WIP: acl interceptor and named pipe ui

client/android/profile_manager.go

@@ -145,7 +145,7 @@ func (pm *ProfileManager) SwitchProfile(id string) error {
 // AddProfile creates a new profile
 func (pm *ProfileManager) AddProfile(profileName string) error {
 	// Use ServiceManager (creates profile in profiles/ directory)
-	profile, err := pm.serviceMgr.AddProfile(profileName, androidUsername)
+	profile, err := pm.serviceMgr.AddProfile(profileName, androidUsername, nil)
 	if err != nil {
 		return fmt.Errorf("failed to add profile: %w", err)
 	}

client/cmd/owner.go

@@ -0,0 +1,115 @@
+package cmd
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+var ownerCmd = &cobra.Command{
+	Use:   "owner",
+	Short: "Manage who may control the active NetBird profile",
+	Long: `Manage the owners of the active profile's daemon control channel.
+
+Ownership is enforced per profile: an isolated profile can only be controlled by
+its owner principals (plus root/administrator). A new profile is automatically
+owned by its creator; an unowned profile is claimed by the first caller.`,
+}
+
+var ownerAddCmd = &cobra.Command{
+	Use:   "add <principal>",
+	Short: "Add an owner principal to the active profile",
+	Long: `Add an owner principal to the active profile. Principals are typed:
+  uid:1000               a Unix user ID
+  gid:1000               a Unix group ID
+  group:netbird-admins   a Unix group name (resolved via NSS/getent)
+  sid:S-1-5-21-...       a Windows user or group SID
+
+Requires root/administrator or an existing owner.`,
+	Args: cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.AddOwner(ctx, &proto.AddOwnerRequest{Principal: args[0]}); err != nil {
+				return err
+			}
+			cmd.Printf("Added owner %q to the active profile\n", args[0])
+			return nil
+		})
+	},
+}
+
+var ownerResetCmd = &cobra.Command{
+	Use:   "reset",
+	Short: "Clear the active profile's owner list (root/administrator only)",
+	Long: `Clear the active profile's owner list, returning it to the unowned
+state. The next caller then claims ownership (trust-on-first-use). Requires
+root/administrator.`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ResetOwner(ctx, &proto.ResetOwnerRequest{}); err != nil {
+				return err
+			}
+			cmd.Println("Owner list cleared; the next caller will claim ownership")
+			return nil
+		})
+	},
+}
+
+var ownerShareCmd = &cobra.Command{
+	Use:   "share",
+	Short: "Mark the active profile shared (any local user may control it)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ShareProfile(ctx, &proto.ShareProfileRequest{Shared: true}); err != nil {
+				return err
+			}
+			cmd.Println("Active profile is now shared with all local users")
+			return nil
+		})
+	},
+}
+
+var ownerUnshareCmd = &cobra.Command{
+	Use:   "unshare",
+	Short: "Stop sharing the active profile (restrict to its owners)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return withDaemon(cmd, func(ctx context.Context, c proto.DaemonServiceClient) error {
+			if _, err := c.ShareProfile(ctx, &proto.ShareProfileRequest{Shared: false}); err != nil {
+				return err
+			}
+			cmd.Println("Active profile is no longer shared")
+			return nil
+		})
+	},
+}
+
+// withDaemon runs fn with a connected daemon client, handling setup and teardown.
+func withDaemon(cmd *cobra.Command, fn func(context.Context, proto.DaemonServiceClient) error) error {
+	SetFlagsFromEnvVars(rootCmd)
+	cmd.SetOut(cmd.OutOrStdout())
+	if err := util.InitLog(logLevel, util.LogConsole); err != nil {
+		log.Errorf("failed initializing log %v", err)
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(cmd.Context(), 20*time.Second)
+	defer cancel()
+
+	conn, err := DialClientGRPCServer(ctx, daemonAddr)
+	if err != nil {
+		log.Errorf("failed to connect to service CLI interface %v", err)
+		return err
+	}
+	defer func() {
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon connection: %v", cerr)
+		}
+	}()
+
+	return fn(ctx, proto.NewDaemonServiceClient(conn))
+}

client/cmd/root.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"net"
 	"os"
 	"os/signal"
 	"path"
@@ -143,10 +144,12 @@ func init() {
 
 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
+		// Named pipe (not loopback TCP): the pipe client token carries the
+		// caller's SID so the daemon can authorize each RPC by caller identity.
+		defaultDaemonAddr = "npipe://netbird"
 	}
 
-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -172,6 +175,9 @@ func init() {
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
 
+	rootCmd.AddCommand(ownerCmd)
+	ownerCmd.AddCommand(ownerAddCmd, ownerResetCmd, ownerShareCmd, ownerUnshareCmd)
+
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
 
@@ -265,16 +271,28 @@ func FlagNameToEnvVar(cmdFlag string, prefix string) string {
 }
 
 // DialClientGRPCServer returns client connection to the daemon server.
-func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, error) {
+func DialClientGRPCServer(ctx context.Context, addr string, opts ...grpc.DialOption) (*grpc.ClientConn, error) {
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()
 
-	return grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(addr, "tcp://"),
+	opts = append([]grpc.DialOption{
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-	)
+		grpc.WithBlock()}, opts...)
+
+	// The daemon reads the caller's kernel identity from the transport
+	// (SO_PEERCRED on a Unix socket, the client token on a Windows named pipe),
+	// so the client stays insecure. For npipe we install a context dialer since
+	// gRPC's resolver does not understand Windows named pipes.
+	target := strings.TrimPrefix(addr, "tcp://")
+	if strings.HasPrefix(addr, "npipe://") {
+		path := pipePath(strings.TrimPrefix(addr, "npipe://"))
+		opts = append(opts, grpc.WithContextDialer(func(dialCtx context.Context, _ string) (net.Conn, error) {
+			return dialNamedPipe(dialCtx, path)
+		}))
+		target = "passthrough:///netbird-daemon-pipe"
+	}
+
+	return grpc.DialContext(ctx, target, opts...)
 }
 
 // WithBackOff execute function in backoff cycle.

client/cmd/service_controller.go

@@ -5,6 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"runtime"
 	"time"
 
 	"github.com/kardianos/service"
@@ -13,12 +14,36 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
 
+// daemonServerOptions installs peer-identity transport credentials and the
+// authorization interceptor on the daemon control channel. Identity is only
+// available over a Unix socket (SO_PEERCRED) or a Windows named pipe (client
+// token); over TCP, or on platforms without a peer-credential primitive, the
+// daemon runs without per-caller authorization and warns (no interceptor, so it
+// does not deny everyone).
+func daemonServerOptions(network string, interceptor *ipcauth.Interceptor) []grpc.ServerOption {
+	creds := ipcauth.NewTransportCredentials()
+	if creds == nil {
+		log.Warnf("daemon control channel has no peer-identity primitive on %s; per-caller authorization is disabled", runtime.GOOS)
+		return nil
+	}
+	if network == "tcp" {
+		log.Warnf("daemon is listening on TCP (%s); peer identity cannot be authenticated over TCP, per-caller authorization is disabled", daemonAddr)
+		return nil
+	}
+	return []grpc.ServerOption{
+		grpc.Creds(creds),
+		grpc.ChainUnaryInterceptor(interceptor.UnaryServerInterceptor()),
+		grpc.ChainStreamInterceptor(interceptor.StreamServerInterceptor()),
+	}
+}
+
 func validateJSONSocketFlags() error {
 	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
 		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
@@ -37,8 +62,19 @@ func (p *program) Start(svc service.Service) error {
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
-	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
-	p.serv = grpc.NewServer()
+	network, _, err := parseListenAddress(daemonAddr)
+	if err != nil {
+		return fmt.Errorf("parse daemon address: %w", err)
+	}
+
+	// Owner-authorization interceptor. The ConfigAdapter is a lazy bridge: the
+	// gRPC server is built before the daemon server instance exists, so we set
+	// the real policy backend below once serverInstance is created.
+	ownerAdapter := &ipcauth.ConfigAdapter{}
+	authInterceptor := ipcauth.NewInterceptor(ownerAdapter, ipcauth.NewDefaultGroupResolver())
+
+	// in any case, even if configuration does not exist we run daemon to serve the CLI gRPC API.
+	p.serv = grpc.NewServer(daemonServerOptions(network, authInterceptor)...)
 
 	daemonListener, err := listenOnAddress(daemonAddr)
 	if err != nil {
@@ -77,6 +113,7 @@ func (p *program) Start(svc service.Service) error {
 		if err := serverInstance.Start(); err != nil {
 			log.Fatalf("failed to start daemon: %v", err)
 		}
+		ownerAdapter.SetBackend(serverInstance)
 		proto.RegisterDaemonServiceServer(p.serv, serverInstance)
 
 		p.serverInstanceMu.Lock()
@@ -84,6 +121,7 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstanceMu.Unlock()
 
 		if jsonListener != nil {
+			log.Warnf("JSON gateway (--enable-json-socket) re-dials the daemon locally; the HTTP client's identity is forwarded so per-caller authorization still applies, but restrict access to %s appropriately", jsonSocket)
 			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
 				log.Fatalf("failed to start daemon JSON server: %v", err)
 			}

client/cmd/service_json_gateway.go

@@ -14,16 +14,45 @@ import (
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
 
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
+// jsonPeerCtxKey keys the HTTP client's kernel identity in the request context.
+type jsonPeerCtxKey struct{}
+
+// jsonConnContext reads the connecting HTTP client's identity from the JSON
+// socket (peercred) and stashes it so it can be forwarded to the daemon. The
+// gateway re-dials the daemon as the daemon's own identity, so without this the
+// daemon would see every JSON request as privileged.
+func jsonConnContext(ctx context.Context, c net.Conn) context.Context {
+	id, err := ipcauth.PeerIdentity(c)
+	if err != nil {
+		log.Debugf("json gateway: cannot read HTTP client identity, requests won't carry it: %v", err)
+		return ctx
+	}
+	return context.WithValue(ctx, jsonPeerCtxKey{}, id)
+}
+
+// jsonForwardIdentity injects the stashed HTTP client identity as gRPC metadata
+// on the gateway's re-dial to the daemon. The daemon trusts it only because the
+// dial arrives as the daemon's own (self/privileged) identity.
+func jsonForwardIdentity(ctx context.Context, _ *http.Request) metadata.MD {
+	id, ok := ctx.Value(jsonPeerCtxKey{}).(ipcauth.Identity)
+	if !ok {
+		return nil
+	}
+	return ipcauth.ForwardIdentityMetadata(id)
+}
+
 func grpcGatewayEndpoint(addr string) string {
 	return strings.TrimPrefix(addr, "tcp://")
 }
 
 func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
-	mux := runtime.NewServeMux()
+	mux := runtime.NewServeMux(runtime.WithMetadata(jsonForwardIdentity))
 	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
 	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
 		return err
@@ -35,6 +64,7 @@ func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint
 		BaseContext: func(net.Listener) context.Context {
 			return p.ctx
 		},
+		ConnContext: jsonConnContext,
 	}
 
 	p.jsonServMu.Lock()

client/cmd/service_pipe_other.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// listenNamedPipe is unsupported off Windows; named pipes are a Windows-only transport.
+func listenNamedPipe(string) (net.Listener, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}
+
+// dialNamedPipe is unsupported off Windows.
+func dialNamedPipe(context.Context, string) (net.Conn, error) {
+	return nil, fmt.Errorf("named pipe daemon socket is only supported on Windows, not %s", runtime.GOOS)
+}

client/cmd/service_pipe_windows.go

@@ -0,0 +1,32 @@
+//go:build windows
+
+package cmd
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"github.com/Microsoft/go-winio"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// listenNamedPipe creates the daemon control named pipe with a tight SDDL
+// (SYSTEM + Administrators + interactive users). ListenPipe fails if the pipe
+// already exists (first-instance semantics), which prevents a squatting process
+// from pre-creating it — we surface that error loudly rather than falling back.
+func listenNamedPipe(path string) (net.Listener, error) {
+	return winio.ListenPipe(path, &winio.PipeConfig{
+		SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
+	})
+}
+
+// dialNamedPipe connects to the daemon control named pipe.
+func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
+	if deadline, ok := ctx.Deadline(); ok {
+		timeout := time.Until(deadline)
+		return winio.DialPipe(path, &timeout)
+	}
+	return winio.DialPipeContext(ctx, path)
+}

client/cmd/service_socket.go

@@ -26,6 +26,15 @@ func listenOnAddress(addr string) (*socketListener, error) {
 		return nil, err
 	}
 
