// ssh <host> <cmd>, ssh -t <host> <cmd>, ssh -T <host> - command or shell execution
+		s.handleExecution(logger, session, privilegeResult, ptyReq, winCh)
+	}
+}
+
+func (s *Server) registerSession(session ssh.Session, sessionType string) sessionKey {
+	sessionID := session.Context().Value(ssh.ContextKeySessionID)
+	if sessionID == nil {
+		sessionID = fmt.Sprintf("%p", session)
+	}
+
+	hasher := sha256.New()
+	hasher.Write([]byte(fmt.Sprintf("%v", sessionID)))
+	hash := hasher.Sum(nil)
+	shortID := hex.EncodeToString(hash[:4])
+
+	remoteAddr := session.RemoteAddr().String()
+	username := session.User()
+	sessionKey := sessionKey(fmt.Sprintf("%s@%s-%s", username, remoteAddr, shortID))
+
+	s.mu.Lock()
+	s.sessions[sessionKey] = &sessionState{
+		session:     session,
+		sessionType: sessionType,
+	}
+	s.mu.Unlock()
+
+	return sessionKey
+}
+
+func (s *Server) unregisterSession(sessionKey sessionKey) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.sessions, sessionKey)
+}
+
+func (s *Server) handlePrivError(logger *log.Entry, session ssh.Session, err error) {
+	logger.Warnf("user privilege check failed: %v", err)
+
+	errorMsg := s.buildUserLookupErrorMessage(err)
+
+	if _, writeErr := fmt.Fprint(session, errorMsg); writeErr != nil {
+		logger.Debugf(errWriteSession, writeErr)
+	}
+	if exitErr := session.Exit(1); exitErr != nil {
+		logSessionExitError(logger, exitErr)
+	}
+}
+
+// buildUserLookupErrorMessage creates appropriate user-facing error messages based on error type
+func (s *Server) buildUserLookupErrorMessage(err error) string {
+	var privilegedErr *PrivilegedUserError
+
+	switch {
+	case errors.As(err, &privilegedErr):
+		if privilegedErr.Username == "root" {
+			return "root login is disabled on this SSH server\n"
+		}
+		return "privileged user access is disabled on this SSH server\n"
+
+	case errors.Is(err, ErrPrivilegeRequired):
+		return "Windows user switching failed - NetBird must run with elevated privileges for user switching\n"
+
+	case errors.Is(err, ErrPrivilegedUserSwitch):
+		return "Cannot switch to privileged user - current user lacks required privileges\n"
+
+	default:
+		return "User authentication failed\n"
+	}
+}

client/ssh/server/session_handlers_js.go

@@ -0,0 +1,22 @@
+//go:build js
+
+package server
+
+import (
+	"fmt"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// handlePtyLogin is not supported on JS/WASM
+func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, _ PrivilegeCheckResult, _ ssh.Pty, _ <-chan ssh.Window) bool {
+	errorMsg := "PTY sessions are not supported on WASM/JS platform\n"
+	if _, err := fmt.Fprint(session.Stderr(), errorMsg); err != nil {
+		logger.Debugf(errWriteSession, err)
+	}
+	if err := session.Exit(1); err != nil {
+		logSessionExitError(logger, err)
+	}
+	return false
+}

client/ssh/server/sftp.go

@@ -0,0 +1,89 @@
+package server
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/gliderlabs/ssh"
+	"github.com/pkg/sftp"
+	log "github.com/sirupsen/logrus"
+)
+
+// SetAllowSFTP enables or disables SFTP support
+func (s *Server) SetAllowSFTP(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowSFTP = allow
+}
+
+// sftpSubsystemHandler handles SFTP subsystem requests
+func (s *Server) sftpSubsystemHandler(sess ssh.Session) {
+	sessionKey := s.registerSession(sess, cmdSFTP)
+	defer s.unregisterSession(sessionKey)
+
+	jwtUsername := s.associateJWTUsername(sess, sessionKey)
+
+	logger := log.WithField("session", sessionKey)
+	if jwtUsername != "" {
+		logger = logger.WithField("jwt_user", jwtUsername)
+	}
+	logger.Info("SFTP session started")
+	defer logger.Info("SFTP session closed")
+
+	s.mu.RLock()
+	allowSFTP := s.allowSFTP
+	s.mu.RUnlock()
+
+	if !allowSFTP {
+		logger.Debug("SFTP subsystem request denied: SFTP disabled")
+		if err := sess.Exit(1); err != nil {
+			logger.Debugf("SFTP session exit: %v", err)
+		}
+		return
+	}
+
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         sess.User(),
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSFTP,
+	})
+
+	if !result.Allowed {
+		logger.Warnf("SFTP access denied: %v", result.Error)
+		if err := sess.Exit(1); err != nil {
+			logger.Debugf("exit SFTP session: %v", err)
+		}
+		return
+	}
+
+	if !result.RequiresUserSwitching {
+		if err := s.executeSftpDirect(sess); err != nil {
+			logger.Errorf("SFTP direct execution: %v", err)
+		}
+		return
+	}
+
+	if err := s.executeSftpWithPrivilegeDrop(sess, result.User); err != nil {
+		logger.Errorf("SFTP privilege drop execution: %v", err)
+	}
+}
+
+// executeSftpDirect executes SFTP directly without privilege dropping
+func (s *Server) executeSftpDirect(sess ssh.Session) error {
+	sftpServer, err := sftp.NewServer(sess)
+	if err != nil {
+		return fmt.Errorf("SFTP server creation: %w", err)
+	}
+
+	defer func() {
+		if err := sftpServer.Close(); err != nil {
+			log.Debugf("failed to close sftp server: %v", err)
+		}
+	}()
+
+	if err := sftpServer.Serve(); err != nil && err != io.EOF {
+		return fmt.Errorf("serve: %w", err)
+	}
+
+	return nil
+}

client/ssh/server/sftp_js.go

@@ -0,0 +1,12 @@
+//go:build js
+
+package server
+
+import (
+	"os/user"
+)
+
+// parseUserCredentials is not supported on JS/WASM
+func (s *Server) parseUserCredentials(_ *user.User) (uint32, uint32, []uint32, error) {
+	return 0, 0, nil, errNotSupported
+}

client/ssh/server/sftp_test.go

@@ -0,0 +1,228 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+	"os/user"
+	"testing"
+	"time"
+
+	"github.com/pkg/sftp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/client/ssh"
+)
+
+func TestSSHServer_SFTPSubsystem(t *testing.T) {
+	// Skip SFTP test when running as root due to protocol issues in some environments
+	if os.Geteuid() == 0 {
+		t.Skip("Skipping SFTP test when running as root - may have protocol compatibility issues")
+	}
+
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Generate client key pair
+	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server with SFTP enabled
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowSFTP(true)
+	server.SetAllowRootLogin(true)
+
+	// Start server
+	serverAddr := "127.0.0.1:0"
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		ln, err := net.Listen("tcp", serverAddr)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		actualAddr := ln.Addr().String()
+		if err := ln.Close(); err != nil {
+			errChan <- fmt.Errorf("close temp listener: %w", err)
+			return
+		}
+
+		addrPort, _ := netip.ParseAddrPort(actualAddr)
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+		started <- actualAddr
+	}()
+
+	select {
+	case actualAddr := <-started:
+		serverAddr = actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Parse client private key
+	signer, err := cryptossh.ParsePrivateKey(clientPrivKey)
+	require.NoError(t, err)
+
+	// Parse server host key
+	hostPrivParsed, err := cryptossh.ParsePrivateKey(hostKey)
+	require.NoError(t, err)
+	hostPubKey := hostPrivParsed.PublicKey()
+
+	// (currentUser already obtained at function start)
+
+	// Create SSH client connection
+	clientConfig := &cryptossh.ClientConfig{
+		User: currentUser.Username,
+		Auth: []cryptossh.AuthMethod{
+			cryptossh.PublicKeys(signer),
+		},
+		HostKeyCallback: cryptossh.FixedHostKey(hostPubKey),
+		Timeout:         5 * time.Second,
+	}
+
+	conn, err := cryptossh.Dial("tcp", serverAddr, clientConfig)
+	require.NoError(t, err, "SSH connection should succeed")
+	defer func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("connection close error: %v", err)
+		}
+	}()
+
+	// Create SFTP client
+	sftpClient, err := sftp.NewClient(conn)
+	require.NoError(t, err, "SFTP client creation should succeed")
+	defer func() {
+		if err := sftpClient.Close(); err != nil {
+			t.Logf("SFTP client close error: %v", err)
+		}
+	}()
+
+	// Test basic SFTP operations
+	workingDir, err := sftpClient.Getwd()
+	assert.NoError(t, err, "Should be able to get working directory")
+	assert.NotEmpty(t, workingDir, "Working directory should not be empty")
+
+	// Test directory listing
+	files, err := sftpClient.ReadDir(".")
+	assert.NoError(t, err, "Should be able to list current directory")
+	assert.NotNil(t, files, "File list should not be nil")
+}
+
+func TestSSHServer_SFTPDisabled(t *testing.T) {
+	// Get current user for SSH connection
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+
+	// Generate host key for server
+	hostKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Generate client key pair
+	clientPrivKey, err := ssh.GeneratePrivateKey(ssh.ED25519)
+	require.NoError(t, err)
+
+	// Create server with SFTP disabled
+	serverConfig := &Config{
+		HostKeyPEM: hostKey,
+		JWT:        nil,
+	}
+	server := New(serverConfig)
+	server.SetAllowSFTP(false)
+
+	// Start server
+	serverAddr := "127.0.0.1:0"
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		ln, err := net.Listen("tcp", serverAddr)
+		if err != nil {
+			errChan <- err
+			return
+		}
+		actualAddr := ln.Addr().String()
+		if err := ln.Close(); err != nil {
+			errChan <- fmt.Errorf("close temp listener: %w", err)
+			return
+		}
+
+		addrPort, _ := netip.ParseAddrPort(actualAddr)
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+		started <- actualAddr
+	}()
+
+	select {
+	case actualAddr := <-started:
+		serverAddr = actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+
+	defer func() {
+		err := server.Stop()
+		require.NoError(t, err)
+	}()
+
+	// Parse client private key
+	signer, err := cryptossh.ParsePrivateKey(clientPrivKey)
+	require.NoError(t, err)
+
+	// Parse server host key
+	hostPrivParsed, err := cryptossh.ParsePrivateKey(hostKey)
+	require.NoError(t, err)
+	hostPubKey := hostPrivParsed.PublicKey()
+
+	// (currentUser already obtained at function start)
+
+	// Create SSH client connection
+	clientConfig := &cryptossh.ClientConfig{
+		User: currentUser.Username,
+		Auth: []cryptossh.AuthMethod{
+			cryptossh.PublicKeys(signer),
+		},
+		HostKeyCallback: cryptossh.FixedHostKey(hostPubKey),
+		Timeout:         5 * time.Second,
+	}
+
+	conn, err := cryptossh.Dial("tcp", serverAddr, clientConfig)
+	require.NoError(t, err, "SSH connection should succeed")
+	defer func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("connection close error: %v", err)
+		}
+	}()
+
+	// Try to create SFTP client - should fail when SFTP is disabled
+	_, err = sftp.NewClient(conn)
+	assert.Error(t, err, "SFTP client creation should fail when SFTP is disabled")
+}

client/ssh/server/sftp_unix.go

@@ -0,0 +1,71 @@
+//go:build !windows
+
+package server
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"strconv"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// executeSftpWithPrivilegeDrop executes SFTP using Unix privilege dropping
+func (s *Server) executeSftpWithPrivilegeDrop(sess ssh.Session, targetUser *user.User) error {
+	uid, gid, groups, err := s.parseUserCredentials(targetUser)
+	if err != nil {
+		return fmt.Errorf("parse user credentials: %w", err)
+	}
+
+	sftpCmd, err := s.createSftpExecutorCommand(sess, uid, gid, groups, targetUser.HomeDir)
+	if err != nil {
+		return fmt.Errorf("create executor: %w", err)
+	}
+
+	sftpCmd.Stdin = sess
+	sftpCmd.Stdout = sess
+	sftpCmd.Stderr = sess.Stderr()
+
+	log.Tracef("starting SFTP with privilege dropping to user %s (UID=%d, GID=%d)", targetUser.Username, uid, gid)
+
+	if err := sftpCmd.Start(); err != nil {
+		return fmt.Errorf("starting SFTP executor: %w", err)
+	}
+
+	if err := sftpCmd.Wait(); err != nil {
+		var exitError *exec.ExitError
+		if errors.As(err, &exitError) {
+			log.Tracef("SFTP process exited with code %d", exitError.ExitCode())
+			return nil
+		}
+		return fmt.Errorf("exec: %w", err)
+	}
+
+	return nil
+}
+
+// createSftpExecutorCommand creates a command that spawns netbird ssh sftp for privilege dropping
+func (s *Server) createSftpExecutorCommand(sess ssh.Session, uid, gid uint32, groups []uint32, workingDir string) (*exec.Cmd, error) {
+	netbirdPath, err := os.Executable()
+	if err != nil {
+		return nil, err
+	}
+
+	args := []string{
+		"ssh", "sftp",
+		"--uid", strconv.FormatUint(uint64(uid), 10),
+		"--gid", strconv.FormatUint(uint64(gid), 10),
+		"--working-dir", workingDir,
+	}
+
+	for _, group := range groups {
+		args = append(args, "--groups", strconv.FormatUint(uint64(group), 10))
+	}
+
+	log.Tracef("creating SFTP executor command: %s %v", netbirdPath, args)
+	return exec.CommandContext(sess.Context(), netbirdPath, args...), nil
+}

client/ssh/server/sftp_windows.go

@@ -0,0 +1,91 @@
+//go:build windows
+
+package server
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// createSftpCommand creates a Windows SFTP command with user switching.
+// The caller must close the returned token handle after starting the process.
+func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
+	username, domain := s.parseUsername(targetUser.Username)
+
+	netbirdPath, err := os.Executable()
+	if err != nil {
+		return nil, 0, fmt.Errorf("get netbird executable path: %w", err)
+	}
+
+	args := []string{
+		"ssh", "sftp",
+		"--working-dir", targetUser.HomeDir,
+		"--windows-username", username,
+		"--windows-domain", domain,
+	}
+
+	pd := NewPrivilegeDropper()
+	token, err := pd.createToken(username, domain)
+	if err != nil {
+		return nil, 0, fmt.Errorf("create token: %w", err)
+	}
+
+	defer func() {
+		if err := windows.CloseHandle(token); err != nil {
+			log.Warnf("failed to close impersonation token: %v", err)
+		}
+	}()
+
+	cmd, primaryToken, err := pd.createProcessWithToken(sess.Context(), windows.Token(token), netbirdPath, append([]string{netbirdPath}, args...), targetUser.HomeDir)
+	if err != nil {
+		return nil, 0, fmt.Errorf("create SFTP command: %w", err)
+	}
+
+	log.Debugf("Created Windows SFTP command with user switching for %s", targetUser.Username)
+	return cmd, primaryToken, nil
+}
+
+// executeSftpCommand executes a Windows SFTP command with proper I/O handling
+func (s *Server) executeSftpCommand(sess ssh.Session, sftpCmd *exec.Cmd, token windows.Token) error {
+	defer func() {
+		if err := windows.CloseHandle(windows.Handle(token)); err != nil {
+			log.Debugf("close primary token: %v", err)
+		}
+	}()
+
+	sftpCmd.Stdin = sess
+	sftpCmd.Stdout = sess
+	sftpCmd.Stderr = sess.Stderr()
+
+	if err := sftpCmd.Start(); err != nil {
+		return fmt.Errorf("starting sftp executor: %w", err)
+	}
+
+	if err := sftpCmd.Wait(); err != nil {
+		var exitError *exec.ExitError
+		if errors.As(err, &exitError) {
+			log.Tracef("sftp process exited with code %d", exitError.ExitCode())
+			return nil
+		}
+
+		return fmt.Errorf("exec sftp: %w", err)
+	}
+
+	return nil
+}
+
+// executeSftpWithPrivilegeDrop executes SFTP using Windows privilege dropping
+func (s *Server) executeSftpWithPrivilegeDrop(sess ssh.Session, targetUser *user.User) error {
+	sftpCmd, token, err := s.createSftpCommand(targetUser, sess)
+	if err != nil {
+		return fmt.Errorf("create sftp: %w", err)
+	}
+	return s.executeSftpCommand(sess, sftpCmd, token)
+}