+	if network == "npipe" {
+		path := pipePath(address)
+		listener, err := listenNamedPipe(path)
+		if err != nil {
+			return nil, err
+		}
+		return &socketListener{Listener: listener, network: network, address: path}, nil
+	}
+
 	if network == "unix" {
 		removeStaleUnixSocket(address)
 	}
@@ -45,13 +54,23 @@ func parseListenAddress(addr string) (string, string, error) {
 	}
 
 	switch network {
-	case "unix", "tcp":
+	case "unix", "tcp", "npipe":
 		return network, address, nil
 	default:
 		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
 	}
 }
 
+// pipePath maps a daemon-addr npipe name (e.g. "netbird" from "npipe://netbird")
+// to a Windows named-pipe path (\\.\pipe\netbird). A full \\.\pipe\ path is
+// returned unchanged.
+func pipePath(name string) string {
+	if strings.HasPrefix(name, `\\`) {
+		return name
+	}
+	return `\\.\pipe\` + name
+}
+
 func removeStaleUnixSocket(path string) {
 	stat, err := os.Lstat(path)
 	if err != nil {

client/cmd/up.go

@@ -56,6 +56,7 @@ var (
 	showQR             bool
 	profileName        string
 	configPath         string
+	claimOwner         bool
 
 	upCmd = &cobra.Command{
 		Use:   "up",
@@ -67,6 +68,7 @@ var (
 
 func init() {
 	upCmd.PersistentFlags().BoolVarP(&foregroundMode, "foreground-mode", "F", false, "start service in foreground")
+	upCmd.PersistentFlags().BoolVar(&claimOwner, "owner", false, "claim ownership of this profile for the current user, restricting daemon control of it to you and root/administrator")
 	upCmd.PersistentFlags().StringVar(&interfaceName, interfaceNameFlag, iface.WgInterfaceDefault, "WireGuard interface name")
 	upCmd.PersistentFlags().Uint16Var(&wireguardPort, wireguardPortFlag, iface.DefaultWgPort, "WireGuard interface listening port")
 	upCmd.PersistentFlags().Uint16Var(&mtu, mtuFlag, iface.DefaultMTU, "Set MTU (Maximum Transmission Unit) for the WireGuard interface")
@@ -391,6 +393,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	if _, err := client.Up(ctx, &proto.UpRequest{
 		ProfileName: &profileID,
 		Username:    &username,
+		ClaimOwner:  claimOwner,
 	}); err != nil {
 		return fmt.Errorf("call service up method: %v", err)
 	}

client/cmd/up_daemon_test.go

@@ -29,7 +29,7 @@ func TestUpDaemon(t *testing.T) {
 	}
 
 	sm := profilemanager.ServiceManager{}
-	created, err := sm.AddProfile("test1", currUser.Username)
+	created, err := sm.AddProfile("test1", currUser.Username, nil)
 	if err != nil {
 		t.Fatalf("failed to add profile: %v", err)
 		return

client/internal/ipcauth/authorize.go

@@ -0,0 +1,90 @@
+package ipcauth
+
+import (
+	"slices"
+	"strconv"
+)
+
+// Ownership is a profile's access policy: the typed owner principals plus the
+// opt-in shared flag.
+type Ownership struct {
+	Owners []string
+	Shared bool
+}
+
+// GroupResolver resolves a Unix caller's effective group IDs (primary +
+// supplementary, NSS-aware) and owner group names to GIDs. It is only consulted
+// for Unix `gid:`/`group:` owners; Windows uses the SIDs carried in the Identity.
+// A nil resolver disables group matching.
+type GroupResolver interface {
+	// CallerGIDs returns the set of group IDs the caller belongs to.
+	CallerGIDs(id Identity) map[uint32]struct{}
+	// GroupNameGID resolves a group name to its GID.
+	GroupNameGID(name string) (uint32, bool)
+}
+
+// Authorize reports whether the identity may control a profile with the given
+// ownership. Privileged callers (root / elevated-admin / LocalSystem) and shared
+// profiles are always allowed; otherwise the identity must match one of the
+// owner principals.
+func Authorize(o Ownership, id Identity, r GroupResolver) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	if o.Shared {
+		return true
+	}
+	for _, raw := range o.Owners {
+		p, ok := ParsePrincipal(raw)
+		if !ok {
+			continue
+		}
+		if principalMatches(p, id, r) {
+			return true
+		}
+	}
+	return false
+}
+
+func principalMatches(p Principal, id Identity, r GroupResolver) bool {
+	switch p.Kind {
+	case KindUID:
+		if id.IsWindows() {
+			return false
+		}
+		uid, err := strconv.ParseUint(p.Value, 10, 32)
+		return err == nil && uint32(uid) == id.UID
+	case KindGID:
+		if id.IsWindows() {
+			return false
+		}
+		gid, err := strconv.ParseUint(p.Value, 10, 32)
+		return err == nil && callerHasGID(uint32(gid), id, r)
+	case KindGroup:
+		if id.IsWindows() || r == nil {
+			return false
+		}
+		gid, ok := r.GroupNameGID(p.Value)
+		return ok && callerHasGID(gid, id, r)
+	case KindSID:
+		if !id.IsWindows() {
+			return false
+		}
+		return id.SID == p.Value || slices.Contains(id.Groups, p.Value)
+	default:
+		return false
+	}
+}
+
+// callerHasGID reports whether gid is the caller's primary GID (from peercred,
+// no lookup) or one of their supplementary groups (NSS-resolved via r).
+func callerHasGID(gid uint32, id Identity, r GroupResolver) bool {
+	if id.GID == gid {
+		return true
+	}
+	if r == nil {
+		return false
+	}
+	_, ok := r.CallerGIDs(id)[gid]
+	return ok
+}

client/internal/ipcauth/creds_stub.go

@@ -0,0 +1,12 @@
+//go:build !linux && !darwin && !freebsd && !windows
+
+package ipcauth
+
+import "google.golang.org/grpc/credentials"
+
+// NewTransportCredentials returns nil on platforms without a peer-identity
+// primitive. The daemon falls back to insecure credentials and skips per-RPC
+// authorization (logging a warning), preserving pre-hardening behavior.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return nil
+}

client/internal/ipcauth/creds_unix.go

@@ -0,0 +1,48 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns gRPC transport credentials that extract the
+// caller's kernel-authenticated identity from a Unix-socket connection and
+// expose it via IdentityFromContext. Non-nil on platforms with a
+// peer-credential primitive.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return unixCreds{}
+}
+
+// unixCreds implements credentials.TransportCredentials over a Unix socket.
+// The server side reads SO_PEERCRED/LOCAL_PEERCRED during the handshake; the
+// client side is a no-op (the kernel supplies the peer identity to the server
+// without any client cooperation), so an ordinary insecure client still works.
+type unixCreds struct{}
+
+func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the peer identity and fails closed if it cannot be read.
+func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := PeerIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (unixCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
+}
+
+func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
+
+func (unixCreds) OverrideServerName(string) error { return nil }

client/internal/ipcauth/creds_windows.go

@@ -0,0 +1,143 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+
+	"golang.org/x/sys/windows"
+	"google.golang.org/grpc/credentials"
+)
+
+var (
+	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
+	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
+	procRevertToSelf               = modadvapi32.NewProc("RevertToSelf")
+)
+
+// Windows group-SID attribute flags (winnt.h): a group only counts toward
+// membership when it is enabled and not marked use-for-deny-only.
+const (
+	seGroupEnabled        = 0x00000004
+	seGroupUseForDenyOnly = 0x00000010
+)
+
+// DefaultPipeSDDL restricts the daemon control pipe to LocalSystem (SY), the
+// Administrators group (BA), and interactive logon users (IU). It deliberately
+// excludes Authenticated Users / Everyone so remote or arbitrary service
+// principals cannot connect. This is the connection gate; the interceptor still
+// does per-RPC authorization by caller identity.
+func DefaultPipeSDDL() string {
+	return "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;IU)"
+}
+
+// NewTransportCredentials returns gRPC transport credentials that derive the
+// caller's identity from the named-pipe client token, following Microsoft's
+// "Verifying Client Access with ACLs" pattern: ImpersonateNamedPipeClient ->
+// OpenThreadToken -> RevertToSelf. Per threat-model M-NOIMP, impersonation is
+// used only to read the client token for identity, never to perform privileged work.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return winpipeCreds{}
+}
+
+type winpipeCreds struct{}
+
+func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the connecting client's identity from the pipe token.
+// Fails closed if the handle or token cannot be read.
+func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return nil, nil, fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+	handle := windows.Handle(fdConn.Fd())
+
+	id, err := pipeClientIdentity(handle)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (winpipeCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: "netbird-ipc-peercred"}
+}
+
+func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
+
+func (winpipeCreds) OverrideServerName(string) error { return nil }
+
+// pipeClientIdentity reads the connecting client's user SID, enabled group SIDs,
+// and elevation from the named-pipe handle. The impersonation window is kept as
+// small as possible and pinned to the OS thread (impersonation is thread-local).
+func pipeClientIdentity(handle windows.Handle) (Identity, error) {
+	var pid uint32
+	hasPID := windows.GetNamedPipeClientProcessId(handle, &pid) == nil
+
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	if err := impersonateNamedPipeClient(handle); err != nil {
+		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
+	}
+	defer func() { _ = revertToSelf() }()
+
+	// openAsSelf=true: the token is opened using the daemon's process context
+	// (LocalSystem), not the impersonated client's, so the open always succeeds.
+	var token windows.Token
+	if err := windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
+		return Identity{}, fmt.Errorf("open thread token: %w", err)
+	}
+	defer token.Close()
+
+	tu, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token user: %w", err)
+	}
+
+	tg, err := token.GetTokenGroups()
+	if err != nil {
+		return Identity{}, fmt.Errorf("get token groups: %w", err)
+	}
+	var groups []string
+	for _, g := range tg.AllGroups() {
+		if g.Attributes&seGroupEnabled == 0 || g.Attributes&seGroupUseForDenyOnly != 0 {
+			continue
+		}
+		groups = append(groups, g.Sid.String())
+	}
+
+	return Identity{
+		SID:      tu.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+		PID:      int32(pid),
+		HasPID:   hasPID,
+	}, nil
+}
+
+func impersonateNamedPipeClient(h windows.Handle) error {
+	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
+	if r == 0 {
+		return e
+	}
+	return nil
+}
+
+func revertToSelf() error {
+	r, _, e := procRevertToSelf.Call()
+	if r == 0 {
+		return e
+	}
+	return nil
+}