client/ssh/server/shell.go

@@ -0,0 +1,184 @@
+package server
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	defaultUnixShell = "/bin/sh"
+
+	pwshExe       = "pwsh.exe" // #nosec G101 - This is not a credential, just executable name
+	powershellExe = "powershell.exe"
+)
+
+// getUserShell returns the appropriate shell for the given user ID
+// Handles all platform-specific logic and fallbacks consistently
+func getUserShell(userID string) string {
+	switch runtime.GOOS {
+	case "windows":
+		return getWindowsUserShell()
+	default:
+		return getUnixUserShell(userID)
+	}
+}
+
+// getWindowsUserShell returns the best shell for Windows users.
+// We intentionally do not support cmd.exe or COMSPEC fallbacks to avoid command injection
+// vulnerabilities that arise from cmd.exe's complex command line parsing and special characters.
+// PowerShell provides safer argument handling and is available on all modern Windows systems.
+// Order: pwsh.exe -> powershell.exe
+func getWindowsUserShell() string {
+	if path, err := exec.LookPath(pwshExe); err == nil {
+		return path
+	}
+	if path, err := exec.LookPath(powershellExe); err == nil {
+		return path
+	}
+
+	return `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`
+}
+
+// getUnixUserShell returns the shell for Unix-like systems.
+// Tries /etc/passwd first (fast, no subprocess), falls back to getent for NSS users.
+func getUnixUserShell(userID string) string {
+	if shell := getShellFromPasswd(userID); shell != "" {
+		return shell
+	}
+
+	if shell := getShellFromGetent(userID); shell != "" {
+		return shell
+	}
+
+	if shell := os.Getenv("SHELL"); shell != "" {
+		return shell
+	}
+
+	return defaultUnixShell
+}
+
+// getShellFromPasswd reads the shell from /etc/passwd for the given user ID
+func getShellFromPasswd(userID string) string {
+	file, err := os.Open("/etc/passwd")
+	if err != nil {
+		return ""
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			log.Warnf("close /etc/passwd file: %v", err)
+		}
+	}()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		fields := strings.Split(line, ":")
+		if len(fields) < 7 {
+			continue
+		}
+
+		// field 2 is UID
+		if fields[2] == userID {
+			shell := strings.TrimSpace(fields[6])
+			return shell
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		log.Warnf("error reading /etc/passwd: %v", err)
+	}
+
+	return ""
+}
+
+// prepareUserEnv prepares environment variables for user execution
+func prepareUserEnv(user *user.User, shell string) []string {
+	pathValue := "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
+	if runtime.GOOS == "windows" {
+		pathValue = `C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0`
+	}
+
+	return []string{
+		fmt.Sprint("SHELL=" + shell),
+		fmt.Sprint("USER=" + user.Username),
+		fmt.Sprint("LOGNAME=" + user.Username),
+		fmt.Sprint("HOME=" + user.HomeDir),
+		"PATH=" + pathValue,
+	}
+}
+
+// acceptEnv checks if environment variable from SSH client should be accepted
+// This is a whitelist of variables that SSH clients can send to the server
+func acceptEnv(envVar string) bool {
+	varName := envVar
+	if idx := strings.Index(envVar, "="); idx != -1 {
+		varName = envVar[:idx]
+	}
+
+	exactMatches := []string{
+		"LANG",
+		"LANGUAGE",
+		"TERM",
+		"COLORTERM",
+		"EDITOR",
+		"VISUAL",
+		"PAGER",
+		"LESS",
+		"LESSCHARSET",
+		"TZ",
+	}
+
+	prefixMatches := []string{
+		"LC_",
+	}
+
+	for _, exact := range exactMatches {
+		if varName == exact {
+			return true
+		}
+	}
+
+	for _, prefix := range prefixMatches {
+		if strings.HasPrefix(varName, prefix) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// prepareSSHEnv prepares SSH protocol-specific environment variables
+// These variables provide information about the SSH connection itself
+func prepareSSHEnv(session ssh.Session) []string {
+	remoteAddr := session.RemoteAddr()
+	localAddr := session.LocalAddr()
+
+	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
+	if err != nil {
+		remoteHost = remoteAddr.String()
+		remotePort = "0"
+	}
+
+	localHost, localPort, err := net.SplitHostPort(localAddr.String())
+	if err != nil {
+		localHost = localAddr.String()
+		localPort = strconv.Itoa(InternalSSHPort)
+	}
+
+	return []string{
+		// SSH_CLIENT format: "client_ip client_port server_port"
+		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
+		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
+		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
+	}
+}

client/ssh/server/test.go

@@ -0,0 +1,49 @@
+// This file is intentionally named test.go (not test_test.go) so the exported
+// StartTestServer helper is visible to the ssh/proxy and ssh/client external
+// test packages, not just this package's own tests. The //go:build !js tag
+// keeps its "testing" import — and the whole testing/flag/regexp transitive
+// chain it drags in — out of the wasm client, which links ssh/server through
+// the engine but never runs Go tests under GOOS=js.
+//go:build !js
+
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"testing"
+	"time"
+)
+
+// StartTestServer starts the SSH server and returns the address it's listening on.
+func StartTestServer(t *testing.T, server *Server) string {
+	started := make(chan string, 1)
+	errChan := make(chan error, 1)
+
+	go func() {
+		addrPort := netip.MustParseAddrPort("127.0.0.1:0")
+		if err := server.Start(context.Background(), addrPort); err != nil {
+			errChan <- err
+			return
+		}
+
+		actualAddr := server.Addr()
+		if actualAddr == nil {
+			errChan <- fmt.Errorf("server started but no listener address available")
+			return
+		}
+
+		started <- actualAddr.String()
+	}()
+
+	select {
+	case actualAddr := <-started:
+		return actualAddr
+	case err := <-errChan:
+		t.Fatalf("Server failed to start: %v", err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("Server start timeout")
+	}
+	return ""
+}

client/ssh/server/user_utils.go

@@ -0,0 +1,411 @@
+package server
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/user"
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+var (
+	ErrPrivilegeRequired    = errors.New("SeAssignPrimaryTokenPrivilege required for user switching - NetBird must run with elevated privileges")
+	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
+)
+
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
+// Dependency injection variables for testing - allows mocking dynamic runtime checks
+var (
+	getCurrentUser         = currentUserWithGetent
+	lookupUser             = lookupWithGetent
+	getCurrentOS           = func() string { return runtime.GOOS }
+	getIsProcessPrivileged = isCurrentProcessPrivileged
+
+	getEuid = os.Geteuid
+)
+
+const (
+	// FeatureSSHLogin represents SSH login operations for privilege checking
+	FeatureSSHLogin = "SSH login"
+	// FeatureSFTP represents SFTP operations for privilege checking
+	FeatureSFTP = "SFTP"
+)
+
+// PrivilegeCheckRequest represents a privilege check request
+type PrivilegeCheckRequest struct {
+	// Username being requested (empty = current user)
+	RequestedUsername         string
+	FeatureSupportsUserSwitch bool // Does this feature/operation support user switching?
+	FeatureName               string
+}
+
+// PrivilegeCheckResult represents the result of a privilege check
+type PrivilegeCheckResult struct {
+	// Allowed indicates whether the privilege check passed
+	Allowed bool
+	// User is the effective user to use for the operation (nil if not allowed)
+	User *user.User
+	// Error contains the reason for denial (nil if allowed)
+	Error error
+	// UsedFallback indicates we fell back to current user instead of requested user.
+	// This happens on Unix when running as an unprivileged user (e.g., in containers)
+	// where there's no point in user switching since we lack privileges anyway.
+	// When true, all privilege checks have already been performed and no additional
+	// privilege dropping or root checks are needed - the current user is the target.
+	UsedFallback bool
+	// RequiresUserSwitching indicates whether user switching will actually occur
+	// (false for fallback cases where no actual switching happens)
+	RequiresUserSwitching bool
+}
+
+// CheckPrivileges performs comprehensive privilege checking for all SSH features.
+// This is the single source of truth for privilege decisions across the SSH server.
+func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
+	context, err := s.buildPrivilegeCheckContext(req.FeatureName)
+	if err != nil {
+		return PrivilegeCheckResult{Allowed: false, Error: err}
+	}
+
+	// Handle empty username case - but still check root access controls
+	if req.RequestedUsername == "" {
+		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
+			return PrivilegeCheckResult{
+				Allowed: false,
+				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
+			}
+		}
+		return PrivilegeCheckResult{
+			Allowed:               true,
+			User:                  context.currentUser,
+			RequiresUserSwitching: false,
+		}
+	}
+
+	return s.checkUserRequest(context, req)
+}
+
+// buildPrivilegeCheckContext gathers all the context needed for privilege checking
+func (s *Server) buildPrivilegeCheckContext(featureName string) (*privilegeCheckContext, error) {
+	currentUser, err := getCurrentUser()
+	if err != nil {
+		return nil, fmt.Errorf("get current user for %s: %w", featureName, err)
+	}
+
+	s.mu.RLock()
+	allowRoot := s.allowRootLogin
+	s.mu.RUnlock()
+
+	return &privilegeCheckContext{
+		currentUser:           currentUser,
+		currentUserPrivileged: getIsProcessPrivileged(),
+		allowRoot:             allowRoot,
+	}, nil
+}
+
+// checkUserRequest handles normal privilege checking flow for specific usernames
+func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheckRequest) PrivilegeCheckResult {
+	if !ctx.currentUserPrivileged && isPlatformUnix() {
+		log.Debugf("Unix non-privileged shortcut: falling back to current user %s for %s (requested: %s)",
+			ctx.currentUser.Username, req.FeatureName, req.RequestedUsername)
+		return PrivilegeCheckResult{
+			Allowed:               true,
+			User:                  ctx.currentUser,
+			UsedFallback:          true,
+			RequiresUserSwitching: false,
+		}
+	}
+
+	resolvedUser, err := s.resolveRequestedUser(req.RequestedUsername)
+	if err != nil {
+		// Calculate if user switching would be required even if lookup failed
+		needsUserSwitching := !isSameUser(req.RequestedUsername, ctx.currentUser.Username)
+		return PrivilegeCheckResult{
+			Allowed:               false,
+			Error:                 err,
+			RequiresUserSwitching: needsUserSwitching,
+		}
+	}
+
+	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
+
+	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
+		return PrivilegeCheckResult{
+			Allowed:               false,
+			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
+			RequiresUserSwitching: needsUserSwitching,
+		}
+	}
+
+	if needsUserSwitching && !req.FeatureSupportsUserSwitch {
+		return PrivilegeCheckResult{
+			Allowed:               false,
+			Error:                 fmt.Errorf("%s: user switching not supported by this feature", req.FeatureName),
+			RequiresUserSwitching: needsUserSwitching,
+		}
+	}
+
+	return PrivilegeCheckResult{
+		Allowed:               true,
+		User:                  resolvedUser,
+		RequiresUserSwitching: needsUserSwitching,
+	}
+}
+
+// resolveRequestedUser resolves a username to its canonical user identity
+func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, error) {
+	if requestedUsername == "" {
+		return getCurrentUser()
+	}
+
+	if err := validateUsername(requestedUsername); err != nil {
+		return nil, fmt.Errorf("invalid username %q: %w", requestedUsername, err)
+	}
+
+	u, err := lookupUser(requestedUsername)
+	if err != nil {
+		return nil, &UserNotFoundError{Username: requestedUsername, Cause: err}
+	}
+	return u, nil
+}
+
+// isSameResolvedUser compares two resolved user identities
+func isSameResolvedUser(user1, user2 *user.User) bool {
+	if user1 == nil || user2 == nil {
+		return user1 == user2
+	}
+	return user1.Uid == user2.Uid
+}
+
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
+// isSameUser checks if two usernames refer to the same user
+// SECURITY: This function must be conservative - it should only return true
+// when we're certain both usernames refer to the exact same user identity
+func isSameUser(requestedUsername, currentUsername string) bool {
+	// Empty requested username means current user
+	if requestedUsername == "" {
+		return true
+	}
+
+	// Exact match (most common case)
+	if getCurrentOS() == "windows" {
+		if strings.EqualFold(requestedUsername, currentUsername) {
+			return true
+		}
+	} else {
+		if requestedUsername == currentUsername {
+			return true
+		}
+	}
+
+	// Windows domain resolution: only allow domain stripping when comparing
+	// a bare username against the current user's domain-qualified name
+	if getCurrentOS() == "windows" {
+		return isWindowsSameUser(requestedUsername, currentUsername)
+	}
+
+	return false
+}
+
+// isWindowsSameUser handles Windows-specific user comparison with domain logic
+func isWindowsSameUser(requestedUsername, currentUsername string) bool {
+	// Extract domain and username parts
+	extractParts := func(name string) (domain, user string) {
+		// Handle DOMAIN\username format
+		if idx := strings.LastIndex(name, `\`); idx != -1 {
+			return name[:idx], name[idx+1:]
+		}
+		// Handle user@domain.com format
+		if idx := strings.Index(name, "@"); idx != -1 {
+			return name[idx+1:], name[:idx]
+		}
+		// No domain specified - local machine
+		return "", name
+	}
+
+	reqDomain, reqUser := extractParts(requestedUsername)
+	curDomain, curUser := extractParts(currentUsername)
+
+	// Case-insensitive username comparison
+	if !strings.EqualFold(reqUser, curUser) {
+		return false
+	}
+
+	// If requested username has no domain, it refers to local machine user
+	// Allow this to match the current user regardless of current user's domain
+	if reqDomain == "" {
+		return true
+	}
+
+	// If both have domains, they must match exactly (case-insensitive)
+	return strings.EqualFold(reqDomain, curDomain)
+}
+
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return nil, result.Error
+	}
+
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
+// On Unix: root
+// On Windows: Administrator, SYSTEM (case-insensitive)
+// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
+func isPrivilegedUsername(username string) bool {
+	if getCurrentOS() != "windows" {
+		return username == "root"
+	}
+
+	bareUsername := username
+	// Handle Windows domain format: DOMAIN\username
+	if idx := strings.LastIndex(username, `\`); idx != -1 {
+		bareUsername = username[idx+1:]
+	}
+	// Handle email-style format: username@domain.com
+	if idx := strings.Index(bareUsername, "@"); idx != -1 {
+		bareUsername = bareUsername[:idx]
+	}
+
+	return isWindowsPrivilegedUser(bareUsername)
+}
+
+// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
+func isWindowsPrivilegedUser(bareUsername string) bool {
+	// common privileged usernames (case insensitive)
+	privilegedNames := []string{
+		"administrator",
+		"admin",
+		"root",
+		"system",
+		"localsystem",
+		"networkservice",
+		"localservice",
+	}
+
+	usernameLower := strings.ToLower(bareUsername)
+	for _, privilegedName := range privilegedNames {
+		if usernameLower == privilegedName {
+			return true
+		}
+	}
+
+	// computer accounts (ending with $) are not privileged by themselves
+	// They only gain privileges through group membership or specific SIDs
+
+	if targetUser, err := lookupUser(bareUsername); err == nil {
+		return isWindowsPrivilegedSID(targetUser.Uid)
+	}
+
+	return false
+}
+
+// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
+func isWindowsPrivilegedSID(sid string) bool {
+	privilegedSIDs := []string{
+		"S-1-5-18",     // Local System (SYSTEM)
+		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
+		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
+		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
+		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
+	}
+
+	for _, privilegedSID := range privilegedSIDs {
+		if sid == privilegedSID {
+			return true
+		}
+	}
+
+	// Check for domain administrator accounts (RID 500 in any domain)
+	// Format: S-1-5-21-domain-domain-domain-500
+	// This is reliable as RID 500 is reserved for the domain Administrator account
+	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
+		return true
+	}
+
+	// Check for other well-known privileged RIDs in domain contexts
+	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
+	if strings.HasPrefix(sid, "S-1-5-21-") {
+		if strings.HasSuffix(sid, "-512") || // Domain Admins group
+			strings.HasSuffix(sid, "-516") || // Domain Controllers group
+			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
+			return true
+		}
+	}
+
+	return false
+}
+
+// isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
+// On Unix systems, this means running as root (UID 0).
+// On Windows, this means running as Administrator or SYSTEM.
+func isCurrentProcessPrivileged() bool {
+	if getCurrentOS() == "windows" {
+		return isWindowsElevated()
+	}
+	return getEuid() == 0
+}
+
+// isWindowsElevated checks if the current process is running with elevated privileges on Windows
+func isWindowsElevated() bool {
+	currentUser, err := getCurrentUser()
+	if err != nil {
+		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
+		return false
+	}
+
+	if isWindowsPrivilegedSID(currentUser.Uid) {
+		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
+		return true
+	}
+
+	if isPrivilegedUsername(currentUser.Username) {
+		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
+		return true
+	}
+
+	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
+	return false
+}