client/internal/ipcauth/forward.go

@@ -0,0 +1,72 @@
+package ipcauth
+
+import (
+	"context"
+	"strconv"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// Metadata keys used by the local JSON gateway to forward the HTTP client's
+// identity to the daemon. Trusted by the interceptor ONLY when the gRPC peer is
+// itself the daemon (self/privileged) — i.e. the loopback gateway — so a direct
+// gRPC caller cannot forge them.
+const (
+	mdFwdUID = "x-netbird-fwd-uid"
+	mdFwdGID = "x-netbird-fwd-gid"
+	mdFwdPID = "x-netbird-fwd-pid"
+)
+
+// ForwardIdentityMetadata encodes a Unix identity for the gateway to forward to
+// the daemon. Windows identities are not forwarded (the gateway cannot read a
+// pipe token for an HTTP client); nil is returned in that case.
+func ForwardIdentityMetadata(id Identity) metadata.MD {
+	if id.IsWindows() {
+		return nil
+	}
+	md := metadata.Pairs(
+		mdFwdUID, strconv.FormatUint(uint64(id.UID), 10),
+		mdFwdGID, strconv.FormatUint(uint64(id.GID), 10),
+	)
+	if id.HasPID {
+		md.Set(mdFwdPID, strconv.FormatInt(int64(id.PID), 10))
+	}
+	return md
+}
+
+// forwardedIdentity extracts a forwarded Unix identity from incoming gRPC
+// metadata, if present and well-formed.
+func forwardedIdentity(ctx context.Context) (Identity, bool) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	uidStr := mdFirst(md, mdFwdUID)
+	if uidStr == "" {
+		return Identity{}, false
+	}
+	uid, err := strconv.ParseUint(uidStr, 10, 32)
+	if err != nil {
+		return Identity{}, false
+	}
+	id := Identity{UID: uint32(uid)}
+	if g := mdFirst(md, mdFwdGID); g != "" {
+		if v, err := strconv.ParseUint(g, 10, 32); err == nil {
+			id.GID = uint32(v)
+		}
+	}
+	if p := mdFirst(md, mdFwdPID); p != "" {
+		if v, err := strconv.ParseInt(p, 10, 32); err == nil {
+			id.PID = int32(v)
+			id.HasPID = true
+		}
+	}
+	return id, true
+}
+
+func mdFirst(md metadata.MD, key string) string {
+	if v := md.Get(key); len(v) > 0 {
+		return v[0]
+	}
+	return ""
+}

client/internal/ipcauth/identity.go

@@ -0,0 +1,106 @@
+// Package ipcauth provides the kernel-authenticated identity of a local IPC
+// (gRPC) caller and the transport credentials that surface it into the gRPC
+// context, so the daemon can authorize each RPC by caller identity.
+//
+// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
+// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the named-pipe
+// client token. Platforms without a peer-identity primitive get no credentials
+// and therefore no enforcement (the daemon logs a warning and stays open,
+// preserving today's behavior until the transport gains an identity primitive).
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+// sidLocalSystem is the well-known Windows SID for the LocalSystem account.
+const sidLocalSystem = "S-1-5-18"
+
+// Identity is the kernel-authenticated identity of a local IPC caller. The zero
+// value is not a valid identity; obtain one via IdentityFromContext (which
+// reports presence) or PeerIdentity.
+type Identity struct {
+	// UID and GID are the caller's Unix user ID and primary group ID.
+	// Zero on Windows, where SID is authoritative instead.
+	UID uint32
+	GID uint32
+
+	// PID is the caller's process ID, for audit only. HasPID is false when the
+	// platform cannot supply it (e.g. Darwin/FreeBSD xucred carries no PID).
+	PID    int32
+	HasPID bool
+
+	// SID is the caller's Windows security identifier (empty on Unix).
+	SID string
+
+	// Groups holds the caller's Windows group SIDs, captured from the client
+	// token at handshake (empty on Unix, where supplementary group membership is
+	// resolved on demand via NSS/getent by the authorizer).
+	Groups []string
+
+	// Elevated reports whether the Windows client token is elevated (run as
+	// administrator). Always false on Unix, where privilege is uid==0.
+	Elevated bool
+}
+
+// IsWindows reports whether this identity is a Windows principal (SID-based)
+// rather than a Unix uid/gid principal.
+func (i Identity) IsWindows() bool {
+	return i.SID != ""
+}
+
+// IsPrivileged reports whether the caller is the platform's administrative
+// principal — Unix root (uid 0), or on Windows an elevated token or LocalSystem.
+// It deliberately requires actual elevation on Windows (a non-elevated member of
+// Administrators has a filtered token and is NOT privileged), mirroring "must
+// really be root" on Unix.
+func (i Identity) IsPrivileged() bool {
+	if i.IsWindows() {
+		return i.Elevated || i.SID == sidLocalSystem
+	}
+	return i.UID == 0
+}
+
+// String renders the identity for audit logs.
+func (i Identity) String() string {
+	if i.IsWindows() {
+		if i.HasPID {
+			return fmt.Sprintf("sid=%s elevated=%t pid=%d", i.SID, i.Elevated, i.PID)
+		}
+		return fmt.Sprintf("sid=%s elevated=%t", i.SID, i.Elevated)
+	}
+	if i.HasPID {
+		return fmt.Sprintf("uid=%d gid=%d pid=%d", i.UID, i.GID, i.PID)
+	}
+	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
+}
+
+// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so the
+// interceptor can retrieve it from the request context via IdentityFromContext.
+type AuthInfo struct {
+	credentials.CommonAuthInfo
+	Identity Identity
+}
+
+// AuthType identifies the authentication scheme.
+func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
+
+// IdentityFromContext extracts the caller's kernel-authenticated identity from
+// the gRPC peer context. The second return value is false when no IPC transport
+// credentials were negotiated (e.g. an unsupported platform, or a caller that
+// did not come through the daemon socket) — callers MUST fail closed in that case.
+func IdentityFromContext(ctx context.Context) (Identity, bool) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	info, ok := p.AuthInfo.(AuthInfo)
+	if !ok {
+		return Identity{}, false
+	}
+	return info.Identity, true
+}

client/internal/ipcauth/identity_test.go

@@ -0,0 +1,50 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+func TestIdentityFromContext_NoPeer(t *testing.T) {
+	_, ok := IdentityFromContext(context.Background())
+	assert.False(t, ok, "bare context must report no identity (fail closed)")
+}
+
+func TestIdentityFromContext_WrongAuthInfo(t *testing.T) {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{})
+	_, ok := IdentityFromContext(ctx)
+	assert.False(t, ok, "peer without our AuthInfo must report no identity")
+}
+
+func TestIdentityFromContext_Present(t *testing.T) {
+	want := Identity{UID: 1000, GID: 1000, PID: 4242, HasPID: true}
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       want,
+		},
+	})
+
+	got, ok := IdentityFromContext(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, want, got)
+}
+
+func TestIdentity_IsPrivileged(t *testing.T) {
+	// Unix
+	assert.True(t, Identity{UID: 0}.IsPrivileged(), "root is privileged")
+	assert.False(t, Identity{UID: 1000}.IsPrivileged(), "non-root is not privileged")
+	// Windows
+	assert.True(t, Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true}.IsPrivileged(), "elevated admin is privileged")
+	assert.True(t, Identity{SID: "S-1-5-18"}.IsPrivileged(), "LocalSystem is privileged")
+	assert.False(t, Identity{SID: "S-1-5-21-1-2-3-1001"}.IsPrivileged(), "non-elevated admin is NOT privileged")
+}
+
+func TestIdentity_IsWindows(t *testing.T) {
+	assert.True(t, Identity{SID: "S-1-5-18"}.IsWindows())
+	assert.False(t, Identity{UID: 0}.IsWindows())
+}

client/internal/ipcauth/interceptor.go

@@ -0,0 +1,124 @@
+package ipcauth
+
+import (
+	"context"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// Interceptor enforces per-RPC authorization on the daemon control channel,
+// keyed to the caller's kernel-authenticated identity. It is safe-by-default:
+// any RPC without a matching bypass is gated by the active profile's ownership,
+// and a caller without a readable identity is denied.
+type Interceptor struct {
+	policy   ProfilePolicy
+	resolver GroupResolver
+	// selfUID is the daemon's own effective UID. A caller whose UID matches it
+	// (rootless container / foreground daemon running as the invoking user) is
+	// allowed: it already has full control of the daemon process. -1 on Windows.
+	selfUID int
+}
+
+// NewInterceptor builds an interceptor over the given policy and group resolver.
+func NewInterceptor(policy ProfilePolicy, resolver GroupResolver) *Interceptor {
+	return &Interceptor{policy: policy, resolver: resolver, selfUID: os.Geteuid()}
+}
+
+// UnaryServerInterceptor authorizes each unary RPC before the handler runs.
+func (i *Interceptor) UnaryServerInterceptor() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		if err := i.authorize(ctx, info.FullMethod); err != nil {
+			return nil, err
+		}
+		return handler(ctx, req)
+	}
+}
+
+// StreamServerInterceptor authorizes each streaming RPC before the handler runs.
+func (i *Interceptor) StreamServerInterceptor() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		if err := i.authorize(ss.Context(), info.FullMethod); err != nil {
+			return err
+		}
+		return handler(srv, ss)
+	}
+}
+
+func (i *Interceptor) authorize(ctx context.Context, fullMethod string) error {
+	id, ok := IdentityFromContext(ctx)
+	if !ok {
+		log.Warnf("ipc authz: DENY %s — caller identity unavailable", fullMethod)
+		return status.Error(codes.PermissionDenied, "caller identity could not be verified on the daemon control channel")
+	}
+
+	if i.isSelfOrPrivileged(id) {
+		// The local JSON gateway connects as the daemon itself (self/privileged)
+		// and forwards the real HTTP client's identity. Trust it here — and only
+		// here, where the transport peer is already the daemon — then authorize
+		// as the forwarded client. A direct non-privileged caller never reaches
+		// this branch, so it cannot forge the forwarding metadata.
+		fwd, hasFwd := forwardedIdentity(ctx)
+		if !hasFwd {
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+		log.Infof("ipc authz: honoring gateway-forwarded identity %s", fwd)
+		id = fwd
+		if i.isSelfOrPrivileged(id) {
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+	}
+
+	// Per-user / per-target-profile RPCs authorize themselves in the handler.
+	if handlerAuthorizedMethods[fullMethod] {
+		return nil
+	}
+
+	o := i.policy.ActiveProfileOwnership()
+
+	// Trust-on-first-use: an unowned, non-shared profile is claimed by the first
+	// caller. The claim is atomic; if we lose the race we re-read and authorize.
+	if len(o.Owners) == 0 && !o.Shared {
+		claimed, err := i.policy.ClaimActiveProfileOwnerIfUnowned(id)
+		if err != nil {
+			log.Errorf("ipc authz: claim active profile for %s: %v", id, err)
+			return status.Error(codes.Internal, "failed to claim profile ownership")
+		}
+		if claimed {
+			log.Infof("ipc authz: %s claimed ownership of the active profile (trust-on-first-use)", id)
+			i.auditAllow(id, fullMethod)
+			return nil
+		}
+		o = i.policy.ActiveProfileOwnership()
+	}
+
+	if Authorize(o, id, i.resolver) {
+		i.auditAllow(id, fullMethod)
+		return nil
+	}
+
+	log.Warnf("ipc authz: DENY %s for %s — active profile owned by another principal", fullMethod, id)
+	return status.Errorf(codes.PermissionDenied,
+		"not authorized to control the active profile (caller %s); ask an owner or run as root/administrator", id)
+}
+
+// isSelfOrPrivileged reports whether the caller is the platform administrator
+// (root / elevated-admin / LocalSystem) or the daemon's own user.
+func (i *Interceptor) isSelfOrPrivileged(id Identity) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	// Daemon-self: only meaningful on Unix (Windows privilege is covered above).
+	return !id.IsWindows() && i.selfUID >= 0 && int(id.UID) == i.selfUID
+}
+
+func (i *Interceptor) auditAllow(id Identity, fullMethod string) {
+	if auditMethods[fullMethod] {
+		log.Infof("ipc authz: allow %s for %s", fullMethod, id)
+	}
+}