client/ssh/server/user_utils_js.go

@@ -0,0 +1,8 @@
+//go:build js
+
+package server
+
+// validateUsername is not supported on JS/WASM
+func validateUsername(_ string) error {
+	return errNotSupported
+}

client/ssh/server/user_utils_test.go

@@ -0,0 +1,908 @@
+package server
+
+import (
+	"errors"
+	"os/user"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Test helper functions
+func createTestUser(username, uid, gid, homeDir string) *user.User {
+	return &user.User{
+		Uid:      uid,
+		Gid:      gid,
+		Username: username,
+		Name:     username,
+		HomeDir:  homeDir,
+	}
+}
+
+// Test dependency injection setup - injects platform dependencies to test real logic
+func setupTestDependencies(currentUser *user.User, currentUserErr error, os string, euid int, lookupUsers map[string]*user.User, lookupErrors map[string]error) func() {
+	// Store originals
+	originalGetCurrentUser := getCurrentUser
+	originalLookupUser := lookupUser
+	originalGetCurrentOS := getCurrentOS
+	originalGetEuid := getEuid
+
+	// Reset caches to ensure clean test state
+
+	// Set test values - inject platform dependencies
+	getCurrentUser = func() (*user.User, error) {
+		return currentUser, currentUserErr
+	}
+
+	lookupUser = func(username string) (*user.User, error) {
+		if err, exists := lookupErrors[username]; exists {
+			return nil, err
+		}
+		if userObj, exists := lookupUsers[username]; exists {
+			return userObj, nil
+		}
+		return nil, errors.New("user: unknown user " + username)
+	}
+
+	getCurrentOS = func() string {
+		return os
+	}
+
+	getEuid = func() int {
+		return euid
+	}
+
+	// Mock privilege detection based on the test user
+	getIsProcessPrivileged = func() bool {
+		if currentUser == nil {
+			return false
+		}
+		// Check both username and SID for Windows systems
+		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
+			return true
+		}
+		return isPrivilegedUsername(currentUser.Username)
+	}
+
+	// Return cleanup function
+	return func() {
+		getCurrentUser = originalGetCurrentUser
+		lookupUser = originalLookupUser
+		getCurrentOS = originalGetCurrentOS
+		getEuid = originalGetEuid
+
+		getIsProcessPrivileged = isCurrentProcessPrivileged
+
+		// Reset caches after test
+	}
+}
+
+func TestCheckPrivileges_ComprehensiveMatrix(t *testing.T) {
+	tests := []struct {
+		name                      string
+		os                        string
+		euid                      int
+		currentUser               *user.User
+		requestedUsername         string
+		featureSupportsUserSwitch bool
+		allowRoot                 bool
+		lookupUsers               map[string]*user.User
+		expectedAllowed           bool
+		expectedRequiresSwitch    bool
+	}{
+		{
+			name:                      "linux_root_can_switch_to_alice",
+			os:                        "linux",
+			euid:                      0, // Root process
+			currentUser:               createTestUser("root", "0", "0", "/root"),
+			requestedUsername:         "alice",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"alice": createTestUser("alice", "1000", "1000", "/home/alice"),
+			},
+			expectedAllowed:        true,
+			expectedRequiresSwitch: true,
+		},
+		{
+			name:                      "linux_non_root_fallback_to_current_user",
+			os:                        "linux",
+			euid:                      1000, // Non-root process
+			currentUser:               createTestUser("alice", "1000", "1000", "/home/alice"),
+			requestedUsername:         "bob",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			expectedAllowed:           true,  // Should fallback to current user (alice)
+			expectedRequiresSwitch:    false, // Fallback means no actual switching
+		},
+		{
+			name:                      "windows_admin_can_switch_to_alice",
+			os:                        "windows",
+			euid:                      1000, // Irrelevant on Windows
+			currentUser:               createTestUser("Administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\Users\\Administrator"),
+			requestedUsername:         "alice",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"alice": createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			},
+			expectedAllowed:        true,
+			expectedRequiresSwitch: true,
+		},
+		{
+			name:                      "windows_non_admin_no_fallback_hard_failure",
+			os:                        "windows",
+			euid:                      1000, // Irrelevant on Windows
+			currentUser:               createTestUser("alice", "1001", "1001", "C:\\Users\\alice"),
+			requestedUsername:         "bob",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"bob": createTestUser("bob", "S-1-5-21-123456789-123456789-123456789-1002", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\bob"),
+			},
+			expectedAllowed:        true, // Let OS decide - deferred security check
+			expectedRequiresSwitch: true, // Different user was requested
+		},
+		// Comprehensive test matrix: non-root linux with different allowRoot settings
+		{
+			name:                      "linux_non_root_request_root_allowRoot_false",
+			os:                        "linux",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "1000", "1000", "/home/alice"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           true,  // Fallback allows access regardless of root setting
+			expectedRequiresSwitch:    false, // Fallback case, no switching
+		},
+		{
+			name:                      "linux_non_root_request_root_allowRoot_true",
+			os:                        "linux",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "1000", "1000", "/home/alice"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			expectedAllowed:           true,  // Should fallback to alice (non-privileged process)
+			expectedRequiresSwitch:    false, // Fallback means no actual switching
+		},
+		// Windows admin test matrix
+		{
+			name:                      "windows_admin_request_root_allowRoot_false",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("Administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\Users\\Administrator"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           false, // Root not allowed
+			expectedRequiresSwitch:    true,
+		},
+		{
+			name:                      "windows_admin_request_root_allowRoot_true",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("Administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\Users\\Administrator"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"root": createTestUser("root", "0", "0", "/root"),
+			},
+			expectedAllowed:        true, // Windows user switching should work like Unix
+			expectedRequiresSwitch: true,
+		},
+		// Windows non-admin test matrix
+		{
+			name:                      "windows_non_admin_request_root_allowRoot_false",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           false, // Root not allowed (allowRoot=false takes precedence)
+			expectedRequiresSwitch:    true,
+		},
+		{
+			name:                      "windows_system_account_allowRoot_false",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("NETBIRD\\WIN2K19-C2$", "S-1-5-18", "S-1-5-18", "C:\\Windows\\System32"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           false, // Root not allowed
+			expectedRequiresSwitch:    true,
+		},
+		{
+			name:                      "windows_system_account_allowRoot_true",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("NETBIRD\\WIN2K19-C2$", "S-1-5-18", "S-1-5-18", "C:\\Windows\\System32"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"root": createTestUser("root", "0", "0", "/root"),
+			},
+			expectedAllowed:        true, // SYSTEM can switch to root
+			expectedRequiresSwitch: true,
+		},
+		{
+			name:                      "windows_non_admin_request_root_allowRoot_true",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			requestedUsername:         "root",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"root": createTestUser("root", "0", "0", "/root"),
+			},
+			expectedAllowed:        true, // Let OS decide - deferred security check
+			expectedRequiresSwitch: true,
+		},
+
+		// Feature doesn't support user switching scenarios
+		{
+			name:                      "linux_root_feature_no_user_switching_same_user",
+			os:                        "linux",
+			euid:                      0,
+			currentUser:               createTestUser("root", "0", "0", "/root"),
+			requestedUsername:         "root", // Same user
+			featureSupportsUserSwitch: false,
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"root": createTestUser("root", "0", "0", "/root"),
+			},
+			expectedAllowed:        true, // Same user should work regardless of feature support
+			expectedRequiresSwitch: false,
+		},
+		{
+			name:                      "linux_root_feature_no_user_switching_different_user",
+			os:                        "linux",
+			euid:                      0,
+			currentUser:               createTestUser("root", "0", "0", "/root"),
+			requestedUsername:         "alice",
+			featureSupportsUserSwitch: false, // Feature doesn't support switching
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"alice": createTestUser("alice", "1000", "1000", "/home/alice"),
+			},
+			expectedAllowed:        false, // Should deny because feature doesn't support switching
+			expectedRequiresSwitch: true,
+		},
+
+		// Empty username (current user) scenarios
+		{
+			name:                      "linux_non_root_current_user_empty_username",
+			os:                        "linux",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "1000", "1000", "/home/alice"),
+			requestedUsername:         "", // Empty = current user
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           true, // Current user should always work
+			expectedRequiresSwitch:    false,
+		},
+		{
+			name:                      "linux_root_current_user_empty_username_root_not_allowed",
+			os:                        "linux",
+			euid:                      0,
+			currentUser:               createTestUser("root", "0", "0", "/root"),
+			requestedUsername:         "", // Empty = current user (root)
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false, // Root not allowed
+			expectedAllowed:           false, // Should deny root even when it's current user
+			expectedRequiresSwitch:    false,
+		},
+
+		// User not found scenarios
+		{
+			name:                      "linux_root_user_not_found",
+			os:                        "linux",
+			euid:                      0,
+			currentUser:               createTestUser("root", "0", "0", "/root"),
+			requestedUsername:         "nonexistent",
+			featureSupportsUserSwitch: true,
+			allowRoot:                 true,
+			lookupUsers:               map[string]*user.User{}, // No users defined = user not found
+			expectedAllowed:           false,                   // Should fail due to user not found
+			expectedRequiresSwitch:    true,
+		},
+
+		// Windows feature doesn't support user switching
+		{
+			name:                      "windows_admin_feature_no_user_switching_different_user",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("Administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\Users\\Administrator"),
+			requestedUsername:         "alice",
+			featureSupportsUserSwitch: false, // Feature doesn't support switching
+			allowRoot:                 true,
+			lookupUsers: map[string]*user.User{
+				"alice": createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			},
+			expectedAllowed:        false, // Should deny because feature doesn't support switching
+			expectedRequiresSwitch: true,
+		},
+
+		// Windows regular user scenarios (non-admin)
+		{
+			name:                      "windows_regular_user_same_user",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			requestedUsername:         "alice", // Same user
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			lookupUsers: map[string]*user.User{
+				"alice": createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			},
+			expectedAllowed:        true,  // Regular user accessing themselves should work
+			expectedRequiresSwitch: false, // No switching for same user
+		},
+		{
+			name:                      "windows_regular_user_empty_username",
+			os:                        "windows",
+			euid:                      1000,
+			currentUser:               createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\Users\\alice"),
+			requestedUsername:         "", // Empty = current user
+			featureSupportsUserSwitch: true,
+			allowRoot:                 false,
+			expectedAllowed:           true,  // Current user should always work
+			expectedRequiresSwitch:    false, // No switching for current user
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Inject platform dependencies to test real logic
+			cleanup := setupTestDependencies(tt.currentUser, nil, tt.os, tt.euid, tt.lookupUsers, nil)
+			defer cleanup()
+
+			server := &Server{allowRootLogin: tt.allowRoot}
+
+			result := server.CheckPrivileges(PrivilegeCheckRequest{
+				RequestedUsername:         tt.requestedUsername,
+				FeatureSupportsUserSwitch: tt.featureSupportsUserSwitch,
+				FeatureName:               "SSH login",
+			})
+
+			assert.Equal(t, tt.expectedAllowed, result.Allowed)
+			assert.Equal(t, tt.expectedRequiresSwitch, result.RequiresUserSwitching)
+		})
+	}
+}
+
+func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Fallback mechanism is Unix-specific")
+	}
+
+	// Create test scenario where fallback should occur
+	server := &Server{allowRootLogin: true}
+
+	// Mock dependencies to simulate non-privileged user
+	originalGetCurrentUser := getCurrentUser
+	originalGetIsProcessPrivileged := getIsProcessPrivileged
+
+	defer func() {
+		getCurrentUser = originalGetCurrentUser
+		getIsProcessPrivileged = originalGetIsProcessPrivileged
+
+	}()
+
+	// Set up mocks for fallback scenario
+	getCurrentUser = func() (*user.User, error) {
+		return createTestUser("netbird", "1000", "1000", "/var/lib/netbird"), nil
+	}
+	getIsProcessPrivileged = func() bool { return false } // Non-privileged
+
+	// Request different user - should fallback
+	result := server.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         "alice",
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               "SSH login",
+	})
+
+	// Verify fallback occurred
+	assert.True(t, result.Allowed, "Should allow with fallback")
+	assert.True(t, result.UsedFallback, "Should indicate fallback was used")
+	assert.Equal(t, "netbird", result.User.Username, "Should return current user")
+	assert.False(t, result.RequiresUserSwitching, "Should not require switching when fallback is used")
+
+	// Key assertion: When UsedFallback is true, no privilege dropping should be needed
+	// because all privilege checks have already been performed and we're using current user
+	t.Logf("UsedFallback=true means: current user (%s) is the target, no privilege dropping needed",
+		result.User.Username)
+}
+
+func TestPrivilegedUsernameDetection(t *testing.T) {
+	tests := []struct {
+		name       string
+		username   string
+		platform   string
+		privileged bool
+	}{
+		// Unix/Linux tests
+		{"unix_root", "root", "linux", true},
+		{"unix_regular_user", "alice", "linux", false},
+		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
+
+		// Windows tests
+		{"windows_administrator", "Administrator", "windows", true},
+		{"windows_system", "SYSTEM", "windows", true},
+		{"windows_admin", "admin", "windows", true},
+		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
+		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
+		{"windows_email_admin", "admin@domain.com", "windows", true},
+		{"windows_regular_user", "alice", "windows", false},
+		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
+		{"windows_localsystem", "localsystem", "windows", true},
+		{"windows_networkservice", "networkservice", "windows", true},
+		{"windows_localservice", "localservice", "windows", true},
+
+		// Computer accounts (these depend on current user context in real implementation)
+		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
+		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
+
+		// Cross-platform
+		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Mock the platform for this test
+			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
+			defer cleanup()
+
+			result := isPrivilegedUsername(tt.username)
+			assert.Equal(t, tt.privileged, result)
+		})
+	}
+}
+
+func TestWindowsPrivilegedSIDDetection(t *testing.T) {
+	tests := []struct {
+		name        string
+		sid         string
+		privileged  bool
+		description string
+	}{
+		// Well-known system accounts
+		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
+		{"local_service", "S-1-5-19", true, "Local Service"},
+		{"network_service", "S-1-5-20", true, "Network Service"},
+		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
+		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
+
+		// Domain accounts
+		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
+		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
+		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
+		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
+
+		// Regular users
+		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
+		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
+		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
+
+		// Groups that are not privileged