client/internal/ipcauth/interceptor_test.go

@@ -0,0 +1,139 @@
+package ipcauth
+
+import (
+	"context"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+type mockPolicy struct {
+	o       Ownership
+	claimed bool
+}
+
+func (m *mockPolicy) ActiveProfileOwnership() Ownership { return m.o }
+
+// ClaimActiveProfileOwnerIfUnowned records a claim and marks the profile owned.
+func (m *mockPolicy) ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error) {
+	if len(m.o.Owners) == 0 && !m.o.Shared {
+		m.o.Owners = []string{OwnerPrincipalForIdentity(id)}
+		m.claimed = true
+		return true, nil
+	}
+	return false, nil
+}
+
+type mockResolver struct {
+	gids  map[uint32]struct{}
+	names map[string]uint32
+}
+
+func (m mockResolver) CallerGIDs(Identity) map[uint32]struct{} { return m.gids }
+func (m mockResolver) GroupNameGID(n string) (uint32, bool)    { g, ok := m.names[n]; return g, ok }
+
+func ctxWith(id Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{AuthInfo: AuthInfo{Identity: id}})
+}
+
+const (
+	up    = servicePath + "Up"
+	list  = servicePath + "ListProfiles"
+	unkwn = servicePath + "SomeFutureMethod"
+)
+
+func TestInterceptorAuthorize(t *testing.T) {
+	const selfUID = 4000
+
+	tests := []struct {
+		name     string
+		own      Ownership
+		resolver GroupResolver
+		ctx      context.Context
+		method   string
+		wantErr  bool
+	}{
+		{"no identity denies", Ownership{}, nil, context.Background(), up, true},
+		{"root allowed", Ownership{}, nil, ctxWith(Identity{UID: 0}), up, false},
+		{"daemon-self allowed", Ownership{}, nil, ctxWith(Identity{UID: selfUID}), up, false},
+		{"shared allows any", Ownership{Shared: true}, nil, ctxWith(Identity{UID: 1234}), up, false},
+		{"uid owner allowed", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 1000}), up, false},
+		{"non-owner denied", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), up, true},
+		{"handler-authorized bypass", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), list, false},
+		{"unknown method gated", Ownership{Owners: []string{"uid:1000"}}, nil, ctxWith(Identity{UID: 2000}), unkwn, true},
+		{"primary gid owner", Ownership{Owners: []string{"gid:5000"}}, nil, ctxWith(Identity{UID: 2000, GID: 5000}), up, false},
+		{"group-name owner via resolver", Ownership{Owners: []string{"group:admins"}},
+			mockResolver{names: map[string]uint32{"admins": 5000}, gids: map[uint32]struct{}{5000: {}}},
+			ctxWith(Identity{UID: 2000, GID: 42}), up, false},
+		{"windows sid owner", Ownership{Owners: []string{"sid:S-1-5-21-9"}}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-9"}), up, false},
+		{"windows group-sid owner", Ownership{Owners: []string{"sid:S-1-5-32-544"}}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-1", Groups: []string{"S-1-5-32-544"}}), up, false},
+		{"windows elevated privileged", Ownership{}, nil,
+			ctxWith(Identity{SID: "S-1-5-21-1", Elevated: true}), up, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			i := &Interceptor{policy: &mockPolicy{o: tt.own}, resolver: tt.resolver, selfUID: selfUID}
+			err := i.authorize(tt.ctx, tt.method)
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, codes.PermissionDenied, status.Code(err))
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestInterceptorForwardedIdentity verifies the JSON-gateway trust model: a
+// self/privileged transport peer (the loopback gateway) may forward a real
+// client identity, but a non-privileged caller cannot forge it.
+func TestInterceptorForwardedIdentity(t *testing.T) {
+	const selfUID = 4000
+	owners := Ownership{Owners: []string{"uid:1000"}}
+
+	withFwd := func(peerUID, fwdUID uint32) context.Context {
+		ctx := ctxWith(Identity{UID: peerUID})
+		return metadata.NewIncomingContext(ctx, metadata.Pairs(mdFwdUID, itoa(fwdUID)))
+	}
+
+	// Gateway (peer == daemon-self) forwards a non-owner client → denied as that client.
+	i := &Interceptor{policy: &mockPolicy{o: owners}, selfUID: selfUID}
+	assert.Error(t, i.authorize(withFwd(selfUID, 2000), up))
+
+	// Gateway forwards the owner → allowed.
+	assert.NoError(t, i.authorize(withFwd(selfUID, 1000), up))
+
+	// A non-privileged direct caller's forwarded metadata is IGNORED (can't forge):
+	// caller uid 2000 forwarding uid:1000 is still treated as 2000 → denied.
+	assert.Error(t, i.authorize(withFwd(2000, 1000), up))
+}
+
+func itoa(u uint32) string {
+	return strconv.FormatUint(uint64(u), 10)
+}
+
+// TestInterceptorTOFU verifies an unowned, non-shared profile is claimed by the
+// first non-privileged caller, and a different caller is then denied.
+func TestInterceptorTOFU(t *testing.T) {
+	policy := &mockPolicy{o: Ownership{}} // unowned
+	i := &Interceptor{policy: policy, resolver: nil, selfUID: 4000}
+
+	// First caller (uid 1000) claims via TOFU.
+	err := i.authorize(ctxWith(Identity{UID: 1000}), up)
+	assert.NoError(t, err)
+	assert.True(t, policy.claimed, "first caller should claim ownership")
+	assert.Equal(t, []string{"uid:1000"}, policy.o.Owners)
+
+	// A different caller is now denied (profile owned by uid 1000).
+	err = i.authorize(ctxWith(Identity{UID: 2000}), up)
+	assert.Error(t, err)
+	assert.Equal(t, codes.PermissionDenied, status.Code(err))
+}

client/internal/ipcauth/peercred_bsd.go

@@ -0,0 +1,43 @@
+//go:build darwin || freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via LOCAL_PEERCRED (xucred). xucred
+// carries the uid and group list but no pid, so audit on these platforms is
+// uid/gid-based (HasPID is false); PID via LOCAL_PEERPID is a possible follow-up.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Xucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("LOCAL_PEERCRED: %w", credErr)
+	}
+
+	id := Identity{UID: cred.Uid}
+	// Groups[0] is the effective (primary) GID; guard against an empty list.
+	if cred.Ngroups > 0 {
+		id.GID = cred.Groups[0]
+	}
+	return id, nil
+}

client/internal/ipcauth/peercred_linux.go

@@ -0,0 +1,43 @@
+//go:build linux
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket connection via SO_PEERCRED. The credentials are
+// captured by the kernel at connect() time and cannot be spoofed or changed for
+// the life of the connection.
+func PeerIdentity(c net.Conn) (Identity, error) {
+	uc, ok := c.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", c)
+	}
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("getsockopt control: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("SO_PEERCRED: %w", credErr)
+	}
+
+	return Identity{
+		UID:    cred.Uid,
+		GID:    cred.Gid,
+		PID:    cred.Pid,
+		HasPID: true,
+	}, nil
+}

client/internal/ipcauth/peercred_stub.go

@@ -0,0 +1,16 @@
+//go:build !linux && !darwin && !freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+	"runtime"
+)
+
+// PeerIdentity is unimplemented on platforms without a Unix-socket peer-credential
+// primitive. Windows derives identity from the named-pipe client token instead
+// (see the Windows transport credentials), so it never calls this.
+func PeerIdentity(net.Conn) (Identity, error) {
+	return Identity{}, fmt.Errorf("peer credential check not supported on %s", runtime.GOOS)
+}

client/internal/ipcauth/peercred_unix_test.go

@@ -0,0 +1,114 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/health"
+	healthpb "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+// TestPeerIdentity_MatchesCurrentProcess connects to a real Unix socket and
+// verifies the extracted UID/GID match the running process (both ends are us).
+func TestPeerIdentity_MatchesCurrentProcess(t *testing.T) {
+	sock := filepath.Join(t.TempDir(), "peer.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	type result struct {
+		id  Identity
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- result{err: aerr}
+			return
+		}
+		defer func() { _ = c.Close() }()
+		id, ierr := PeerIdentity(c)
+		done <- result{id: id, err: ierr}
+	}()
+
+	client, err := net.Dial("unix", sock)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	res := <-done
+	require.NoError(t, res.err)
+	assert.Equal(t, uint32(os.Getuid()), res.id.UID, "UID should match current process")
+	assert.Equal(t, uint32(os.Getgid()), res.id.GID, "primary GID should match current process")
+}
+
+// TestPeerIdentity_NonUnixConn rejects non-Unix connections (fail closed).
+func TestPeerIdentity_NonUnixConn(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+
+	done := make(chan error, 1)
+	go func() {
+		c, aerr := ln.Accept()
+		if aerr != nil {
+			done <- aerr
+			return
+		}
+		defer func() { _ = c.Close() }()
+		_, ierr := PeerIdentity(c)
+		done <- ierr
+	}()
+
+	client, err := net.Dial("tcp", ln.Addr().String())
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+
+	assert.Error(t, <-done, "PeerIdentity must reject a non-Unix connection")
+}
+
+// TestGRPCRoundTrip_ServerCredsClientInsecure proves the transport contract end
+// to end: a gRPC server using the peercred transport credentials still serves a
+// plain insecure client (the CLI never changed), and the caller's kernel
+// identity reaches the handler via IdentityFromContext.
+func TestGRPCRoundTrip_ServerCredsClientInsecure(t *testing.T) {
+	sock := filepath.Join(t.TempDir(), "rt.sock")
+	ln, err := net.Listen("unix", sock)
+	require.NoError(t, err)
+
+	var gotUID uint32
+	var gotOK bool
+	srv := grpc.NewServer(
+		grpc.Creds(NewTransportCredentials()),
+		grpc.UnaryInterceptor(func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, h grpc.UnaryHandler) (any, error) {
+			id, ok := IdentityFromContext(ctx)
+			gotUID, gotOK = id.UID, ok
+			return h(ctx, req)
+		}),
+	)
+	healthpb.RegisterHealthServer(srv, health.NewServer())
+	go func() { _ = srv.Serve(ln) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("unix://"+sock, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = healthpb.NewHealthClient(conn).Check(ctx, &healthpb.HealthCheckRequest{})
+	require.NoError(t, err, "insecure client must reach the peercred server")
+
+	assert.True(t, gotOK, "handler must see a peer identity")
+	assert.Equal(t, uint32(os.Getuid()), gotUID, "handler must see the caller's UID")
+}

client/internal/ipcauth/policy.go

@@ -0,0 +1,92 @@
+package ipcauth
+
+import "sync"
+
+const servicePath = "/daemon.DaemonService/"
+
+// ProfilePolicy exposes the active profile's ownership to the interceptor. The
+// daemon server implements it; ConfigAdapter bridges the gap because the gRPC
+// server (and its interceptor) is constructed before the server instance exists.
+type ProfilePolicy interface {
+	// ActiveProfileOwnership returns the active profile's ownership policy.
+	ActiveProfileOwnership() Ownership
+
+	// ClaimActiveProfileOwnerIfUnowned atomically claims the active profile for
+	// id when it has no owners and is not shared (trust-on-first-use), and
+	// reports whether id is now an owner. A false return means the profile was
+	// already owned/shared or another caller won the claim — the caller must
+	// re-read ownership and authorize normally.
+	ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error)
+}
+
+// handlerAuthorizedMethods bypass the active-profile gate: they are per-user or
+// per-target-profile operations whose handler does its own authorization (bound
+// to the caller identity). Peer identity is still required to reach them.
+var handlerAuthorizedMethods = map[string]bool{
+	servicePath + "AddProfile":       true,
+	servicePath + "ListProfiles":     true,
+	servicePath + "GetActiveProfile": true,
+	servicePath + "RemoveProfile":    true,
+	servicePath + "RenameProfile":    true,
+}
+
+// auditMethods are the Tier-C/H RPCs (threat model §3) whose successful
+// authorization is worth an audit log line. Denials are always logged.
+var auditMethods = map[string]bool{
+	servicePath + "GetConfig":          true,
+	servicePath + "SetConfig":          true,
+	servicePath + "Login":              true,
+	servicePath + "WaitSSOLogin":       true,
+	servicePath + "RequestJWTAuth":     true,
+	servicePath + "WaitJWTToken":       true,
+	servicePath + "StartCapture":       true,
+	servicePath + "StartBundleCapture": true,
+	servicePath + "DebugBundle":        true,
+	servicePath + "ExposeService":      true,
+	servicePath + "Up":                 true,
+	servicePath + "Down":               true,
+	servicePath + "SelectNetworks":     true,
+	servicePath + "DeselectNetworks":   true,
+	servicePath + "SwitchProfile":      true,
+	servicePath + "TriggerUpdate":      true,
+	servicePath + "Logout":             true,
+	servicePath + "CleanState":         true,
+	servicePath + "DeleteState":        true,
+}
+
+// ConfigAdapter is a ProfilePolicy whose backend is set lazily, once the daemon
+// server instance is created. Until then it reports an unowned profile
+// (Ownership zero value), so non-privileged callers are denied — fail closed.
+type ConfigAdapter struct {
+	mu      sync.RWMutex
+	backend ProfilePolicy
+}
+
+// SetBackend installs the real policy. Must be called before serving RPCs.
+func (a *ConfigAdapter) SetBackend(backend ProfilePolicy) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.backend = backend
+}
+
+// ActiveProfileOwnership delegates to the backend, or reports an unowned profile
+// when no backend is set yet.
+func (a *ConfigAdapter) ActiveProfileOwnership() Ownership {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	if a.backend == nil {
+		return Ownership{}
+	}
+	return a.backend.ActiveProfileOwnership()
+}
+
+// ClaimActiveProfileOwnerIfUnowned delegates to the backend. Before the backend
+// is set it cannot claim, so it reports not-owned (fail closed).
+func (a *ConfigAdapter) ClaimActiveProfileOwnerIfUnowned(id Identity) (bool, error) {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	if a.backend == nil {
+		return false, nil
+	}
+	return a.backend.ClaimActiveProfileOwnerIfUnowned(id)
+}