+		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
+		{"power_users", "S-1-5-32-547", false, "Power Users group"},
+
+		// Invalid SIDs
+		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
+		{"empty_sid", "", false, "Empty SID"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsPrivilegedSID(tt.sid)
+			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
+		})
+	}
+}
+
+func TestIsSameUser(t *testing.T) {
+	tests := []struct {
+		name     string
+		user1    string
+		user2    string
+		os       string
+		expected bool
+	}{
+		// Basic cases
+		{"same_username", "alice", "alice", "linux", true},
+		{"different_username", "alice", "bob", "linux", false},
+
+		// Linux (no domain processing)
+		{"linux_domain_vs_bare", "DOMAIN\\alice", "alice", "linux", false},
+		{"linux_email_vs_bare", "alice@domain.com", "alice", "linux", false},
+		{"linux_same_literal", "DOMAIN\\alice", "DOMAIN\\alice", "linux", true},
+
+		// Windows (with domain processing) - Note: parameter order is (requested, current, os, expected)
+		{"windows_domain_vs_bare", "alice", "DOMAIN\\alice", "windows", true},                         // bare username matches domain current user
+		{"windows_email_vs_bare", "alice", "alice@domain.com", "windows", true},                       // bare username matches email current user
+		{"windows_different_domains_same_user", "DOMAIN1\\alice", "DOMAIN2\\alice", "windows", false}, // SECURITY: different domains = different users
+		{"windows_case_insensitive", "Alice", "alice", "windows", true},
+		{"windows_different_users", "DOMAIN\\alice", "DOMAIN\\bob", "windows", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set up OS mock
+			cleanup := setupTestDependencies(nil, nil, tt.os, 1000, nil, nil)
+			defer cleanup()
+
+			result := isSameUser(tt.user1, tt.user2)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestUsernameValidation_Unix(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Unix-specific username validation tests")
+	}
+
+	tests := []struct {
+		name     string
+		username string
+		wantErr  bool
+		errMsg   string
+	}{
+		// Valid usernames (Unix/POSIX)
+		{"valid_alphanumeric", "user123", false, ""},
+		{"valid_with_dots", "user.name", false, ""},
+		{"valid_with_hyphens", "user-name", false, ""},
+		{"valid_with_underscores", "user_name", false, ""},
+		{"valid_uppercase", "UserName", false, ""},
+		{"valid_starting_with_digit", "123user", false, ""},
+		{"valid_starting_with_dot", ".hidden", false, ""},
+
+		// Invalid usernames (Unix/POSIX)
+		{"empty_username", "", true, "username cannot be empty"},
+		{"username_too_long", "thisusernameiswaytoolongandexceedsthe32characterlimit", true, "username too long"},
+		{"username_starting_with_hyphen", "-user", true, "invalid characters"}, // POSIX restriction
+		{"username_with_spaces", "user name", true, "invalid characters"},
+		{"username_with_shell_metacharacters", "user;rm", true, "invalid characters"},
+		{"username_with_command_injection", "user`rm -rf /`", true, "invalid characters"},
+		{"username_with_pipe", "user|rm", true, "invalid characters"},
+		{"username_with_ampersand", "user&rm", true, "invalid characters"},
+		{"username_with_quotes", "user\"name", true, "invalid characters"},
+		{"username_with_newline", "user\nname", true, "invalid characters"},
+		{"reserved_dot", ".", true, "cannot be '.' or '..'"},
+		{"reserved_dotdot", "..", true, "cannot be '.' or '..'"},
+		{"username_with_at_symbol", "user@domain", true, "invalid characters"}, // Not allowed in bare Unix usernames
+		{"username_with_backslash", "user\\name", true, "invalid characters"},  // Not allowed in Unix usernames
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateUsername(tt.username)
+			if tt.wantErr {
+				assert.Error(t, err, "Should reject invalid username")
+				if tt.errMsg != "" {
+					assert.Contains(t, err.Error(), tt.errMsg, "Error message should contain expected text")
+				}
+			} else {
+				assert.NoError(t, err, "Should accept valid username")
+			}
+		})
+	}
+}
+
+func TestUsernameValidation_Windows(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows-specific username validation tests")
+	}
+
+	tests := []struct {
+		name     string
+		username string
+		wantErr  bool
+		errMsg   string
+	}{
+		// Valid usernames (Windows)
+		{"valid_alphanumeric", "user123", false, ""},
+		{"valid_with_dots", "user.name", false, ""},
+		{"valid_with_hyphens", "user-name", false, ""},
+		{"valid_with_underscores", "user_name", false, ""},
+		{"valid_uppercase", "UserName", false, ""},
+		{"valid_starting_with_digit", "123user", false, ""},
+		{"valid_starting_with_dot", ".hidden", false, ""},
+		{"valid_starting_with_hyphen", "-user", false, ""},     // Windows allows this
+		{"valid_domain_username", "DOMAIN\\user", false, ""},   // Windows domain format
+		{"valid_email_username", "user@domain.com", false, ""}, // Windows email format
+		{"valid_machine_username", "MACHINE\\user", false, ""}, // Windows machine format
+
+		// Invalid usernames (Windows)
+		{"empty_username", "", true, "username cannot be empty"},
+		{"username_too_long", "thisusernameiswaytoolongandexceedsthe32characterlimit", true, "username too long"},
+		{"username_with_spaces", "user name", true, "invalid characters"},
+		{"username_with_shell_metacharacters", "user;rm", true, "invalid characters"},
+		{"username_with_command_injection", "user`rm -rf /`", true, "invalid characters"},
+		{"username_with_pipe", "user|rm", true, "invalid characters"},
+		{"username_with_ampersand", "user&rm", true, "invalid characters"},
+		{"username_with_quotes", "user\"name", true, "invalid characters"},
+		{"username_with_newline", "user\nname", true, "invalid characters"},
+		{"username_with_brackets", "user[name]", true, "invalid characters"},
+		{"username_with_colon", "user:name", true, "invalid characters"},
+		{"username_with_semicolon", "user;name", true, "invalid characters"},
+		{"username_with_equals", "user=name", true, "invalid characters"},
+		{"username_with_comma", "user,name", true, "invalid characters"},
+		{"username_with_plus", "user+name", true, "invalid characters"},
+		{"username_with_asterisk", "user*name", true, "invalid characters"},
+		{"username_with_question", "user?name", true, "invalid characters"},
+		{"username_with_angles", "user<name>", true, "invalid characters"},
+		{"reserved_dot", ".", true, "cannot be '.' or '..'"},
+		{"reserved_dotdot", "..", true, "cannot be '.' or '..'"},
+		{"username_ending_with_period", "user.", true, "cannot end with a period"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateUsername(tt.username)
+			if tt.wantErr {
+				assert.Error(t, err, "Should reject invalid username")
+				if tt.errMsg != "" {
+					assert.Contains(t, err.Error(), tt.errMsg, "Error message should contain expected text")
+				}
+			} else {
+				assert.NoError(t, err, "Should accept valid username")
+			}
+		})
+	}
+}
+
+// Test real-world integration scenarios with actual platform capabilities
+func TestCheckPrivileges_RealWorldScenarios(t *testing.T) {
+	tests := []struct {
+		name                      string
+		feature                   string
+		featureSupportsUserSwitch bool
+		requestedUsername         string
+		allowRoot                 bool
+		expectedBehaviorPattern   string
+	}{
+		{"SSH_login_current_user", "SSH login", true, "", true, "should_allow_current_user"},
+		{"SFTP_current_user", "SFTP", true, "", true, "should_allow_current_user"},
+		{"port_forwarding_current_user", "port forwarding", false, "", true, "should_allow_current_user"},
+		{"SSH_login_root_not_allowed", "SSH login", true, "root", false, "should_deny_root"},
+		{"port_forwarding_different_user", "port forwarding", false, "differentuser", true, "should_deny_switching"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Mock privileged environment to ensure consistent test behavior across environments
+			cleanup := setupTestDependencies(
+				createTestUser("root", "0", "0", "/root"), // Running as root
+				nil,
+				runtime.GOOS,
+				0, // euid 0 (root)
+				map[string]*user.User{
+					"root":          createTestUser("root", "0", "0", "/root"),
+					"differentuser": createTestUser("differentuser", "1000", "1000", "/home/differentuser"),
+				},
+				nil,
+			)
+			defer cleanup()
+
+			server := &Server{allowRootLogin: tt.allowRoot}
+
+			result := server.CheckPrivileges(PrivilegeCheckRequest{
+				RequestedUsername:         tt.requestedUsername,
+				FeatureSupportsUserSwitch: tt.featureSupportsUserSwitch,
+				FeatureName:               tt.feature,
+			})
+
+			switch tt.expectedBehaviorPattern {
+			case "should_allow_current_user":
+				assert.True(t, result.Allowed, "Should allow current user access")
+				assert.False(t, result.RequiresUserSwitching, "Current user should not require switching")
+			case "should_deny_root":
+				assert.False(t, result.Allowed, "Should deny root when not allowed")
+				assert.Contains(t, result.Error.Error(), "root", "Should mention root in error")
+			case "should_deny_switching":
+				assert.False(t, result.Allowed, "Should deny when feature doesn't support switching")
+				assert.Contains(t, result.Error.Error(), "user switching not supported", "Should mention switching in error")
+			}
+		})
+	}
+}
+
+// Test with actual platform capabilities - no mocking
+func TestCheckPrivileges_ActualPlatform(t *testing.T) {
+	// This test uses the REAL platform capabilities
+	server := &Server{allowRootLogin: true}
+
+	// Test current user access - should always work
+	result := server.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         "", // Current user
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               "SSH login",
+	})
+
+	assert.True(t, result.Allowed, "Current user should always be allowed")
+	assert.False(t, result.RequiresUserSwitching, "Current user should not require switching")
+	assert.NotNil(t, result.User, "Should return current user")
+
+	// Test user switching capability based on actual platform
+	actualIsPrivileged := isCurrentProcessPrivileged() // REAL check
+	actualOS := runtime.GOOS                           // REAL check
+
+	t.Logf("Platform capabilities: OS=%s, isPrivileged=%v, supportsUserSwitching=%v",
+		actualOS, actualIsPrivileged, actualIsPrivileged)
+
+	// Test requesting different user
+	result = server.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         "nonexistentuser",
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               "SSH login",
+	})
+
+	switch {
+	case actualOS == "windows":
+		// Windows supports user switching but should fail on nonexistent user
+		assert.False(t, result.Allowed, "Windows should deny nonexistent user")
+		assert.True(t, result.RequiresUserSwitching, "Should indicate switching is needed")
+		assert.Contains(t, result.Error.Error(), "not found",
+			"Should indicate user not found")
+	case !actualIsPrivileged:
+		// Non-privileged Unix processes should fallback to current user
+		assert.True(t, result.Allowed, "Non-privileged Unix process should fallback to current user")
+		assert.False(t, result.RequiresUserSwitching, "Fallback means no switching actually happens")
+		assert.True(t, result.UsedFallback, "Should indicate fallback was used")
+		assert.NotNil(t, result.User, "Should return current user")
+	default:
+		// Privileged Unix processes should attempt user lookup
+		assert.False(t, result.Allowed, "Should fail due to nonexistent user")
+		assert.True(t, result.RequiresUserSwitching, "Should indicate switching is needed")
+		assert.Contains(t, result.Error.Error(), "nonexistentuser",
+			"Should indicate user not found")
+	}
+}
+
+// Test platform detection logic with dependency injection
+func TestPlatformLogic_DependencyInjection(t *testing.T) {
+	tests := []struct {
+		name                          string
+		os                            string
+		euid                          int
+		currentUser                   *user.User
+		expectedIsProcessPrivileged   bool
+		expectedSupportsUserSwitching bool
+	}{
+		{
+			name:                          "linux_root_process",
+			os:                            "linux",
+			euid:                          0,
+			currentUser:                   createTestUser("root", "0", "0", "/root"),
+			expectedIsProcessPrivileged:   true,
+			expectedSupportsUserSwitching: true,
+		},
+		{
+			name:                          "linux_non_root_process",
+			os:                            "linux",
+			euid:                          1000,
+			currentUser:                   createTestUser("alice", "1000", "1000", "/home/alice"),
+			expectedIsProcessPrivileged:   false,
+			expectedSupportsUserSwitching: false,
+		},
+		{
+			name:                          "windows_admin_process",
+			os:                            "windows",
+			euid:                          1000, // euid ignored on Windows
+			currentUser:                   createTestUser("Administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\Users\\Administrator"),
+			expectedIsProcessPrivileged:   true,
+			expectedSupportsUserSwitching: true, // Windows supports user switching when privileged
+		},
+		{
+			name:                          "windows_regular_process",
+			os:                            "windows",
+			euid:                          1000, // euid ignored on Windows
+			currentUser:                   createTestUser("alice", "1001", "1001", "C:\\Users\\alice"),
+			expectedIsProcessPrivileged:   false,
+			expectedSupportsUserSwitching: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Inject platform dependencies and test REAL logic
+			cleanup := setupTestDependencies(tt.currentUser, nil, tt.os, tt.euid, nil, nil)
+			defer cleanup()
+
+			// Test the actual functions with injected dependencies
+			actualIsPrivileged := isCurrentProcessPrivileged()
+			actualSupportsUserSwitching := actualIsPrivileged
+
+			assert.Equal(t, tt.expectedIsProcessPrivileged, actualIsPrivileged,
+				"isCurrentProcessPrivileged() result mismatch")
+			assert.Equal(t, tt.expectedSupportsUserSwitching, actualSupportsUserSwitching,
+				"supportsUserSwitching() result mismatch")
+
+			t.Logf("Platform: %s, EUID: %d, User: %s", tt.os, tt.euid, tt.currentUser.Username)
+			t.Logf("Results: isPrivileged=%v, supportsUserSwitching=%v",
+				actualIsPrivileged, actualSupportsUserSwitching)
+		})
+	}
+}
+
+func TestCheckPrivileges_WindowsElevatedUserSwitching(t *testing.T) {
+	// Test Windows elevated user switching scenarios with simplified privilege logic
+	tests := []struct {
+		name                  string
+		currentUser           *user.User
+		requestedUsername     string
+		allowRoot             bool
+		expectedAllowed       bool
+		expectedErrorContains string
+	}{
+		{
+			name:              "windows_admin_can_switch_to_alice",
+			currentUser:       createTestUser("administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\\\Users\\\\Administrator"),
+			requestedUsername: "alice",
+			allowRoot:         true,
+			expectedAllowed:   true,
+		},
+		{
+			name:              "windows_non_admin_can_try_switch",
+			currentUser:       createTestUser("alice", "S-1-5-21-123456789-123456789-123456789-1001", "S-1-5-21-123456789-123456789-123456789-513", "C:\\\\Users\\\\alice"),
+			requestedUsername: "bob",
+			allowRoot:         true,
+			expectedAllowed:   true, // Privilege check allows it, OS will reject during execution
+		},
+		{
+			name:              "windows_system_can_switch_to_alice",
+			currentUser:       createTestUser("SYSTEM", "S-1-5-18", "S-1-5-18", "C:\\\\Windows\\\\system32\\\\config\\\\systemprofile"),
+			requestedUsername: "alice",
+			allowRoot:         true,
+			expectedAllowed:   true,
+		},
+		{
+			name:                  "windows_admin_root_not_allowed",
+			currentUser:           createTestUser("administrator", "S-1-5-21-123456789-123456789-123456789-500", "S-1-5-32-544", "C:\\\\Users\\\\Administrator"),
+			requestedUsername:     "root",
+			allowRoot:             false,
+			expectedAllowed:       false,
+			expectedErrorContains: "privileged user login is disabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup test dependencies with Windows OS and specified privileges
+			lookupUsers := map[string]*user.User{
+				tt.requestedUsername: createTestUser(tt.requestedUsername, "1002", "1002", "C:\\\\Users\\\\"+tt.requestedUsername),
+			}
+			cleanup := setupTestDependencies(tt.currentUser, nil, "windows", 1000, lookupUsers, nil)
+			defer cleanup()
+
+			server := &Server{allowRootLogin: tt.allowRoot}
+
+			result := server.CheckPrivileges(PrivilegeCheckRequest{
+				RequestedUsername:         tt.requestedUsername,
+				FeatureSupportsUserSwitch: true,
+				FeatureName:               "SSH login",
+			})
+
+			assert.Equal(t, tt.expectedAllowed, result.Allowed,
+				"Privilege check result should match expected for %s", tt.name)
+
+			if !tt.expectedAllowed && tt.expectedErrorContains != "" {
+				assert.NotNil(t, result.Error, "Should have error when not allowed")
+				assert.Contains(t, result.Error.Error(), tt.expectedErrorContains,
+					"Error should contain expected message")
+			}
+
+			if tt.expectedAllowed && tt.requestedUsername != "" && tt.currentUser.Username != tt.requestedUsername {
+				assert.True(t, result.RequiresUserSwitching, "Should require user switching for different user")
+			}
+		})
+	}
+}