client/internal/ipcauth/principal.go

@@ -0,0 +1,55 @@
+package ipcauth
+
+import (
+	"strconv"
+	"strings"
+)
+
+// PrincipalKind is the type of an owner principal.
+type PrincipalKind string
+
+const (
+	KindUID   PrincipalKind = "uid"   // Unix user ID
+	KindGID   PrincipalKind = "gid"   // Unix group ID
+	KindGroup PrincipalKind = "group" // Unix group name (NSS-resolved)
+	KindSID   PrincipalKind = "sid"   // Windows user or group SID
+)
+
+// Principal is a parsed owner entry from a profile's Owners list.
+type Principal struct {
+	Kind  PrincipalKind
+	Value string
+}
+
+// ParsePrincipal parses a "kind:value" owner string. Returns false for empty
+// values or unknown kinds so malformed entries are ignored rather than trusted.
+func ParsePrincipal(s string) (Principal, bool) {
+	kind, value, ok := strings.Cut(s, ":")
+	if !ok || value == "" {
+		return Principal{}, false
+	}
+	switch PrincipalKind(kind) {
+	case KindUID, KindGID, KindGroup, KindSID:
+		return Principal{Kind: PrincipalKind(kind), Value: value}, true
+	default:
+		return Principal{}, false
+	}
+}
+
+// UIDPrincipal builds the owner string for a Unix user ID.
+func UIDPrincipal(uid uint32) string {
+	return string(KindUID) + ":" + strconv.FormatUint(uint64(uid), 10)
+}
+
+// SIDPrincipal builds the owner string for a Windows SID.
+func SIDPrincipal(sid string) string { return string(KindSID) + ":" + sid }
+
+// OwnerPrincipalForIdentity returns the self-ownership principal for an identity:
+// the user's UID on Unix, or the user's SID on Windows. Used to auto-isolate a
+// new profile to its creator.
+func OwnerPrincipalForIdentity(id Identity) string {
+	if id.IsWindows() {
+		return SIDPrincipal(id.SID)
+	}
+	return UIDPrincipal(id.UID)
+}

client/internal/ipcauth/resolver_unix.go

@@ -0,0 +1,72 @@
+//go:build !windows
+
+package ipcauth
+
+import (
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/shell"
+)
+
+const groupCacheTTL = 30 * time.Second
+
+// NewDefaultGroupResolver returns an NSS-aware group resolver backed by
+// getent/`id -G` (via client/internal/shell), so `gid:`/`group:` owners resolve
+// correctly for LDAP/AD users under CGO_ENABLED=0. Results are cached briefly.
+func NewDefaultGroupResolver() GroupResolver {
+	return &nssResolver{byUID: make(map[uint32]gidCacheEntry)}
+}
+
+type gidCacheEntry struct {
+	gids map[uint32]struct{}
+	at   time.Time
+}
+
+type nssResolver struct {
+	mu    sync.Mutex
+	byUID map[uint32]gidCacheEntry
+}
+
+func (r *nssResolver) CallerGIDs(id Identity) map[uint32]struct{} {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if e, ok := r.byUID[id.UID]; ok && time.Since(e.at) < groupCacheTTL {
+		return e.gids
+	}
+	gids := resolveGIDs(id.UID)
+	r.byUID[id.UID] = gidCacheEntry{gids: gids, at: time.Now()}
+	return gids
+}
+
+func resolveGIDs(uid uint32) map[uint32]struct{} {
+	out := make(map[uint32]struct{})
+	u, err := shell.GetUserFromGetent(strconv.FormatUint(uint64(uid), 10))
+	if err != nil {
+		return out
+	}
+	ids, err := shell.GroupIdsWithFallback(u)
+	if err != nil {
+		return out
+	}
+	for _, s := range ids {
+		if g, err := strconv.ParseUint(s, 10, 32); err == nil {
+			out[uint32(g)] = struct{}{}
+		}
+	}
+	return out
+}
+
+func (r *nssResolver) GroupNameGID(name string) (uint32, bool) {
+	g, err := shell.LookupGroupWithGetent(name)
+	if err != nil {
+		return 0, false
+	}
+	gid, err := strconv.ParseUint(g.Gid, 10, 32)
+	if err != nil {
+		return 0, false
+	}
+	return uint32(gid), true
+}

client/internal/ipcauth/resolver_windows.go

@@ -0,0 +1,10 @@
+//go:build windows
+
+package ipcauth
+
+// NewDefaultGroupResolver returns nil on Windows: group authorization uses the
+// group SIDs carried in the client token (see the Windows transport
+// credentials), not NSS/getent.
+func NewDefaultGroupResolver() GroupResolver {
+	return nil
+}

client/internal/profilemanager/config.go

@@ -102,6 +102,11 @@ type ConfigInput struct {
 	DNSLabels domain.List
 
 	MTU *uint16
+
+	// Owners replaces the profile's owner principal list when non-nil.
+	// Shared replaces the profile's shared flag when non-nil.
+	Owners []string
+	Shared *bool
 }
 
 // Config Configuration type
@@ -184,6 +189,17 @@ type Config struct {
 
 	MTU uint16
 
+	// Owners lists the principals allowed to control this profile over the local
+	// IPC, as typed strings: "uid:1000", "gid:1000", "group:netbird-admins"
+	// (Unix, NSS-resolved) or "sid:S-1-5-..." (Windows user or group SID). Empty
+	// with Shared=false means the profile is owned by nobody yet (privileged +
+	// daemon-self only, until claimed). Interpreted by client/internal/ipcauth.
+	Owners []string `json:"Owners,omitempty"`
+
+	// Shared, when true, lets any authenticated local caller control this profile
+	// (opt-in). Takes precedence over Owners.
+	Shared bool `json:"Shared,omitempty"`
+
 	// policy is the MDM policy that produced the currently-set values for
 	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
 	// and reset on every apply() invocation. Never persisted to disk.
@@ -642,6 +658,18 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
+	if input.Owners != nil && !slices.Equal(config.Owners, input.Owners) {
+		log.Infof("updating profile owners to %v", input.Owners)
+		config.Owners = input.Owners
+		updated = true
+	}
+
+	if input.Shared != nil && *input.Shared != config.Shared {
+		log.Infof("updating profile shared flag to %t", *input.Shared)
+		config.Shared = *input.Shared
+		updated = true
+	}
+
 	// MDM is the last override layer: any key present in the policy
 	// supersedes defaults, on-disk config, env vars and CLI input.
 	config.applyMDMPolicy(loadMDMPolicy())

client/internal/profilemanager/service.go

@@ -296,7 +296,7 @@ func (s *ServiceManager) DefaultProfilePath() string {
 // The returned Profile carries the freshly-generated ID so callers can
 // show it to the user (and so the gRPC AddProfileResponse can include
 // it).
-func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, error) {
+func (s *ServiceManager) AddProfile(displayName, username string, owners []string) (*Profile, error) {
 	configDir, err := s.getConfigDir(username)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get config directory: %w", err)
@@ -318,6 +318,9 @@ func (s *ServiceManager) AddProfile(displayName, username string) (*Profile, err
 		return nil, fmt.Errorf("failed to create new config: %w", err)
 	}
 	cfg.Name = displayName
+	// owners auto-isolates the new profile to its creator (nil = unowned, so the
+	// eventual first caller claims it via trust-on-first-use).
+	cfg.Owners = owners
 
 	if err := util.WriteJson(context.Background(), profPath, cfg); err != nil {
 		return nil, fmt.Errorf("failed to write profile config: %w", err)

client/internal/profilemanager/service_test.go

@@ -32,7 +32,7 @@ func withTestSM(t *testing.T, fn func(sm *ServiceManager, username string)) {
 
 func TestServiceProfile_ExactID(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		got, err := sm.ResolveProfile(created.ID.String(), username)
@@ -44,7 +44,7 @@ func TestServiceProfile_ExactID(t *testing.T) {
 
 func TestServiceProfile_IDPrefix(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		prefix := created.ID[:4]
@@ -75,7 +75,7 @@ func TestServiceProfile_AmbiguousPrefix(t *testing.T) {
 
 func TestServiceProfile_ExactNameUnique(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		got, err := sm.ResolveProfile("work", username)
@@ -86,9 +86,9 @@ func TestServiceProfile_ExactNameUnique(t *testing.T) {
 
 func TestServiceProfile_AmbiguousName(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		_, err := sm.AddProfile("work", username)
+		_, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
-		_, err = sm.AddProfile("work", username)
+		_, err = sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		_, err = sm.ResolveProfile("work", username)
@@ -133,10 +133,10 @@ func TestServiceProfile_LegacyFilenameCoexists(t *testing.T) {
 
 func TestAddProfile_AllowsDuplicateWithFlag(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		first, err := sm.AddProfile("work", username)
+		first, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
-		second, err := sm.AddProfile("work", username)
+		second, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 		assert.NotEqual(t, first.ID, second.ID)
 		assert.Equal(t, "work", second.Name)
@@ -151,7 +151,7 @@ func TestAddProfile_RejectsInvalidNames(t *testing.T) {
 			strings.Repeat("a", maxProfileNameLen+1), // too long
 		}
 		for _, name := range cases {
-			_, err := sm.AddProfile(name, username)
+			_, err := sm.AddProfile(name, username, nil)
 			assert.Error(t, err, "expected error for %q", name)
 		}
 	})
@@ -215,7 +215,7 @@ func TestIsValidProfileFilenameStem(t *testing.T) {
 
 func TestRemoveProfile_DeletesStateFile(t *testing.T) {
 	withTestSM(t, func(sm *ServiceManager, username string) {
-		created, err := sm.AddProfile("work", username)
+		created, err := sm.AddProfile("work", username, nil)
 		require.NoError(t, err)
 
 		configDir, err := sm.getConfigDir(username)

client/internal/shell/getent_cgo_unix.go

@@ -0,0 +1,29 @@
+//go:build cgo && !osusergo && !windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent with CGO delegates directly to os/user.Lookup.
+// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
+// the NSS stack natively. If it fails, the user truly doesn't exist and
+// getent would also fail.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent with CGO delegates directly to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GroupIdsWithFallback with CGO delegates directly to user.GroupIds.
+// libc's getgrouplist handles NSS groups natively.
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/internal/shell/getent_nocgo_unix.go

@@ -1,6 +1,6 @@
 //go:build (!cgo || osusergo) && !windows
 
-package server
+package shell
 
 import (
 	"os"
@@ -10,10 +10,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-// lookupWithGetent looks up a user by name, falling back to getent if os/user fails.
+// LookupWithGetent looks up a user by name, falling back to getent if os/user fails.
 // Without CGO, os/user only reads /etc/passwd and misses NSS-provided users.
 // getent goes through the host's NSS stack.
-func lookupWithGetent(username string) (*user.User, error) {
+func LookupWithGetent(username string) (*user.User, error) {
 	u, err := user.Lookup(username)
 	if err == nil {
 		return u, nil
@@ -22,7 +22,7 @@ func lookupWithGetent(username string) (*user.User, error) {
 	stdErr := err
 	log.Debugf("os/user.Lookup(%q) failed, trying getent: %v", username, err)
 
-	u, _, getentErr := runGetent(username)
+	u, _, getentErr := runGetentPasswd(username)
 	if getentErr != nil {
 		log.Debugf("getent fallback for %q also failed: %v", username, getentErr)
 		return nil, stdErr
@@ -31,8 +31,26 @@ func lookupWithGetent(username string) (*user.User, error) {
 	return u, nil
 }
 
-// currentUserWithGetent gets the current user, falling back to getent if os/user fails.
-func currentUserWithGetent() (*user.User, error) {
+// LookupGroupWithGetent returns the resolved group from either a gid or groupname,
+// falling back to getent if os/user fails (NSS groups under nocgo).
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	g, err := user.LookupGroup(name)
+	if err == nil {
+		return g, nil
+	}
+
+	stdErr := err
+	log.Debugf("os/user.LookupGroup(%q) failed, trying getent: %v", name, err)
+	g, getentErr := runGetentGroup(name)
+	if getentErr != nil {
+		log.Debugf("getent fallback for %q also failed: %v", name, getentErr)
+		return nil, stdErr
+	}
+	return g, nil
+}
+
+// CurrentUserWithGetent gets the current user, falling back to getent if os/user fails.
+func CurrentUserWithGetent() (*user.User, error) {
 	u, err := user.Current()
 	if err == nil {
 		return u, nil
@@ -42,7 +60,7 @@ func currentUserWithGetent() (*user.User, error) {
 	uid := strconv.Itoa(os.Getuid())
 	log.Debugf("os/user.Current() failed, trying getent with UID %s: %v", uid, err)
 
-	u, _, getentErr := runGetent(uid)
+	u, _, getentErr := runGetentPasswd(uid)
 	if getentErr != nil {
 		return nil, stdErr
 	}
@@ -50,14 +68,14 @@ func currentUserWithGetent() (*user.User, error) {
 	return u, nil
 }
 
-// groupIdsWithFallback gets group IDs for a user via the id command first,
+// GroupIdsWithFallback gets group IDs for a user via the id command first,
 // falling back to user.GroupIds().
-// NOTE: unlike lookupWithGetent/currentUserWithGetent which try stdlib first,
+// NOTE: unlike LookupWithGetent/CurrentUserWithGetent which try stdlib first,
 // this intentionally tries `id -G` first because without CGO, user.GroupIds()
 // only reads /etc/group and silently returns incomplete results for NSS users
 // (no error, just missing groups). The id command goes through NSS and returns
 // the full set.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
 	ids, err := runIdGroups(u.Username)
 	if err == nil {
 		return ids, nil

client/internal/shell/getent_test.go

@@ -1,4 +1,4 @@
-package server
+package shell
 
 import (
 	"os/user"
@@ -15,7 +15,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := lookupWithGetent(current.Username)
+	u, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Username, u.Username)
 	assert.Equal(t, current.Uid, u.Uid)
@@ -23,7 +23,7 @@ func TestLookupWithGetent_CurrentUser(t *testing.T) {
 }
 
 func TestLookupWithGetent_NonexistentUser(t *testing.T) {
-	_, err := lookupWithGetent("nonexistent_user_xyzzy_12345")
+	_, err := LookupWithGetent("nonexistent_user_xyzzy_12345")
 	require.Error(t, err, "should fail for nonexistent user")
 }
 
@@ -31,7 +31,7 @@ func TestCurrentUserWithGetent(t *testing.T) {
 	stdUser, err := user.Current()
 	require.NoError(t, err)
 
-	u, err := currentUserWithGetent()
+	u, err := CurrentUserWithGetent()
 	require.NoError(t, err)
 	assert.Equal(t, stdUser.Uid, u.Uid)
 	assert.Equal(t, stdUser.Username, u.Username)
@@ -41,7 +41,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(current)
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "current user should have at least one group")
 
@@ -56,7 +56,7 @@ func TestGroupIdsWithFallback_CurrentUser(t *testing.T) {
 func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		// Windows stub always returns empty, which is correct
-		shell := getShellFromGetent("1000")
+		shell := GetShellFromGetent("1000")
 		assert.Empty(t, shell, "Windows stub should return empty")
 		return
 	}
@@ -65,9 +65,9 @@ func TestGetShellFromGetent_CurrentUser(t *testing.T) {
 	require.NoError(t, err)
 
 	// getent may not be available on all systems (e.g., macOS without Homebrew getent)
-	shell := getShellFromGetent(current.Uid)
+	shell := GetShellFromGetent(current.Uid)
 	if shell == "" {
-		t.Log("getShellFromGetent returned empty, getent may not be available")
+		t.Log("GetShellFromGetent returned empty, getent may not be available")
 		return
 	}
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
@@ -78,7 +78,7 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 		t.Skip("no root user on Windows")
 	}
 
-	u, err := lookupWithGetent("root")
+	u, err := LookupWithGetent("root")
 	if err != nil {
 		t.Skip("root user not available on this system")
 	}
@@ -86,25 +86,25 @@ func TestLookupWithGetent_RootUser(t *testing.T) {
 }
 
 // TestIntegration_FullLookupChain exercises the complete user lookup chain
-// against the real system, testing that all wrappers (lookupWithGetent,
-// currentUserWithGetent, groupIdsWithFallback, getShellFromGetent) produce
+// against the real system, testing that all wrappers (LookupWithGetent,
+// CurrentUserWithGetent, GroupIdsWithFallback, GetShellFromGetent) produce
 // consistent and correct results when composed together.
 func TestIntegration_FullLookupChain(t *testing.T) {
-	// Step 1: currentUserWithGetent must resolve the running user.
-	current, err := currentUserWithGetent()
-	require.NoError(t, err, "currentUserWithGetent must resolve the running user")
+	// Step 1: CurrentUserWithGetent must resolve the running user.
+	current, err := CurrentUserWithGetent()
+	require.NoError(t, err, "CurrentUserWithGetent must resolve the running user")
 	require.NotEmpty(t, current.Uid)
 	require.NotEmpty(t, current.Username)
 
-	// Step 2: lookupWithGetent by the same username must return matching identity.
-	byName, err := lookupWithGetent(current.Username)
+	// Step 2: LookupWithGetent by the same username must return matching identity.
+	byName, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 	assert.Equal(t, current.Uid, byName.Uid, "lookup by name should return same UID")
 	assert.Equal(t, current.Gid, byName.Gid, "lookup by name should return same GID")
 	assert.Equal(t, current.HomeDir, byName.HomeDir, "lookup by name should return same home")
 
-	// Step 3: groupIdsWithFallback must return at least the primary GID.
-	groups, err := groupIdsWithFallback(current)
+	// Step 3: GroupIdsWithFallback must return at least the primary GID.
+	groups, err := GroupIdsWithFallback(current)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "user must have at least one group")
 
@@ -120,10 +120,10 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 	}
 	assert.True(t, foundPrimary, "primary GID %s should appear in supplementary groups", current.Gid)
 
-	// Step 4: getShellFromGetent should either return a valid shell path or empty
+	// Step 4: GetShellFromGetent should either return a valid shell path or empty
 	// (empty is OK when getent is not available, e.g. macOS without Homebrew getent).
 	if runtime.GOOS != "windows" {
-		shell := getShellFromGetent(current.Uid)
+		shell := GetShellFromGetent(current.Uid)
 		if shell != "" {
 			assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 		}
@@ -131,17 +131,17 @@ func TestIntegration_FullLookupChain(t *testing.T) {
 }
 
 // TestIntegration_LookupAndGroupsConsistency verifies that a user resolved via
-// lookupWithGetent can have their groups resolved via groupIdsWithFallback,
+// LookupWithGetent can have their groups resolved via GroupIdsWithFallback,
 // testing the handoff between the two functions as used by the SSH server.
 func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
 	// Simulate the SSH server flow: lookup user, then get their groups.
-	resolved, err := lookupWithGetent(current.Username)
+	resolved, err := LookupWithGetent(current.Username)
 	require.NoError(t, err)
 
-	groups, err := groupIdsWithFallback(resolved)
+	groups, err := GroupIdsWithFallback(resolved)
 	require.NoError(t, err)
 	require.NotEmpty(t, groups, "resolved user must have groups")
 
@@ -156,7 +156,7 @@ func TestIntegration_LookupAndGroupsConsistency(t *testing.T) {
 }
 
 // TestIntegration_ShellLookupChain tests the full shell resolution chain
-// (getShellFromPasswd -> getShellFromGetent -> $SHELL -> default) on Unix.
+// (getShellFromPasswd -> GetShellFromGetent -> $SHELL -> default) on Unix.
 func TestIntegration_ShellLookupChain(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Unix shell lookup not applicable on Windows")
@@ -165,8 +165,8 @@ func TestIntegration_ShellLookupChain(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	// getUserShell is the top-level function used by the SSH server.
-	shell := getUserShell(current.Uid)
-	require.NotEmpty(t, shell, "getUserShell must always return a shell")
+	// GetUserShell is the top-level function used by the SSH server.
+	shell := GetUserShell(current.Uid)
+	require.NotEmpty(t, shell, "GetUserShell must always return a shell")
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 }

client/internal/shell/getent_unix.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package server
+package shell
 
 import (
 	"context"
@@ -14,19 +14,26 @@ import (
 
 const getentTimeout = 5 * time.Second
 
-// getShellFromGetent gets a user's login shell via getent by UID.
+// GetShellFromGetent gets a user's login shell via getent by UID.
 // This is needed even with CGO because getShellFromPasswd reads /etc/passwd
 // directly and won't find NSS-provided users there.
-func getShellFromGetent(userID string) string {
-	_, shell, err := runGetent(userID)
+func GetShellFromGetent(userID string) string {
+	_, shell, err := runGetentPasswd(userID)
 	if err != nil {
 		return ""
 	}
 	return shell
 }
 
-// runGetent executes `getent passwd <query>` and returns the user and login shell.
-func runGetent(query string) (*user.User, string, error) {
+// GetUserFromGetent returns the resolved user from either a uid or username,
+// going through the host's NSS stack.
+func GetUserFromGetent(query string) (*user.User, error) {
+	u, _, err := runGetentPasswd(query)
+	return u, err
+}
+
+// runGetentPasswd executes `getent passwd <query>` and returns the user and login shell.
+func runGetentPasswd(query string) (*user.User, string, error) {
 	if !validateGetentInput(query) {
 		return nil, "", fmt.Errorf("invalid getent input: %q", query)
 	}
@@ -42,7 +49,24 @@ func runGetent(query string) (*user.User, string, error) {
 	return parseGetentPasswd(string(out))
 }
 
-// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell"
+// runGetentGroup executes `getent group <query>` and returns the group.
+func runGetentGroup(query string) (*user.Group, error) {
+	if !validateGetentInput(query) {
+		return nil, fmt.Errorf("invalid getent input: %q", query)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), getentTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "getent", "group", query).Output()
+	if err != nil {
+		return nil, fmt.Errorf("getent group %s: %w", query, err)
+	}
+
+	return parseGetentGroup(string(out))
+}
+
+// parseGetentPasswd parses getent passwd output: "name:x:uid:gid:gecos:home:shell".
 func parseGetentPasswd(output string) (*user.User, string, error) {
 	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
 	if len(fields) < 6 {
@@ -67,6 +91,20 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 	}, shell, nil
 }
 