client/ssh/server/userswitching_js.go

@@ -0,0 +1,8 @@
+//go:build js
+
+package server
+
+// enableUserSwitching is not supported on JS/WASM
+func enableUserSwitching() error {
+	return errNotSupported
+}

client/ssh/server/userswitching_unix.go

@@ -0,0 +1,258 @@
+//go:build unix
+
+package server
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+	"os/exec"
+	"os/user"
+	"regexp"
+	"runtime"
+	"strconv"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+)
+
+// POSIX portable filename character set regex: [a-zA-Z0-9._-]
+// First character cannot be hyphen (POSIX requirement)
+var posixUsernameRegex = regexp.MustCompile(`^[a-zA-Z0-9._][a-zA-Z0-9._-]*$`)
+
+// validateUsername validates that a username conforms to POSIX standards with security considerations
+func validateUsername(username string) error {
+	if username == "" {
+		return errors.New("username cannot be empty")
+	}
+
+	// POSIX allows up to 256 characters, but practical limit is 32 for compatibility
+	if len(username) > 32 {
+		return errors.New("username too long (max 32 characters)")
+	}
+
+	if !posixUsernameRegex.MatchString(username) {
+		return errors.New("username contains invalid characters (must match POSIX portable filename character set)")
+	}
+
+	if username == "." || username == ".." {
+		return fmt.Errorf("username cannot be '.' or '..'")
+	}
+
+	// Warn if username is fully numeric (can cause issues with UID/username ambiguity)
+	if isFullyNumeric(username) {
+		log.Warnf("fully numeric username '%s' may cause issues with some commands", username)
+	}
+
+	return nil
+}
+
+// isFullyNumeric checks if username contains only digits
+func isFullyNumeric(username string) bool {
+	for _, char := range username {
+		if char < '0' || char > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+// createPtyLoginCommand creates a Pty command using login for privileged processes
+func (s *Server) createPtyLoginCommand(localUser *user.User, ptyReq ssh.Pty, session ssh.Session) (*exec.Cmd, error) {
+	loginPath, args, err := s.getLoginCmd(localUser.Username, session.RemoteAddr())
+	if err != nil {
+		return nil, fmt.Errorf("get login command: %w", err)
+	}
+
+	execCmd := exec.CommandContext(session.Context(), loginPath, args...)
+	execCmd.Dir = localUser.HomeDir
+	execCmd.Env = s.preparePtyEnv(localUser, ptyReq, session)
+
+	return execCmd, nil
+}
+
+// getLoginCmd returns the login command and args for privileged Pty user switching
+func (s *Server) getLoginCmd(username string, remoteAddr net.Addr) (string, []string, error) {
+	loginPath, err := exec.LookPath("login")
+	if err != nil {
+		return "", nil, fmt.Errorf("login command not available: %w", err)
+	}
+
+	addrPort, err := netip.ParseAddrPort(remoteAddr.String())
+	if err != nil {
+		return "", nil, fmt.Errorf("parse remote address: %w", err)
+	}
+
+	switch runtime.GOOS {
+	case "linux":
+		p, a := s.getLinuxLoginCmd(loginPath, username, addrPort.Addr().String())
+		return p, a, nil
+	case "darwin", "freebsd", "openbsd", "netbsd", "dragonfly":
+		return loginPath, []string{"-fp", "-h", addrPort.Addr().String(), username}, nil
+	default:
+		return "", nil, fmt.Errorf("unsupported Unix platform for login command: %s", runtime.GOOS)
+	}
+}
+
+// getLinuxLoginCmd returns the login command for Linux systems.
+// Handles differences between util-linux and shadow-utils login implementations.
+func (s *Server) getLinuxLoginCmd(loginPath, username, remoteIP string) (string, []string) {
+	// Special handling for Arch Linux without /etc/pam.d/remote
+	var loginArgs []string
+	if s.fileExists("/etc/arch-release") && !s.fileExists("/etc/pam.d/remote") {
+		loginArgs = []string{"-f", username, "-p"}
+	} else {
+		loginArgs = []string{"-f", username, "-h", remoteIP, "-p"}
+	}
+
+	// util-linux login requires setsid -c to create a new session and set the
+	// controlling terminal. Without this, vhangup() kills the parent process.
+	// See https://bugs.debian.org/1078023 for details.
+	// TODO: handle this via the executor using syscall.Setsid() + TIOCSCTTY + syscall.Exec()
+	// to avoid external setsid dependency.
+	if !s.loginIsUtilLinux {
+		return loginPath, loginArgs
+	}
+
+	setsidPath, err := exec.LookPath("setsid")
+	if err != nil {
+		log.Warnf("setsid not available but util-linux login detected, login may fail: %v", err)
+		return loginPath, loginArgs
+	}
+
+	args := append([]string{"-w", "-c", loginPath}, loginArgs...)
+	return setsidPath, args
+}
+
+// fileExists checks if a file exists
+func (s *Server) fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+// parseUserCredentials extracts numeric UID, GID, and supplementary groups
+func (s *Server) parseUserCredentials(localUser *user.User) (uint32, uint32, []uint32, error) {
+	uid64, err := strconv.ParseUint(localUser.Uid, 10, 32)
+	if err != nil {
+		return 0, 0, nil, fmt.Errorf("invalid UID %s: %w", localUser.Uid, err)
+	}
+	uid := uint32(uid64)
+
+	gid64, err := strconv.ParseUint(localUser.Gid, 10, 32)
+	if err != nil {
+		return 0, 0, nil, fmt.Errorf("invalid GID %s: %w", localUser.Gid, err)
+	}
+	gid := uint32(gid64)
+
+	groups, err := s.getSupplementaryGroups(localUser)
+	if err != nil || len(groups) == 0 {
+		if err != nil {
+			log.Warnf("failed to get supplementary groups for user %s: %v", localUser.Username, err)
+		}
+		groups = []uint32{gid}
+	}
+
+	return uid, gid, groups, nil
+}
+
+// getSupplementaryGroups retrieves supplementary group IDs for a user.
+// Uses id/getent fallback for NSS users in CGO_ENABLED=0 builds.
+func (s *Server) getSupplementaryGroups(u *user.User) ([]uint32, error) {
+	groupIDStrings, err := groupIdsWithFallback(u)
+	if err != nil {
+		return nil, fmt.Errorf("get group IDs for user %s: %w", u.Username, err)
+	}
+
+	groups := make([]uint32, len(groupIDStrings))
+	for i, gidStr := range groupIDStrings {
+		gid64, err := strconv.ParseUint(gidStr, 10, 32)
+		if err != nil {
+			return nil, fmt.Errorf("invalid group ID %s for user %s: %w", gidStr, u.Username, err)
+		}
+		groups[i] = uint32(gid64)
+	}
+
+	return groups, nil
+}
+
+// createExecutorCommand creates a command that spawns netbird ssh exec for privilege dropping.
+// Returns the command and a cleanup function (no-op on Unix).
+func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
+	logger.Debugf("creating executor command for user %s (Pty: %v)", localUser.Username, hasPty)
+
+	if err := validateUsername(localUser.Username); err != nil {
+		return nil, nil, fmt.Errorf("invalid username %q: %w", localUser.Username, err)
+	}
+
+	uid, gid, groups, err := s.parseUserCredentials(localUser)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parse user credentials: %w", err)
+	}
+	privilegeDropper := NewPrivilegeDropper(WithLogger(logger))
+	config := ExecutorConfig{
+		UID:        uid,
+		GID:        gid,
+		Groups:     groups,
+		WorkingDir: localUser.HomeDir,
+		Shell:      getUserShell(localUser.Uid),
+		Command:    session.RawCommand(),
+		PTY:        hasPty,
+	}
+
+	cmd, err := privilegeDropper.CreateExecutorCommand(session.Context(), config)
+	return cmd, func() {}, err
+}
+
+// enableUserSwitching is a no-op on Unix systems
+func enableUserSwitching() error {
+	return nil
+}
+
+// createPtyCommand creates the exec.Cmd for Pty execution respecting privilege check results
+func (s *Server) createPtyCommand(privilegeResult PrivilegeCheckResult, ptyReq ssh.Pty, session ssh.Session) (*exec.Cmd, error) {
+	localUser := privilegeResult.User
+	if localUser == nil {
+		return nil, errors.New("no user in privilege result")
+	}
+
+	if privilegeResult.UsedFallback {
+		return s.createDirectPtyCommand(session, localUser, ptyReq), nil
+	}
+
+	return s.createPtyLoginCommand(localUser, ptyReq, session)
+}
+
+// createDirectPtyCommand creates a direct Pty command without privilege dropping
+func (s *Server) createDirectPtyCommand(session ssh.Session, localUser *user.User, ptyReq ssh.Pty) *exec.Cmd {
+	log.Debugf("creating direct Pty command for user %s (no user switching needed)", localUser.Username)
+
+	shell := getUserShell(localUser.Uid)
+	args := s.getShellCommandArgs(shell, session.RawCommand())
+
+	cmd := s.createShellCommand(session.Context(), shell, args)
+	cmd.Dir = localUser.HomeDir
+	cmd.Env = s.preparePtyEnv(localUser, ptyReq, session)
+
+	return cmd
+}
+
+// preparePtyEnv prepares environment variables for Pty execution
+func (s *Server) preparePtyEnv(localUser *user.User, ptyReq ssh.Pty, session ssh.Session) []string {
+	termType := ptyReq.Term
+	if termType == "" {
+		termType = "xterm-256color"
+	}
+
+	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env = append(env, prepareSSHEnv(session)...)
+	env = append(env, fmt.Sprintf("TERM=%s", termType))
+
+	for _, v := range session.Environ() {
+		if acceptEnv(v) {
+			env = append(env, v)
+		}
+	}
+	return env
+}

client/ssh/server/userswitching_windows.go

@@ -0,0 +1,273 @@
+//go:build windows
+
+package server
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+	"os/user"
+	"strings"
+	"unsafe"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// validateUsername validates Windows usernames according to SAM Account Name rules
+func validateUsername(username string) error {
+	if username == "" {
+		return fmt.Errorf("username cannot be empty")
+	}
+
+	usernameToValidate := extractUsernameFromDomain(username)
+
+	if err := validateUsernameLength(usernameToValidate); err != nil {
+		return err
+	}
+
+	if err := validateUsernameCharacters(usernameToValidate); err != nil {
+		return err
+	}
+
+	if err := validateUsernameFormat(usernameToValidate); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// extractUsernameFromDomain extracts the username part from domain\username or username@domain format
+func extractUsernameFromDomain(username string) string {
+	if idx := strings.LastIndex(username, `\`); idx != -1 {
+		return username[idx+1:]
+	}
+	if idx := strings.Index(username, "@"); idx != -1 {
+		return username[:idx]
+	}
+	return username
+}
+
+// validateUsernameLength checks if username length is within Windows limits
+func validateUsernameLength(username string) error {
+	if len(username) > 20 {
+		return fmt.Errorf("username too long (max 20 characters for Windows)")
+	}
+	return nil
+}
+
+// validateUsernameCharacters checks for invalid characters in Windows usernames
+func validateUsernameCharacters(username string) error {
+	invalidChars := []rune{'"', '/', '[', ']', ':', ';', '|', '=', ',', '+', '*', '?', '<', '>', ' ', '`', '&', '\n'}
+	for _, char := range username {
+		for _, invalid := range invalidChars {
+			if char == invalid {
+				return fmt.Errorf("username contains invalid characters")
+			}
+		}
+		if char < 32 || char == 127 {
+			return fmt.Errorf("username contains control characters")
+		}
+	}
+	return nil
+}
+
+// validateUsernameFormat checks for invalid username formats and patterns
+func validateUsernameFormat(username string) error {
+	if username == "." || username == ".." {
+		return fmt.Errorf("username cannot be '.' or '..'")
+	}
+
+	if strings.HasSuffix(username, ".") {
+		return fmt.Errorf("username cannot end with a period")
+	}
+
+	return nil
+}
+
+// createExecutorCommand creates a command using Windows executor for privilege dropping.
+// Returns the command and a cleanup function that must be called after starting the process.
+func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
+	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
+
+	username, _ := s.parseUsername(localUser.Username)
+	if err := validateUsername(username); err != nil {
+		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
+	}
+
+	return s.createUserSwitchCommand(logger, session, localUser)
+}
+
+// createUserSwitchCommand creates a command with Windows user switching.
+// Returns the command and a cleanup function that must be called after starting the process.
+func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
+	username, domain := s.parseUsername(localUser.Username)
+
+	shell := getUserShell(localUser.Uid)
+
+	rawCmd := session.RawCommand()
+	var command string
+	if rawCmd != "" {
+		command = rawCmd
+	}
+
+	config := WindowsExecutorConfig{
+		Username:   username,
+		Domain:     domain,
+		WorkingDir: localUser.HomeDir,
+		Shell:      shell,
+		Command:    command,
+	}
+
+	dropper := NewPrivilegeDropper(WithLogger(logger))
+	cmd, token, err := dropper.CreateWindowsExecutorCommand(session.Context(), config)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cleanup := func() {
+		if token != 0 {
+			if err := windows.CloseHandle(windows.Handle(token)); err != nil {
+				logger.Debugf("close primary token: %v", err)
+			}
+		}
+	}
+
+	return cmd, cleanup, nil
+}
+
+// parseUsername extracts username and domain from a Windows username
+func (s *Server) parseUsername(fullUsername string) (username, domain string) {
+	// Handle DOMAIN\username format
+	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
+		domain = fullUsername[:idx]
+		username = fullUsername[idx+1:]
+		return username, domain
+	}
+
+	// Handle username@domain format
+	if username, domain, ok := strings.Cut(fullUsername, "@"); ok {
+		return username, domain
+	}
+
+	// Local user (no domain)
+	return fullUsername, "."
+}
+
+// hasPrivilege checks if the current process has a specific privilege
+func hasPrivilege(token windows.Handle, privilegeName string) (bool, error) {
+	var luid windows.LUID
+	if err := windows.LookupPrivilegeValue(nil, windows.StringToUTF16Ptr(privilegeName), &luid); err != nil {
+		return false, fmt.Errorf("lookup privilege value: %w", err)
+	}
+
+	var returnLength uint32
+	err := windows.GetTokenInformation(
+		windows.Token(token),
+		windows.TokenPrivileges,
+		nil, // null buffer to get size
+		0,
+		&returnLength,
+	)
+
+	if err != nil && !errors.Is(err, windows.ERROR_INSUFFICIENT_BUFFER) {
+		return false, fmt.Errorf("get token information size: %w", err)
+	}
+
+	buffer := make([]byte, returnLength)
+	err = windows.GetTokenInformation(
+		windows.Token(token),
+		windows.TokenPrivileges,
+		&buffer[0],
+		returnLength,
+		&returnLength,
+	)
+	if err != nil {
+		return false, fmt.Errorf("get token information: %w", err)
+	}
+
+	privileges := (*windows.Tokenprivileges)(unsafe.Pointer(&buffer[0]))
+
+	// Check if the privilege is present and enabled
+	for i := uint32(0); i < privileges.PrivilegeCount; i++ {
+		privilege := (*windows.LUIDAndAttributes)(unsafe.Pointer(
+			uintptr(unsafe.Pointer(&privileges.Privileges[0])) +
+				uintptr(i)*unsafe.Sizeof(windows.LUIDAndAttributes{}),
+		))
+		if privilege.Luid == luid {
+			return (privilege.Attributes & windows.SE_PRIVILEGE_ENABLED) != 0, nil
+		}
+	}
+
+	return false, nil
+}
+
+// enablePrivilege enables a specific privilege for the current process token
+// This is required because privileges like SeAssignPrimaryTokenPrivilege are present
+// but disabled by default, even for the SYSTEM account
+func enablePrivilege(token windows.Handle, privilegeName string) error {
+	var luid windows.LUID
+	if err := windows.LookupPrivilegeValue(nil, windows.StringToUTF16Ptr(privilegeName), &luid); err != nil {
+		return fmt.Errorf("lookup privilege value for %s: %w", privilegeName, err)
+	}
+
+	privileges := windows.Tokenprivileges{
+		PrivilegeCount: 1,
+		Privileges: [1]windows.LUIDAndAttributes{
+			{
+				Luid:       luid,
+				Attributes: windows.SE_PRIVILEGE_ENABLED,
+			},
+		},
+	}
+
+	err := windows.AdjustTokenPrivileges(
+		windows.Token(token),
+		false,
+		&privileges,
+		0,
+		nil,
+		nil,
+	)
+	if err != nil {
+		return fmt.Errorf("adjust token privileges for %s: %w", privilegeName, err)
+	}
+
+	hasPriv, err := hasPrivilege(token, privilegeName)
+	if err != nil {
+		return fmt.Errorf("verify privilege %s after enabling: %w", privilegeName, err)
+	}
+	if !hasPriv {
+		return fmt.Errorf("privilege %s could not be enabled (may not be granted to account)", privilegeName)
+	}
+
+	log.Debugf("Successfully enabled privilege %s for current process", privilegeName)
+	return nil
+}
+
+// enableUserSwitching enables required privileges for Windows user switching
+func enableUserSwitching() error {
+	process := windows.CurrentProcess()
+
+	var token windows.Token
+	err := windows.OpenProcessToken(
+		process,
+		windows.TOKEN_ADJUST_PRIVILEGES|windows.TOKEN_QUERY,
+		&token,
+	)
+	if err != nil {
+		return fmt.Errorf("open process token: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(windows.Handle(token)); err != nil {
+			log.Debugf("Failed to close process token: %v", err)
+		}
+	}()
+
+	if err := enablePrivilege(windows.Handle(token), "SeAssignPrimaryTokenPrivilege"); err != nil {
+		return fmt.Errorf("enable SeAssignPrimaryTokenPrivilege: %w", err)
+	}
+	log.Infof("Windows user switching privileges enabled successfully")
+	return nil
+}