+// parseGetentGroup parses getent group output: "group:x:gid:members".
+func parseGetentGroup(output string) (*user.Group, error) {
+	fields := strings.SplitN(strings.TrimSpace(output), ":", 8)
+	if len(fields) < 4 {
+		return nil, fmt.Errorf("unexpected getent output (need 4+ fields): %q", output)
+	}
+
+	if fields[0] == "" || fields[2] == "" {
+		return nil, fmt.Errorf("missing required fields in getent output: %q", output)
+	}
+
+	return &user.Group{Gid: fields[2], Name: fields[0]}, nil
+}
+
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
 // (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is

client/internal/shell/getent_unix_test.go

@@ -1,6 +1,6 @@
 //go:build !windows
 
-package server
+package shell
 
 import (
 	"os/exec"
@@ -198,7 +198,7 @@ func TestRunGetent_RootUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, shell, err := runGetent("root")
+	u, shell, err := runGetentPasswd("root")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -211,7 +211,7 @@ func TestRunGetent_ByUID(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	u, _, err := runGetent("0")
+	u, _, err := runGetentPasswd("0")
 	require.NoError(t, err)
 	assert.Equal(t, "root", u.Username)
 	assert.Equal(t, "0", u.Uid)
@@ -222,15 +222,15 @@ func TestRunGetent_NonexistentUser(t *testing.T) {
 		t.Skip("getent not available on this system")
 	}
 
-	_, _, err := runGetent("nonexistent_user_xyzzy_12345")
+	_, _, err := runGetentPasswd("nonexistent_user_xyzzy_12345")
 	assert.Error(t, err)
 }
 
 func TestRunGetent_InvalidInput(t *testing.T) {
-	_, _, err := runGetent("")
+	_, _, err := runGetentPasswd("")
 	assert.Error(t, err)
 
-	_, _, err = runGetent("user\x00name")
+	_, _, err = runGetentPasswd("user\x00name")
 	assert.Error(t, err)
 }
 
@@ -239,7 +239,7 @@ func TestRunGetent_NotAvailable(t *testing.T) {
 		t.Skip("getent is available, can't test missing case")
 	}
 
-	_, _, err := runGetent("root")
+	_, _, err := runGetentPasswd("root")
 	assert.Error(t, err, "should fail when getent is not installed")
 }
 
@@ -286,7 +286,7 @@ func TestGetentResultsMatchStdlib(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Username)
+	getentUser, _, err := runGetentPasswd(current.Username)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match")
@@ -303,7 +303,7 @@ func TestGetentResultsMatchStdlib_ByUID(t *testing.T) {
 	current, err := user.Current()
 	require.NoError(t, err)
 
-	getentUser, _, err := runGetent(current.Uid)
+	getentUser, _, err := runGetentPasswd(current.Uid)
 	require.NoError(t, err)
 
 	assert.Equal(t, current.Username, getentUser.Username, "username should match when looked up by UID")
@@ -359,7 +359,7 @@ func TestGetShellFromPasswd_CurrentUser(t *testing.T) {
 	assert.True(t, shell[0] == '/', "shell should be an absolute path, got %q", shell)
 
 	if _, err := exec.LookPath("getent"); err == nil {
-		_, getentShell, getentErr := runGetent(current.Uid)
+		_, getentShell, getentErr := runGetentPasswd(current.Uid)
 		if getentErr == nil && getentShell != "" {
 			assert.Equal(t, getentShell, shell, "shell from /etc/passwd should match getent")
 		}
@@ -403,7 +403,7 @@ func TestGetShellFromPasswd_MatchesGetentForKnownUsers(t *testing.T) {
 			continue
 		}
 
-		_, getentShell, err := runGetent(uid)
+		_, getentShell, err := runGetentPasswd(uid)
 		if err != nil {
 			continue
 		}

client/internal/shell/getent_windows.go

@@ -0,0 +1,31 @@
+//go:build windows
+
+package shell
+
+import "os/user"
+
+// LookupWithGetent on Windows just delegates to os/user.Lookup.
+// Windows does not use NSS/getent; its user lookup works without CGO.
+func LookupWithGetent(username string) (*user.User, error) {
+	return user.Lookup(username)
+}
+
+// CurrentUserWithGetent on Windows just delegates to os/user.Current.
+func CurrentUserWithGetent() (*user.User, error) {
+	return user.Current()
+}
+
+// LookupGroupWithGetent on Windows just delegates to os/user.LookupGroup.
+func LookupGroupWithGetent(name string) (*user.Group, error) {
+	return user.LookupGroup(name)
+}
+
+// GetShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
+func GetShellFromGetent(_ string) string {
+	return ""
+}
+
+// GroupIdsWithFallback on Windows just delegates to u.GroupIds().
+func GroupIdsWithFallback(u *user.User) ([]string, error) {
+	return u.GroupIds()
+}

client/internal/shell/shell.go

@@ -1,17 +1,14 @@
-package server
+package shell
 
 import (
 	"bufio"
 	"fmt"
-	"net"
 	"os"
 	"os/exec"
 	"os/user"
 	"runtime"
-	"strconv"
 	"strings"
 
-	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -22,9 +19,9 @@ const (
 	powershellExe = "powershell.exe"
 )
 
-// getUserShell returns the appropriate shell for the given user ID
-// Handles all platform-specific logic and fallbacks consistently
-func getUserShell(userID string) string {
+// GetUserShell returns the appropriate shell for the given user ID.
+// Handles all platform-specific logic and fallbacks consistently.
+func GetUserShell(userID string) string {
 	switch runtime.GOOS {
 	case "windows":
 		return getWindowsUserShell()
@@ -56,7 +53,7 @@ func getUnixUserShell(userID string) string {
 		return shell
 	}
 
-	if shell := getShellFromGetent(userID); shell != "" {
+	if shell := GetShellFromGetent(userID); shell != "" {
 		return shell
 	}
 
@@ -67,7 +64,7 @@ func getUnixUserShell(userID string) string {
 	return defaultUnixShell
 }
 
-// getShellFromPasswd reads the shell from /etc/passwd for the given user ID
+// getShellFromPasswd reads the shell from /etc/passwd for the given user ID.
 func getShellFromPasswd(userID string) string {
 	file, err := os.Open("/etc/passwd")
 	if err != nil {
@@ -101,8 +98,8 @@ func getShellFromPasswd(userID string) string {
 	return ""
 }
 
-// prepareUserEnv prepares environment variables for user execution
-func prepareUserEnv(user *user.User, shell string) []string {
+// PrepareUserEnv prepares environment variables for user execution.
+func PrepareUserEnv(user *user.User, shell string) []string {
 	pathValue := "/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 	if runtime.GOOS == "windows" {
 		pathValue = `C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0`
@@ -117,9 +114,9 @@ func prepareUserEnv(user *user.User, shell string) []string {
 	}
 }
 
-// acceptEnv checks if environment variable from SSH client should be accepted
-// This is a whitelist of variables that SSH clients can send to the server
-func acceptEnv(envVar string) bool {
+// AcceptEnv checks if an environment variable from an SSH client should be accepted.
+// This is a whitelist of variables that SSH clients can send to the server.
+func AcceptEnv(envVar string) bool {
 	varName := envVar
 	if idx := strings.Index(envVar, "="); idx != -1 {
 		varName = envVar[:idx]
@@ -156,29 +153,3 @@ func acceptEnv(envVar string) bool {
 
 	return false
 }
-
-// prepareSSHEnv prepares SSH protocol-specific environment variables
-// These variables provide information about the SSH connection itself
-func prepareSSHEnv(session ssh.Session) []string {
-	remoteAddr := session.RemoteAddr()
-	localAddr := session.LocalAddr()
-
-	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
-	if err != nil {
-		remoteHost = remoteAddr.String()
-		remotePort = "0"
-	}
-
-	localHost, localPort, err := net.SplitHostPort(localAddr.String())
-	if err != nil {
-		localHost = localAddr.String()
-		localPort = strconv.Itoa(InternalSSHPort)
-	}
-
-	return []string{
-		// SSH_CLIENT format: "client_ip client_port server_port"
-		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
-		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
-		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
-	}
-}

client/proto/daemon.pb.gw.go

@@ -791,6 +791,78 @@ func local_request_DaemonService_GetActiveProfile_0(ctx context.Context, marshal
 	return msg, metadata, err
 }
 
+func request_DaemonService_AddOwner_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.AddOwner(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_AddOwner_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.AddOwner(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ResetOwner_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResetOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ResetOwner(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ResetOwner_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ResetOwnerRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ResetOwner(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ShareProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ShareProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ShareProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ShareProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ShareProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ShareProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 func request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var (
 		protoReq LogoutRequest
@@ -1730,6 +1802,66 @@ func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/AddOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_AddOwner_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ResetOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ResetOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/ResetOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ResetOwner_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ResetOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ShareProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ShareProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/ShareProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ShareProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ShareProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2581,6 +2713,57 @@ func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/AddOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_AddOwner_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ResetOwner_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ResetOwner", runtime.WithHTTPPathPattern("/daemon.DaemonService/ResetOwner"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ResetOwner_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ResetOwner_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ShareProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ShareProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/ShareProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ShareProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ShareProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2855,6 +3038,9 @@ var (
 	pattern_DaemonService_RemoveProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RemoveProfile"}, ""))
 	pattern_DaemonService_ListProfiles_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListProfiles"}, ""))
 	pattern_DaemonService_GetActiveProfile_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetActiveProfile"}, ""))
+	pattern_DaemonService_AddOwner_0                   = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "AddOwner"}, ""))
+	pattern_DaemonService_ResetOwner_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ResetOwner"}, ""))
+	pattern_DaemonService_ShareProfile_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ShareProfile"}, ""))
 	pattern_DaemonService_Logout_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Logout"}, ""))
 	pattern_DaemonService_GetFeatures_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetFeatures"}, ""))
 	pattern_DaemonService_TriggerUpdate_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TriggerUpdate"}, ""))
@@ -2904,6 +3090,9 @@ var (
 	forward_DaemonService_RemoveProfile_0              = runtime.ForwardResponseMessage
 	forward_DaemonService_ListProfiles_0               = runtime.ForwardResponseMessage
 	forward_DaemonService_GetActiveProfile_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_AddOwner_0                   = runtime.ForwardResponseMessage
+	forward_DaemonService_ResetOwner_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_ShareProfile_0               = runtime.ForwardResponseMessage
 	forward_DaemonService_Logout_0                     = runtime.ForwardResponseMessage
 	forward_DaemonService_GetFeatures_0                = runtime.ForwardResponseMessage
 	forward_DaemonService_TriggerUpdate_0              = runtime.ForwardResponseMessage

client/proto/daemon.proto

@@ -104,6 +104,18 @@ service DaemonService {
 
   rpc GetActiveProfile(GetActiveProfileRequest) returns (GetActiveProfileResponse) {}
 
+  // AddOwner adds a principal to the active profile's owner list. Requires the
+  // caller to be privileged (root/administrator) or an existing owner.
+  rpc AddOwner(AddOwnerRequest) returns (AddOwnerResponse) {}
+
+  // ResetOwner clears the active profile's owner list, returning it to the
+  // unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+  rpc ResetOwner(ResetOwnerRequest) returns (ResetOwnerResponse) {}
+
+  // ShareProfile marks the active profile shared (any local caller) or unshared.
+  // Requires the caller to be an owner or privileged.
+  rpc ShareProfile(ShareProfileRequest) returns (ShareProfileResponse) {}
+
   // Logout disconnects from the network and deletes the peer from the management server
   rpc Logout(LogoutRequest) returns (LogoutResponse) {}
 
@@ -270,6 +282,10 @@ message UpRequest {
   // RPC blocks until the engine is running or gives up, which is the behaviour
   // needed by the CLI.
   bool async = 4;
+
+  // claimOwner, when true, claims ownership of the active profile for the
+  // calling user (adds their kernel principal to the profile's owner list).
+  bool claimOwner = 5;
 }
 
 message UpResponse {}
@@ -774,6 +790,24 @@ message AddProfileResponse {
   string id = 1;
 }
 
+message AddOwnerRequest {
+  // principal is a typed owner string: "uid:1000", "gid:1000",
+  // "group:netbird-admins" (Unix, NSS-resolved), or "sid:S-1-5-..." (Windows).
+  string principal = 1;
+}
+
+message AddOwnerResponse {}
+
+message ResetOwnerRequest {}
+
+message ResetOwnerResponse {}
+
+message ShareProfileRequest {
+  bool shared = 1;
+}
+
+message ShareProfileResponse {}
+
 message RenameProfileRequest {
   string username = 1;
   // handle: an exact ID, a unique ID prefix, or a unique display name.