client/ssh/server/winpty/conpty.go

@@ -0,0 +1,487 @@
+//go:build windows
+
+package winpty
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"github.com/gliderlabs/ssh"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	ErrEmptyEnvironment = errors.New("empty environment")
+)
+
+const (
+	extendedStartupInfoPresent       = 0x00080000
+	createUnicodeEnvironment         = 0x00000400
+	procThreadAttributePseudoConsole = 0x00020016
+
+	PowerShellCommandFlag = "-Command"
+
+	errCloseInputRead     = "close input read handle: %v"
+	errCloseConPtyCleanup = "close ConPty handle during cleanup"
+)
+
+// PtyConfig holds configuration for Pty execution.
+type PtyConfig struct {
+	Shell      string
+	Command    string
+	Width      int
+	Height     int
+	WorkingDir string
+}
+
+// UserConfig holds user execution configuration.
+type UserConfig struct {
+	Token       windows.Handle
+	Environment []string
+}
+
+var (
+	kernel32                              = windows.NewLazySystemDLL("kernel32.dll")
+	procClosePseudoConsole                = kernel32.NewProc("ClosePseudoConsole")
+	procInitializeProcThreadAttributeList = kernel32.NewProc("InitializeProcThreadAttributeList")
+	procUpdateProcThreadAttribute         = kernel32.NewProc("UpdateProcThreadAttribute")
+	procDeleteProcThreadAttributeList     = kernel32.NewProc("DeleteProcThreadAttributeList")
+)
+
+// ExecutePtyWithUserToken executes a command with ConPty using user token.
+func ExecutePtyWithUserToken(session ssh.Session, ptyConfig PtyConfig, userConfig UserConfig) error {
+	args := buildShellArgs(ptyConfig.Shell, ptyConfig.Command)
+	commandLine := buildCommandLine(args)
+
+	config := ExecutionConfig{
+		Pty:     ptyConfig,
+		User:    userConfig,
+		Session: session,
+		Context: session.Context(),
+	}
+
+	return executeConPtyWithConfig(commandLine, config)
+}
+
+// ExecutionConfig holds all execution configuration.
+type ExecutionConfig struct {
+	Pty     PtyConfig
+	User    UserConfig
+	Session ssh.Session
+	Context context.Context
+}
+
+// executeConPtyWithConfig creates ConPty and executes process with configuration.
+func executeConPtyWithConfig(commandLine string, config ExecutionConfig) error {
+	ctx := config.Context
+	session := config.Session
+	width := config.Pty.Width
+	height := config.Pty.Height
+	userToken := config.User.Token
+	userEnv := config.User.Environment
+	workingDir := config.Pty.WorkingDir
+
+	inputRead, inputWrite, outputRead, outputWrite, err := createConPtyPipes()
+	if err != nil {
+		return fmt.Errorf("create ConPty pipes: %w", err)
+	}
+
+	hPty, err := createConPty(width, height, inputRead, outputWrite)
+	if err != nil {
+		return fmt.Errorf("create ConPty: %w", err)
+	}
+
+	primaryToken, err := duplicateToPrimaryToken(userToken)
+	if err != nil {
+		if closeErr, _, _ := procClosePseudoConsole.Call(uintptr(hPty)); closeErr == 0 {
+			log.Debugf(errCloseConPtyCleanup)
+		}
+		closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+		return fmt.Errorf("duplicate to primary token: %w", err)
+	}
+	defer func() {
+		if err := windows.CloseHandle(primaryToken); err != nil {
+			log.Debugf("close primary token: %v", err)
+		}
+	}()
+
+	siEx, err := setupConPtyStartupInfo(hPty)
+	if err != nil {
+		if closeErr, _, _ := procClosePseudoConsole.Call(uintptr(hPty)); closeErr == 0 {
+			log.Debugf(errCloseConPtyCleanup)
+		}
+		closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+		return fmt.Errorf("setup startup info: %w", err)
+	}
+	defer func() {
+		_, _, _ = procDeleteProcThreadAttributeList.Call(uintptr(unsafe.Pointer(siEx.ProcThreadAttributeList)))
+	}()
+
+	pi, err := createConPtyProcess(commandLine, primaryToken, userEnv, workingDir, siEx)
+	if err != nil {
+		if closeErr, _, _ := procClosePseudoConsole.Call(uintptr(hPty)); closeErr == 0 {
+			log.Debugf(errCloseConPtyCleanup)
+		}
+		closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+		return fmt.Errorf("create process as user with ConPty: %w", err)
+	}
+	defer closeProcessInfo(pi)
+
+	if err := windows.CloseHandle(inputRead); err != nil {
+		log.Debugf(errCloseInputRead, err)
+	}
+	if err := windows.CloseHandle(outputWrite); err != nil {
+		log.Debugf("close output write handle: %v", err)
+	}
+
+	return bridgeConPtyIO(ctx, hPty, inputWrite, outputRead, session, session, session, pi.Process)
+}
+
+// createConPtyPipes creates input/output pipes for ConPty.
+func createConPtyPipes() (inputRead, inputWrite, outputRead, outputWrite windows.Handle, err error) {
+	if err := windows.CreatePipe(&inputRead, &inputWrite, nil, 0); err != nil {
+		return 0, 0, 0, 0, fmt.Errorf("create input pipe: %w", err)
+	}
+
+	if err := windows.CreatePipe(&outputRead, &outputWrite, nil, 0); err != nil {
+		if closeErr := windows.CloseHandle(inputRead); closeErr != nil {
+			log.Debugf(errCloseInputRead, closeErr)
+		}
+		if closeErr := windows.CloseHandle(inputWrite); closeErr != nil {
+			log.Debugf("close input write handle: %v", closeErr)
+		}
+		return 0, 0, 0, 0, fmt.Errorf("create output pipe: %w", err)
+	}
+
+	return inputRead, inputWrite, outputRead, outputWrite, nil
+}
+
+// createConPty creates a Windows ConPty with the specified size and pipe handles.
+func createConPty(width, height int, inputRead, outputWrite windows.Handle) (windows.Handle, error) {
+	size := windows.Coord{X: int16(width), Y: int16(height)}
+
+	var hPty windows.Handle
+	if err := windows.CreatePseudoConsole(size, inputRead, outputWrite, 0, &hPty); err != nil {
+		return 0, fmt.Errorf("CreatePseudoConsole: %w", err)
+	}
+
+	return hPty, nil
+}
+
+// setupConPtyStartupInfo prepares the STARTUPINFOEX with ConPty attributes.
+func setupConPtyStartupInfo(hPty windows.Handle) (*windows.StartupInfoEx, error) {
+	var siEx windows.StartupInfoEx
+	siEx.StartupInfo.Cb = uint32(unsafe.Sizeof(siEx))
+
+	var attrListSize uintptr
+	ret, _, _ := procInitializeProcThreadAttributeList.Call(0, 1, 0, uintptr(unsafe.Pointer(&attrListSize)))
+	if ret == 0 && attrListSize == 0 {
+		return nil, fmt.Errorf("get attribute list size")
+	}
+
+	attrListBytes := make([]byte, attrListSize)
+	siEx.ProcThreadAttributeList = (*windows.ProcThreadAttributeList)(unsafe.Pointer(&attrListBytes[0]))
+
+	ret, _, err := procInitializeProcThreadAttributeList.Call(
+		uintptr(unsafe.Pointer(siEx.ProcThreadAttributeList)),
+		1,
+		0,
+		uintptr(unsafe.Pointer(&attrListSize)),
+	)
+	if ret == 0 {
+		return nil, fmt.Errorf("initialize attribute list: %w", err)
+	}
+
+	ret, _, err = procUpdateProcThreadAttribute.Call(
+		uintptr(unsafe.Pointer(siEx.ProcThreadAttributeList)),
+		0,
+		procThreadAttributePseudoConsole,
+		uintptr(hPty),
+		unsafe.Sizeof(hPty),
+		0,
+		0,
+	)
+	if ret == 0 {
+		return nil, fmt.Errorf("update thread attribute: %w", err)
+	}
+
+	return &siEx, nil
+}
+
+// createConPtyProcess creates the actual process with ConPty.
+func createConPtyProcess(commandLine string, userToken windows.Handle, userEnv []string, workingDir string, siEx *windows.StartupInfoEx) (*windows.ProcessInformation, error) {
+	var pi windows.ProcessInformation
+	creationFlags := uint32(extendedStartupInfoPresent | createUnicodeEnvironment)
+
+	commandLinePtr, err := windows.UTF16PtrFromString(commandLine)
+	if err != nil {
+		return nil, fmt.Errorf("convert command line to UTF16: %w", err)
+	}
+
+	envPtr, err := convertEnvironmentToUTF16(userEnv)
+	if err != nil {
+		return nil, err
+	}
+
+	var workingDirPtr *uint16
+	if workingDir != "" {
+		workingDirPtr, err = windows.UTF16PtrFromString(workingDir)
+		if err != nil {
+			return nil, fmt.Errorf("convert working directory to UTF16: %w", err)
+		}
+	}
+
+	siEx.StartupInfo.Flags |= windows.STARTF_USESTDHANDLES
+	siEx.StartupInfo.StdInput = windows.Handle(0)
+	siEx.StartupInfo.StdOutput = windows.Handle(0)
+	siEx.StartupInfo.StdErr = siEx.StartupInfo.StdOutput
+
+	if userToken != windows.InvalidHandle {
+		err = windows.CreateProcessAsUser(
+			windows.Token(userToken),
+			nil,
+			commandLinePtr,
+			nil,
+			nil,
+			true,
+			creationFlags,
+			envPtr,
+			workingDirPtr,
+			&siEx.StartupInfo,
+			&pi,
+		)
+	} else {
+		err = windows.CreateProcess(
+			nil,
+			commandLinePtr,
+			nil,
+			nil,
+			true,
+			creationFlags,
+			envPtr,
+			workingDirPtr,
+			&siEx.StartupInfo,
+			&pi,
+		)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("create process: %w", err)
+	}
+
+	return &pi, nil
+}
+
+// convertEnvironmentToUTF16 converts environment variables to Windows UTF16 format.
+func convertEnvironmentToUTF16(userEnv []string) (*uint16, error) {
+	if len(userEnv) == 0 {
+		// Return nil pointer for empty environment - Windows API will inherit parent environment
+		return nil, nil //nolint:nilnil // Intentional nil,nil for empty environment
+	}
+
+	var envUTF16 []uint16
+	for _, envVar := range userEnv {
+		if envVar != "" {
+			utf16Str, err := windows.UTF16FromString(envVar)
+			if err != nil {
+				log.Debugf("skipping invalid environment variable: %s (error: %v)", envVar, err)
+				continue
+			}
+			envUTF16 = append(envUTF16, utf16Str[:len(utf16Str)-1]...)
+			envUTF16 = append(envUTF16, 0)
+		}
+	}
+	envUTF16 = append(envUTF16, 0)
+
+	if len(envUTF16) > 0 {
+		return &envUTF16[0], nil
+	}
+	// Return nil pointer when no valid environment variables found
+	return nil, nil //nolint:nilnil // Intentional nil,nil for empty environment
+}
+
+// duplicateToPrimaryToken converts an impersonation token to a primary token.
+func duplicateToPrimaryToken(token windows.Handle) (windows.Handle, error) {
+	var primaryToken windows.Handle
+	if err := windows.DuplicateTokenEx(
+		windows.Token(token),
+		windows.TOKEN_ALL_ACCESS,
+		nil,
+		windows.SecurityImpersonation,
+		windows.TokenPrimary,
+		(*windows.Token)(&primaryToken),
+	); err != nil {
+		return 0, fmt.Errorf("duplicate token: %w", err)
+	}
+	return primaryToken, nil
+}
+
+// SessionExiter provides the Exit method for reporting process exit status.
+type SessionExiter interface {
+	Exit(code int) error
+}
+
+// bridgeConPtyIO handles I/O bridging between ConPty and readers/writers.
+func bridgeConPtyIO(ctx context.Context, hPty, inputWrite, outputRead windows.Handle, reader io.ReadCloser, writer io.Writer, session SessionExiter, process windows.Handle) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+
+	var wg sync.WaitGroup
+	startIOBridging(ctx, &wg, inputWrite, outputRead, reader, writer)
+
+	processErr := waitForProcess(ctx, process)
+	if processErr != nil {
+		return processErr
+	}
+
+	var exitCode uint32
+	if err := windows.GetExitCodeProcess(process, &exitCode); err != nil {
+		log.Debugf("get exit code: %v", err)
+	} else {
+		if err := session.Exit(int(exitCode)); err != nil {
+			log.Debugf("report exit code: %v", err)
+		}
+	}
+
+	// Clean up in the original order after process completes
+	if err := reader.Close(); err != nil {
+		log.Debugf("close reader: %v", err)
+	}
+
+	ret, _, err := procClosePseudoConsole.Call(uintptr(hPty))
+	if ret == 0 {
+		log.Debugf("close ConPty handle: %v", err)
+	}
+
+	wg.Wait()
+
+	if err := windows.CloseHandle(outputRead); err != nil {
+		log.Debugf("close output read handle: %v", err)
+	}
+
+	return nil
+}
+
+// startIOBridging starts the I/O bridging goroutines.
+func startIOBridging(ctx context.Context, wg *sync.WaitGroup, inputWrite, outputRead windows.Handle, reader io.ReadCloser, writer io.Writer) {
+	wg.Add(2)
+
+	// Input: reader (SSH session) -> inputWrite (ConPty)
+	go func() {
+		defer wg.Done()
+		defer func() {
+			if err := windows.CloseHandle(inputWrite); err != nil {
+				log.Debugf("close input write handle in goroutine: %v", err)
+			}
+		}()
+
+		if _, err := io.Copy(&windowsHandleWriter{handle: inputWrite}, reader); err != nil {
+			log.Debugf("input copy ended with error: %v", err)
+		}
+	}()
+
+	// Output: outputRead (ConPty) -> writer (SSH session)
+	go func() {
+		defer wg.Done()
+		if _, err := io.Copy(writer, &windowsHandleReader{handle: outputRead}); err != nil {
+			log.Debugf("output copy ended with error: %v", err)
+		}
+	}()
+}
+
+// waitForProcess waits for process completion with context cancellation.
+func waitForProcess(ctx context.Context, process windows.Handle) error {
+	if _, err := windows.WaitForSingleObject(process, windows.INFINITE); err != nil {
+		return fmt.Errorf("wait for process %d: %w", process, err)
+	}
+	return nil
+}
+
+// buildShellArgs builds shell arguments for ConPty execution.
+func buildShellArgs(shell, command string) []string {
+	if command != "" {
+		return []string{shell, PowerShellCommandFlag, command}
+	}
+	return []string{shell}
+}
+
+// buildCommandLine builds a Windows command line from arguments using proper escaping.
+func buildCommandLine(args []string) string {
+	if len(args) == 0 {
+		return ""
+	}
+
+	var result strings.Builder
+	for i, arg := range args {
+		if i > 0 {
+			result.WriteString(" ")
+		}
+		result.WriteString(syscall.EscapeArg(arg))
+	}
+	return result.String()
+}
+
+// closeHandles closes multiple Windows handles.
+func closeHandles(handles ...windows.Handle) {
+	for _, handle := range handles {
+		if handle != windows.InvalidHandle {
+			if err := windows.CloseHandle(handle); err != nil {
+				log.Debugf("close handle: %v", err)
+			}
+		}
+	}
+}
+
+// closeProcessInfo closes process and thread handles.
+func closeProcessInfo(pi *windows.ProcessInformation) {
+	if pi != nil {
+		if err := windows.CloseHandle(pi.Process); err != nil {
+			log.Debugf("close process handle: %v", err)
+		}
+		if err := windows.CloseHandle(pi.Thread); err != nil {
+			log.Debugf("close thread handle: %v", err)
+		}
+	}
+}
+
+// windowsHandleReader wraps a Windows handle for reading.
+type windowsHandleReader struct {
+	handle windows.Handle
+}
+
+func (r *windowsHandleReader) Read(p []byte) (n int, err error) {
+	var bytesRead uint32
+	if err := windows.ReadFile(r.handle, p, &bytesRead, nil); err != nil {
+		return 0, err
+	}
+	return int(bytesRead), nil
+}
+
+func (r *windowsHandleReader) Close() error {
+	return windows.CloseHandle(r.handle)
+}
+
+// windowsHandleWriter wraps a Windows handle for writing.
+type windowsHandleWriter struct {
+	handle windows.Handle
+}
+
+func (w *windowsHandleWriter) Write(p []byte) (n int, err error) {
+	var bytesWritten uint32
+	if err := windows.WriteFile(w.handle, p, &bytesWritten, nil); err != nil {
+		return 0, err
+	}
+	return int(bytesWritten), nil
+}
+
+func (w *windowsHandleWriter) Close() error {
+	return windows.CloseHandle(w.handle)
+}

client/ssh/server/winpty/conpty_test.go

@@ -0,0 +1,290 @@
+//go:build windows
+
+package winpty
+
+import (
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+func TestBuildShellArgs(t *testing.T) {
+	tests := []struct {
+		name     string
+		shell    string
+		command  string
+		expected []string
+	}{
+		{
+			name:     "Shell with command",
+			shell:    "powershell.exe",
+			command:  "Get-Process",
+			expected: []string{"powershell.exe", "-Command", "Get-Process"},
+		},
+		{
+			name:     "CMD with command",
+			shell:    "cmd.exe",
+			command:  "dir",
+			expected: []string{"cmd.exe", "-Command", "dir"},
+		},
+		{
+			name:     "Shell interactive",
+			shell:    "powershell.exe",
+			command:  "",
+			expected: []string{"powershell.exe"},
+		},
+		{
+			name:     "CMD interactive",
+			shell:    "cmd.exe",
+			command:  "",
+			expected: []string{"cmd.exe"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := buildShellArgs(tt.shell, tt.command)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestBuildCommandLine(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		expected string
+	}{
+		{
+			name:     "Simple args",
+			args:     []string{"cmd.exe", "/c", "echo"},
+			expected: "cmd.exe /c echo",
+		},
+		{
+			name:     "Args with spaces",
+			args:     []string{"Program Files\\app.exe", "arg with spaces"},
+			expected: `"Program Files\app.exe" "arg with spaces"`,
+		},
+		{
+			name:     "Args with quotes",
+			args:     []string{"cmd.exe", "/c", `echo "hello world"`},
+			expected: `cmd.exe /c "echo \"hello world\""`,
+		},
+		{
+			name:     "PowerShell calling PowerShell",
+			args:     []string{"powershell.exe", "-Command", `powershell.exe -Command "Get-Process | Where-Object {$_.Name -eq 'notepad'}"`},
+			expected: `powershell.exe -Command "powershell.exe -Command \"Get-Process | Where-Object {$_.Name -eq 'notepad'}\""`,
+		},
+		{
+			name:     "Complex nested quotes",
+			args:     []string{"cmd.exe", "/c", `echo "He said \"Hello\" to me"`},
+			expected: `cmd.exe /c "echo \"He said \\\"Hello\\\" to me\""`,
+		},
+		{
+			name:     "Path with spaces and args",
+			args:     []string{`C:\Program Files\MyApp\app.exe`, "--config", `C:\My Config\settings.json`},
+			expected: `"C:\Program Files\MyApp\app.exe" --config "C:\My Config\settings.json"`,
+		},
+		{
+			name:     "Empty argument",
+			args:     []string{"cmd.exe", "/c", "echo", ""},
+			expected: `cmd.exe /c echo ""`,
+		},
+		{
+			name:     "Argument with backslashes",
+			args:     []string{"robocopy", `C:\Source\`, `C:\Dest\`, "/E"},
+			expected: `robocopy C:\Source\ C:\Dest\ /E`,
+		},
+		{
+			name:     "Empty args",
+			args:     []string{},
+			expected: "",
+		},
+		{
+			name:     "Single arg with space",
+			args:     []string{"path with spaces"},
+			expected: `"path with spaces"`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := buildCommandLine(tt.args)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestCreateConPtyPipes(t *testing.T) {
+	inputRead, inputWrite, outputRead, outputWrite, err := createConPtyPipes()
+	require.NoError(t, err, "Should create ConPty pipes successfully")
+
+	// Verify all handles are valid
+	assert.NotEqual(t, windows.InvalidHandle, inputRead, "Input read handle should be valid")
+	assert.NotEqual(t, windows.InvalidHandle, inputWrite, "Input write handle should be valid")
+	assert.NotEqual(t, windows.InvalidHandle, outputRead, "Output read handle should be valid")
+	assert.NotEqual(t, windows.InvalidHandle, outputWrite, "Output write handle should be valid")
+
+	// Clean up handles
+	closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+}
+
+func TestCreateConPty(t *testing.T) {
+	inputRead, inputWrite, outputRead, outputWrite, err := createConPtyPipes()
+	require.NoError(t, err, "Should create ConPty pipes successfully")
+	defer closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+
+	hPty, err := createConPty(80, 24, inputRead, outputWrite)
+	require.NoError(t, err, "Should create ConPty successfully")
+	assert.NotEqual(t, windows.InvalidHandle, hPty, "ConPty handle should be valid")
+
+	// Clean up ConPty
+	ret, _, _ := procClosePseudoConsole.Call(uintptr(hPty))
+	assert.NotEqual(t, uintptr(0), ret, "Should close ConPty successfully")
+}
+
+func TestConvertEnvironmentToUTF16(t *testing.T) {
+	tests := []struct {
+		name     string
+		userEnv  []string
+		hasError bool
+	}{
+		{
+			name:     "Valid environment variables",
+			userEnv:  []string{"PATH=C:\\Windows", "USER=testuser", "HOME=C:\\Users\\testuser"},
+			hasError: false,
+		},
+		{
+			name:     "Empty environment",
+			userEnv:  []string{},
+			hasError: false,
+		},
+		{
+			name:     "Environment with empty strings",
+			userEnv:  []string{"PATH=C:\\Windows", "", "USER=testuser"},
+			hasError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := convertEnvironmentToUTF16(tt.userEnv)
+			if tt.hasError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				if len(tt.userEnv) == 0 {
+					assert.Nil(t, result, "Empty environment should return nil")
+				} else {
+					assert.NotNil(t, result, "Non-empty environment should return valid pointer")
+				}
+			}
+		})
+	}
+}
+
+func TestDuplicateToPrimaryToken(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping token tests in short mode")
+	}
+
+	// Get current process token for testing
+	var token windows.Token
+	err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_ALL_ACCESS, &token)
+	require.NoError(t, err, "Should open current process token")
+	defer func() {
+		if err := windows.CloseHandle(windows.Handle(token)); err != nil {
+			t.Logf("Failed to close token: %v", err)
+		}
+	}()
+
+	primaryToken, err := duplicateToPrimaryToken(windows.Handle(token))
+	require.NoError(t, err, "Should duplicate token to primary")
+	assert.NotEqual(t, windows.InvalidHandle, primaryToken, "Primary token should be valid")
+
+	// Clean up
+	err = windows.CloseHandle(primaryToken)
+	assert.NoError(t, err, "Should close primary token")
+}
+
+func TestWindowsHandleReader(t *testing.T) {
+	// Create a pipe for testing
+	var readHandle, writeHandle windows.Handle
+	err := windows.CreatePipe(&readHandle, &writeHandle, nil, 0)
+	require.NoError(t, err, "Should create pipe for testing")
+	defer closeHandles(readHandle, writeHandle)
+
+	// Write test data
+	testData := []byte("Hello, Windows Handle Reader!")
+	var bytesWritten uint32
+	err = windows.WriteFile(writeHandle, testData, &bytesWritten, nil)
+	require.NoError(t, err, "Should write test data")
+	require.Equal(t, uint32(len(testData)), bytesWritten, "Should write all test data")
+
+	// Close write handle to signal EOF
+	if err := windows.CloseHandle(writeHandle); err != nil {
+		t.Fatalf("Should close write handle: %v", err)
+	}
+	writeHandle = windows.InvalidHandle
+
+	// Test reading
+	reader := &windowsHandleReader{handle: readHandle}
+	buffer := make([]byte, len(testData))
+	n, err := reader.Read(buffer)
+	require.NoError(t, err, "Should read from handle")
+	assert.Equal(t, len(testData), n, "Should read expected number of bytes")
+	assert.Equal(t, testData, buffer, "Should read expected data")
+}
+
+func TestWindowsHandleWriter(t *testing.T) {
+	// Create a pipe for testing
+	var readHandle, writeHandle windows.Handle
+	err := windows.CreatePipe(&readHandle, &writeHandle, nil, 0)
+	require.NoError(t, err, "Should create pipe for testing")
+	defer closeHandles(readHandle, writeHandle)
+
+	// Test writing
+	testData := []byte("Hello, Windows Handle Writer!")
+	writer := &windowsHandleWriter{handle: writeHandle}
+	n, err := writer.Write(testData)
+	require.NoError(t, err, "Should write to handle")
+	assert.Equal(t, len(testData), n, "Should write expected number of bytes")
+
+	// Close write handle
+	if err := windows.CloseHandle(writeHandle); err != nil {
+		t.Fatalf("Should close write handle: %v", err)
+	}
+
+	// Verify data was written by reading it back
+	buffer := make([]byte, len(testData))
+	var bytesRead uint32
+	err = windows.ReadFile(readHandle, buffer, &bytesRead, nil)
+	require.NoError(t, err, "Should read back written data")
+	assert.Equal(t, uint32(len(testData)), bytesRead, "Should read back expected number of bytes")
+	assert.Equal(t, testData, buffer, "Should read back expected data")
+}
+
+// BenchmarkConPtyCreation benchmarks ConPty creation performance
+func BenchmarkConPtyCreation(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		inputRead, inputWrite, outputRead, outputWrite, err := createConPtyPipes()
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		hPty, err := createConPty(80, 24, inputRead, outputWrite)
+		if err != nil {
+			closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+			b.Fatal(err)
+		}
+
+		// Clean up
+		if ret, _, err := procClosePseudoConsole.Call(uintptr(hPty)); ret == 0 {
+			log.Debugf("ClosePseudoConsole failed: %v", err)
+		}
+		closeHandles(inputRead, inputWrite, outputRead, outputWrite)
+	}
+}

client/ssh/server_mock.go

@@ -1,46 +0,0 @@
-//go:build !js
-
-package ssh
-
-import "context"
-
-// MockServer mocks ssh.Server
-type MockServer struct {
-	Ctx                     context.Context
-	StopFunc                func() error
-	StartFunc               func() error
-	AddAuthorizedKeyFunc    func(peer, newKey string) error
-	RemoveAuthorizedKeyFunc func(peer string)
-}
-
-// RemoveAuthorizedKey removes SSH key of a given peer from the authorized keys
-func (srv *MockServer) RemoveAuthorizedKey(peer string) {
-	if srv.RemoveAuthorizedKeyFunc == nil {
-		return
-	}
-	srv.RemoveAuthorizedKeyFunc(peer)
-}
-
-// AddAuthorizedKey add a given peer key to server authorized keys
-func (srv *MockServer) AddAuthorizedKey(peer, newKey string) error {
-	if srv.AddAuthorizedKeyFunc == nil {
-		return nil
-	}
-	return srv.AddAuthorizedKeyFunc(peer, newKey)
-}
-
-// Stop stops SSH server.
-func (srv *MockServer) Stop() error {
-	if srv.StopFunc == nil {
-		return nil
-	}
-	return srv.StopFunc()
-}
-
-// Start starts SSH server. Blocking
-func (srv *MockServer) Start() error {
-	if srv.StartFunc == nil {
-		return nil
-	}
-	return srv.StartFunc()
-}

client/ssh/server_test.go

@@ -1,123 +0,0 @@
-//go:build !js
-
-package ssh
-
-import (
-	"fmt"
-	"github.com/stretchr/testify/assert"
-	"golang.org/x/crypto/ssh"
-	"strings"
-	"testing"
-)
-
-func TestServer_AddAuthorizedKey(t *testing.T) {
-	key, err := GeneratePrivateKey(ED25519)
-	if err != nil {
-		t.Fatal(err)
-	}
-	server, err := newDefaultServer(key, "localhost:")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// add multiple keys
-	keys := map[string][]byte{}
-	for i := 0; i < 10; i++ {
-		peer := fmt.Sprintf("%s-%d", "remotePeer", i)
-		remotePrivKey, err := GeneratePrivateKey(ED25519)
-		if err != nil {
-			t.Fatal(err)
-		}
-		remotePubKey, err := GeneratePublicKey(remotePrivKey)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		err = server.AddAuthorizedKey(peer, string(remotePubKey))
-		if err != nil {
-			t.Error(err)
-		}
-		keys[peer] = remotePubKey
-	}
-
-	// make sure that all keys have been added
-	for peer, remotePubKey := range keys {
-		k, ok := server.authorizedKeys[peer]
-		assert.True(t, ok, "expecting remotePeer key to be found in authorizedKeys")
-
-		assert.Equal(t, string(remotePubKey), strings.TrimSpace(string(ssh.MarshalAuthorizedKey(k))))
-	}
-
-}
-
-func TestServer_RemoveAuthorizedKey(t *testing.T) {
-	key, err := GeneratePrivateKey(ED25519)
-	if err != nil {
-		t.Fatal(err)
-	}
-	server, err := newDefaultServer(key, "localhost:")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	remotePrivKey, err := GeneratePrivateKey(ED25519)
-	if err != nil {
-		t.Fatal(err)
-	}
-	remotePubKey, err := GeneratePublicKey(remotePrivKey)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = server.AddAuthorizedKey("remotePeer", string(remotePubKey))
-	if err != nil {
-		t.Error(err)
-	}
-
-	server.RemoveAuthorizedKey("remotePeer")
-
-	_, ok := server.authorizedKeys["remotePeer"]
-	assert.False(t, ok, "expecting remotePeer's SSH key to be removed")
-}
-
-func TestServer_PubKeyHandler(t *testing.T) {
-	key, err := GeneratePrivateKey(ED25519)
-	if err != nil {
-		t.Fatal(err)
-	}
-	server, err := newDefaultServer(key, "localhost:")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var keys []ssh.PublicKey
-	for i := 0; i < 10; i++ {
-		peer := fmt.Sprintf("%s-%d", "remotePeer", i)
-		remotePrivKey, err := GeneratePrivateKey(ED25519)
-		if err != nil {
-			t.Fatal(err)
-		}
-		remotePubKey, err := GeneratePublicKey(remotePrivKey)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		remoteParsedPubKey, _, _, _, err := ssh.ParseAuthorizedKey(remotePubKey)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		err = server.AddAuthorizedKey(peer, string(remotePubKey))
-		if err != nil {
-			t.Error(err)
-		}
-		keys = append(keys, remoteParsedPubKey)
-	}
-
-	for _, key := range keys {
-		accepted := server.publicKeyHandler(nil, key)
-
-		assert.Truef(t, accepted, "expecting SSH connection to be accepted for a given SSH key %s", string(ssh.MarshalAuthorizedKey(key)))
-	}
-
-}

client/ssh/ssh.go

@@ -32,9 +32,8 @@ const RSA KeyType = "rsa"
 // RSAKeySize is a size of newly generated RSA key
 const RSAKeySize = 2048
 
-// GeneratePrivateKey creates RSA Private Key of specified byte size
+// GeneratePrivateKey creates a private key of the specified type.
 func GeneratePrivateKey(keyType KeyType) ([]byte, error) {
-
 	var key crypto.Signer
 	var err error
 	switch keyType {
@@ -59,7 +58,7 @@ func GeneratePrivateKey(keyType KeyType) ([]byte, error) {
 	return pemBytes, nil
 }
 
-// GeneratePublicKey returns the public part of the private key
+// GeneratePublicKey returns the public part of the private key.
 func GeneratePublicKey(key []byte) ([]byte, error) {
 	signer, err := gossh.ParsePrivateKey(key)
 	if err != nil {
@@ -70,20 +69,17 @@ func GeneratePublicKey(key []byte) ([]byte, error) {
 	return []byte(strKey), nil
 }
 
-// EncodePrivateKeyToPEM encodes Private Key from RSA to PEM format
+// EncodePrivateKeyToPEM encodes a private key to PEM format.
 func EncodePrivateKeyToPEM(privateKey crypto.Signer) ([]byte, error) {
 	mk, err := x509.MarshalPKCS8PrivateKey(privateKey)
 	if err != nil {
 		return nil, err
 	}
 
-	// pem.Block
 	privBlock := pem.Block{
 		Type:  "PRIVATE KEY",
 		Bytes: mk,
 	}
-
-	// Private key in PEM format
 	privatePEM := pem.EncodeToMemory(&privBlock)
 	return privatePEM, nil
 }

client/ssh/testutil/user_helpers.go

@@ -0,0 +1,173 @@
+package testutil
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+var testCreatedUsers = make(map[string]bool)
+var testUsersToCleanup []string
+
+// GetTestUsername returns an appropriate username for testing
+func GetTestUsername(t *testing.T) string {
+	if runtime.GOOS == "windows" {
+		currentUser, err := user.Current()
+		require.NoError(t, err, "Should be able to get current user")
+
+		if IsSystemAccount(currentUser.Username) {
+			if IsCI() {
+				if testUser := GetOrCreateTestUser(t); testUser != "" {
+					return testUser
+				}
+			} else {
+				if _, err := user.Lookup("Administrator"); err == nil {
+					return "Administrator"
+				}
+				if testUser := GetOrCreateTestUser(t); testUser != "" {
+					return testUser
+				}
+			}
+		}
+		return currentUser.Username
+	}
+
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+	return currentUser.Username
+}
+
+// IsCI checks if we're running in a CI environment
+func IsCI() bool {
+	if os.Getenv("GITHUB_ACTIONS") == "true" || os.Getenv("CI") == "true" {
+		return true
+	}
+
+	hostname, err := os.Hostname()
+	if err == nil && strings.HasPrefix(hostname, "runner") {
+		return true
+	}
+
+	return false
+}
+
+// IsSystemAccount checks if the user is a system account that can't authenticate
+func IsSystemAccount(username string) bool {
+	systemAccounts := []string{
+		"system",
+		"NT AUTHORITY\\SYSTEM",
+		"NT AUTHORITY\\LOCAL SERVICE",
+		"NT AUTHORITY\\NETWORK SERVICE",
+	}
+
+	for _, sysAccount := range systemAccounts {
+		if strings.EqualFold(username, sysAccount) {
+			return true
+		}
+	}
+
+	return strings.HasSuffix(username, "$")
+}
+
+// RegisterTestUserCleanup registers a test user for cleanup
+func RegisterTestUserCleanup(username string) {
+	if !testCreatedUsers[username] {
+		testCreatedUsers[username] = true
+		testUsersToCleanup = append(testUsersToCleanup, username)
+	}
+}
+
+// CleanupTestUsers removes all created test users
+func CleanupTestUsers() {
+	for _, username := range testUsersToCleanup {
+		RemoveWindowsTestUser(username)
+	}
+	testUsersToCleanup = nil
+	testCreatedUsers = make(map[string]bool)
+}
+
+// GetOrCreateTestUser creates a test user on Windows if needed
+func GetOrCreateTestUser(t *testing.T) string {
+	testUsername := "netbird-test-user"
+
+	if _, err := user.Lookup(testUsername); err == nil {
+		return testUsername
+	}
+
+	if CreateWindowsTestUser(t, testUsername) {
+		RegisterTestUserCleanup(testUsername)
+		return testUsername
+	}
+
+	return ""
+}
+
+// RemoveWindowsTestUser removes a local user on Windows using PowerShell
+func RemoveWindowsTestUser(username string) {
+	if runtime.GOOS != "windows" {
+		return
+	}
+
+	psCmd := fmt.Sprintf(`
+		try {
+			Remove-LocalUser -Name "%s" -ErrorAction Stop
+			Write-Output "User removed successfully"
+		} catch {
+			if ($_.Exception.Message -like "*cannot be found*") {
+				Write-Output "User not found (already removed)"
+			} else {
+				Write-Error $_.Exception.Message
+			}
+		}
+	`, username)
+
+	cmd := exec.Command("powershell", "-Command", psCmd)
+	output, err := cmd.CombinedOutput()
+
+	if err != nil {
+		log.Printf("Failed to remove test user %s: %v, output: %s", username, err, string(output))
+	} else {
+		log.Printf("Test user %s cleanup result: %s", username, string(output))
+	}
+}
+
+// CreateWindowsTestUser creates a local user on Windows using PowerShell
+func CreateWindowsTestUser(t *testing.T, username string) bool {
+	if runtime.GOOS != "windows" {
+		return false
+	}
+
+	psCmd := fmt.Sprintf(`
+		try {
+			$password = ConvertTo-SecureString "TestPassword123!" -AsPlainText -Force
+			New-LocalUser -Name "%s" -Password $password -Description "NetBird test user" -UserMayNotChangePassword -PasswordNeverExpires
+			Add-LocalGroupMember -Group "Users" -Member "%s"
+			Write-Output "User created successfully"
+		} catch {
+			if ($_.Exception.Message -like "*already exists*") {
+				Write-Output "User already exists"
+			} else {
+				Write-Error $_.Exception.Message
+				exit 1
+			}
+		}
+	`, username, username)
+
+	cmd := exec.Command("powershell", "-Command", psCmd)
+	output, err := cmd.CombinedOutput()
+
+	if err != nil {
+		t.Logf("Failed to create test user: %v, output: %s", err, string(output))
+		return false
+	}
+
+	t.Logf("Test user creation result: %s", string(output))
+	return true
+}

client/ssh/testutil/user_helpers_test.go

@@ -0,0 +1,115 @@
+package testutil
+
+import (
+	"os/user"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestUserCurrentBehavior validates user.Current() behavior on Windows.
+// When running as SYSTEM on a domain-joined machine, user.Current() returns:
+// - Username: Computer account name (e.g., "DOMAIN\MACHINE$")
+// - SID: SYSTEM SID (S-1-5-18)
+func TestUserCurrentBehavior(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows-specific test")
+	}
+
+	currentUser, err := user.Current()
+	require.NoError(t, err, "Should be able to get current user")
+
+	t.Logf("Current user - Username: %s, SID: %s", currentUser.Username, currentUser.Uid)
+
+	// When running as SYSTEM, validate expected behavior
+	if currentUser.Uid == "S-1-5-18" {
+		t.Run("SYSTEM_account_behavior", func(t *testing.T) {
+			// SID must be S-1-5-18 for SYSTEM
+			require.Equal(t, "S-1-5-18", currentUser.Uid,
+				"SYSTEM account must have SID S-1-5-18")
+
+			// Username can be either "NT AUTHORITY\SYSTEM" (standalone)
+			// or "DOMAIN\MACHINE$" (domain-joined)
+			username := currentUser.Username
+			isNTAuthority := strings.Contains(strings.ToUpper(username), "NT AUTHORITY")
+			isComputerAccount := strings.HasSuffix(username, "$")
+
+			assert.True(t, isNTAuthority || isComputerAccount,
+				"Username should be either 'NT AUTHORITY\\SYSTEM' or computer account (ending with $), got: %s",
+				username)
+
+			if isComputerAccount {
+				t.Logf("SYSTEM as computer account: %s", username)
+			} else if isNTAuthority {
+				t.Logf("SYSTEM as NT AUTHORITY\\SYSTEM")
+			}
+		})
+	}
+
+	// Validate that IsSystemAccount correctly identifies system accounts
+	t.Run("IsSystemAccount_validation", func(t *testing.T) {
+		// Test with current user if it's a system account
+		if currentUser.Uid == "S-1-5-18" || // SYSTEM
+			currentUser.Uid == "S-1-5-19" || // LOCAL SERVICE
+			currentUser.Uid == "S-1-5-20" { // NETWORK SERVICE
+
+			result := IsSystemAccount(currentUser.Username)
+			assert.True(t, result,
+				"IsSystemAccount should recognize system account: %s (SID: %s)",
+				currentUser.Username, currentUser.Uid)
+		}
+
+		// Test explicit cases
+		testCases := []struct {
+			username string
+			expected bool
+			reason   string
+		}{
+			{"NT AUTHORITY\\SYSTEM", true, "NT AUTHORITY\\SYSTEM"},
+			{"system", true, "system"},
+			{"SYSTEM", true, "SYSTEM (case insensitive)"},
+			{"NT AUTHORITY\\LOCAL SERVICE", true, "LOCAL SERVICE"},
+			{"NT AUTHORITY\\NETWORK SERVICE", true, "NETWORK SERVICE"},
+			{"DOMAIN\\MACHINE$", true, "computer account (ends with $)"},
+			{"WORKGROUP\\WIN2K19-C2$", true, "computer account (ends with $)"},
+			{"Administrator", false, "Administrator is not a system account"},
+			{"alice", false, "regular user"},
+			{"DOMAIN\\alice", false, "domain user"},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.username, func(t *testing.T) {
+				result := IsSystemAccount(tc.username)
+				assert.Equal(t, tc.expected, result,
+					"IsSystemAccount(%q) should be %v because: %s",
+					tc.username, tc.expected, tc.reason)
+			})
+		}
+	})
+}
+
+// TestComputerAccountDetection validates computer account detection.
+func TestComputerAccountDetection(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows-specific test")
+	}
+
+	computerAccounts := []string{
+		"MACHINE$",
+		"WIN2K19-C2$",
+		"DOMAIN\\MACHINE$",
+		"WORKGROUP\\SERVER$",
+		"server.domain.com$",
+	}
+
+	for _, account := range computerAccounts {
+		t.Run(account, func(t *testing.T) {
+			result := IsSystemAccount(account)
+			assert.True(t, result,
+				"Computer account %q should be recognized as system account", account)
+		})
+	}
+}

client/ssh/window_freebsd.go

@@ -1,10 +0,0 @@
-//go:build freebsd
-
-package ssh
-
-import (
-	"os"
-)
-
-func setWinSize(file *os.File, width, height int) {
-}

client/ssh/window_unix.go

@@ -1,14 +0,0 @@
-//go:build linux || darwin
-
-package ssh
-
-import (
-	"os"
-	"syscall"
-	"unsafe"
-)
-
-func setWinSize(file *os.File, width, height int) {
-	syscall.Syscall(syscall.SYS_IOCTL, file.Fd(), uintptr(syscall.TIOCSWINSZ), //nolint
-		uintptr(unsafe.Pointer(&struct{ h, w, x, y uint16 }{uint16(height), uint16(width), 0, 0})))
-}

client/ssh/window_windows.go

@@ -1,9 +0,0 @@
-package ssh
-
-import (
-	"os"
-)
-
-func setWinSize(file *os.File, width, height int) {
-
-}