client/proto/daemon_grpc.pb.go

@@ -51,6 +51,9 @@ const (
 	DaemonService_RemoveProfile_FullMethodName              = "/daemon.DaemonService/RemoveProfile"
 	DaemonService_ListProfiles_FullMethodName               = "/daemon.DaemonService/ListProfiles"
 	DaemonService_GetActiveProfile_FullMethodName           = "/daemon.DaemonService/GetActiveProfile"
+	DaemonService_AddOwner_FullMethodName                   = "/daemon.DaemonService/AddOwner"
+	DaemonService_ResetOwner_FullMethodName                 = "/daemon.DaemonService/ResetOwner"
+	DaemonService_ShareProfile_FullMethodName               = "/daemon.DaemonService/ShareProfile"
 	DaemonService_Logout_FullMethodName                     = "/daemon.DaemonService/Logout"
 	DaemonService_GetFeatures_FullMethodName                = "/daemon.DaemonService/GetFeatures"
 	DaemonService_TriggerUpdate_FullMethodName              = "/daemon.DaemonService/TriggerUpdate"
@@ -132,6 +135,15 @@ type DaemonServiceClient interface {
 	RemoveProfile(ctx context.Context, in *RemoveProfileRequest, opts ...grpc.CallOption) (*RemoveProfileResponse, error)
 	ListProfiles(ctx context.Context, in *ListProfilesRequest, opts ...grpc.CallOption) (*ListProfilesResponse, error)
 	GetActiveProfile(ctx context.Context, in *GetActiveProfileRequest, opts ...grpc.CallOption) (*GetActiveProfileResponse, error)
+	// AddOwner adds a principal to the active profile's owner list. Requires the
+	// caller to be privileged (root/administrator) or an existing owner.
+	AddOwner(ctx context.Context, in *AddOwnerRequest, opts ...grpc.CallOption) (*AddOwnerResponse, error)
+	// ResetOwner clears the active profile's owner list, returning it to the
+	// unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+	ResetOwner(ctx context.Context, in *ResetOwnerRequest, opts ...grpc.CallOption) (*ResetOwnerResponse, error)
+	// ShareProfile marks the active profile shared (any local caller) or unshared.
+	// Requires the caller to be an owner or privileged.
+	ShareProfile(ctx context.Context, in *ShareProfileRequest, opts ...grpc.CallOption) (*ShareProfileResponse, error)
 	// Logout disconnects from the network and deletes the peer from the management server
 	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
 	GetFeatures(ctx context.Context, in *GetFeaturesRequest, opts ...grpc.CallOption) (*GetFeaturesResponse, error)
@@ -528,6 +540,36 @@ func (c *daemonServiceClient) GetActiveProfile(ctx context.Context, in *GetActiv
 	return out, nil
 }
 
+func (c *daemonServiceClient) AddOwner(ctx context.Context, in *AddOwnerRequest, opts ...grpc.CallOption) (*AddOwnerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AddOwnerResponse)
+	err := c.cc.Invoke(ctx, DaemonService_AddOwner_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) ResetOwner(ctx context.Context, in *ResetOwnerRequest, opts ...grpc.CallOption) (*ResetOwnerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ResetOwnerResponse)
+	err := c.cc.Invoke(ctx, DaemonService_ResetOwner_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) ShareProfile(ctx context.Context, in *ShareProfileRequest, opts ...grpc.CallOption) (*ShareProfileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ShareProfileResponse)
+	err := c.cc.Invoke(ctx, DaemonService_ShareProfile_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LogoutResponse)
@@ -742,6 +784,15 @@ type DaemonServiceServer interface {
 	RemoveProfile(context.Context, *RemoveProfileRequest) (*RemoveProfileResponse, error)
 	ListProfiles(context.Context, *ListProfilesRequest) (*ListProfilesResponse, error)
 	GetActiveProfile(context.Context, *GetActiveProfileRequest) (*GetActiveProfileResponse, error)
+	// AddOwner adds a principal to the active profile's owner list. Requires the
+	// caller to be privileged (root/administrator) or an existing owner.
+	AddOwner(context.Context, *AddOwnerRequest) (*AddOwnerResponse, error)
+	// ResetOwner clears the active profile's owner list, returning it to the
+	// unowned state (next caller re-claims via trust-on-first-use). Privileged only.
+	ResetOwner(context.Context, *ResetOwnerRequest) (*ResetOwnerResponse, error)
+	// ShareProfile marks the active profile shared (any local caller) or unshared.
+	// Requires the caller to be an owner or privileged.
+	ShareProfile(context.Context, *ShareProfileRequest) (*ShareProfileResponse, error)
 	// Logout disconnects from the network and deletes the peer from the management server
 	Logout(context.Context, *LogoutRequest) (*LogoutResponse, error)
 	GetFeatures(context.Context, *GetFeaturesRequest) (*GetFeaturesResponse, error)
@@ -887,6 +938,15 @@ func (UnimplementedDaemonServiceServer) ListProfiles(context.Context, *ListProfi
 func (UnimplementedDaemonServiceServer) GetActiveProfile(context.Context, *GetActiveProfileRequest) (*GetActiveProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetActiveProfile not implemented")
 }
+func (UnimplementedDaemonServiceServer) AddOwner(context.Context, *AddOwnerRequest) (*AddOwnerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method AddOwner not implemented")
+}
+func (UnimplementedDaemonServiceServer) ResetOwner(context.Context, *ResetOwnerRequest) (*ResetOwnerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ResetOwner not implemented")
+}
+func (UnimplementedDaemonServiceServer) ShareProfile(context.Context, *ShareProfileRequest) (*ShareProfileResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ShareProfile not implemented")
+}
 func (UnimplementedDaemonServiceServer) Logout(context.Context, *LogoutRequest) (*LogoutResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Logout not implemented")
 }
@@ -1505,6 +1565,60 @@ func _DaemonService_GetActiveProfile_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_AddOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AddOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).AddOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_AddOwner_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).AddOwner(ctx, req.(*AddOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_ResetOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResetOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).ResetOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_ResetOwner_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).ResetOwner(ctx, req.(*ResetOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_ShareProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ShareProfileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).ShareProfile(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_ShareProfile_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).ShareProfile(ctx, req.(*ShareProfileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_Logout_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(LogoutRequest)
 	if err := dec(in); err != nil {
@@ -1873,6 +1987,18 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetActiveProfile",
 			Handler:    _DaemonService_GetActiveProfile_Handler,
 		},
+		{
+			MethodName: "AddOwner",
+			Handler:    _DaemonService_AddOwner_Handler,
+		},
+		{
+			MethodName: "ResetOwner",
+			Handler:    _DaemonService_ResetOwner_Handler,
+		},
+		{
+			MethodName: "ShareProfile",
+			Handler:    _DaemonService_ShareProfile_Handler,
+		},
 		{
 			MethodName: "Logout",
 			Handler:    _DaemonService_Logout_Handler,

client/server/ownership.go

@@ -0,0 +1,204 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// The daemon Server implements ipcauth.ProfilePolicy so the gRPC interceptor can
+// authorize each RPC against the active profile's ownership.
+var _ ipcauth.ProfilePolicy = (*Server)(nil)
+
+// ActiveProfileOwnership returns the active profile's ownership policy. Reads
+// the in-memory active config (kept current by the handlers), falling back to
+// the on-disk active profile when the daemon hasn't loaded one yet.
+func (s *Server) ActiveProfileOwnership() ipcauth.Ownership {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg := s.config
+	if cfg == nil {
+		loaded, err := s.loadActiveProfileConfigLocked()
+		if err != nil {
+			log.Warnf("ownership: cannot load active profile config, treating as unowned: %v", err)
+			return ipcauth.Ownership{}
+		}
+		cfg = loaded
+	}
+	return ipcauth.Ownership{Owners: cfg.Owners, Shared: cfg.Shared}
+}
+
+// ClaimActiveProfileOwnerIfUnowned atomically claims the active profile for id
+// when it has no owners and is not shared (trust-on-first-use). Returns whether
+// id is now an owner. Concurrent first-callers are serialized by s.mutex, so
+// exactly one wins the claim; the others get false and are authorized normally.
+func (s *Server) ClaimActiveProfileOwnerIfUnowned(id ipcauth.Identity) (bool, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg := s.config
+	if cfg == nil {
+		loaded, err := s.loadActiveProfileConfigLocked()
+		if err != nil {
+			return false, fmt.Errorf("load active profile config: %w", err)
+		}
+		cfg = loaded
+	}
+
+	if len(cfg.Owners) > 0 || cfg.Shared {
+		return false, nil // already owned or shared — someone won the race
+	}
+
+	cfg.Owners = []string{ipcauth.OwnerPrincipalForIdentity(id)}
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = nil // revert in-memory on persistence failure
+		return false, fmt.Errorf("persist claimed ownership: %w", err)
+	}
+	s.config = cfg
+	log.Infof("profile ownership claimed by %s (trust-on-first-use)", id)
+	return true, nil
+}
+
+// activeProfileConfigPathLocked resolves the active profile's config file path.
+func (s *Server) activeProfileConfigPathLocked() (string, error) {
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return "", fmt.Errorf("get active profile: %w", err)
+	}
+	path, err := activeProf.FilePath()
+	if err != nil {
+		return "", fmt.Errorf("resolve active profile path: %w", err)
+	}
+	return path, nil
+}
+
+// loadActiveProfileConfigLocked reads the active profile's config from disk.
+func (s *Server) loadActiveProfileConfigLocked() (*profilemanager.Config, error) {
+	path, err := s.activeProfileConfigPathLocked()
+	if err != nil {
+		return nil, err
+	}
+	return profilemanager.GetConfig(path)
+}
+
+// persistActiveProfileConfigLocked writes cfg to the active profile's config file.
+func (s *Server) persistActiveProfileConfigLocked(cfg *profilemanager.Config) error {
+	path, err := s.activeProfileConfigPathLocked()
+	if err != nil {
+		return err
+	}
+	return util.WriteJson(context.Background(), path, cfg)
+}
+
+// activeConfigLocked returns the in-memory active config, loading it from disk
+// if the daemon hasn't cached one. Caller must hold s.mutex.
+func (s *Server) activeConfigLocked() (*profilemanager.Config, error) {
+	if s.config != nil {
+		return s.config, nil
+	}
+	return s.loadActiveProfileConfigLocked()
+}
+
+// claimForCallerLocked adds the caller's principal to cfg (if absent) and
+// persists. No-op for privileged callers (they need no ownership entry). Caller
+// must hold s.mutex.
+func (s *Server) claimForCallerLocked(id ipcauth.Identity, cfg *profilemanager.Config) error {
+	if id.IsPrivileged() {
+		return nil
+	}
+	principal := ipcauth.OwnerPrincipalForIdentity(id)
+	if slices.Contains(cfg.Owners, principal) {
+		return nil
+	}
+	cfg.Owners = append(cfg.Owners, principal)
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = cfg.Owners[:len(cfg.Owners)-1] // revert on failure
+		return err
+	}
+	s.config = cfg
+	return nil
+}
+
+// AddOwner adds a principal to the active profile's owner list. The interceptor
+// has already confirmed the caller is an owner or privileged; the handler just
+// validates and persists.
+func (s *Server) AddOwner(_ context.Context, msg *proto.AddOwnerRequest) (*proto.AddOwnerResponse, error) {
+	principal := msg.GetPrincipal()
+	if _, ok := ipcauth.ParsePrincipal(principal); !ok {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "invalid owner principal %q (expected uid:/gid:/group:/sid:)", principal)
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	if slices.Contains(cfg.Owners, principal) {
+		return &proto.AddOwnerResponse{}, nil
+	}
+	cfg.Owners = append(cfg.Owners, principal)
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		cfg.Owners = cfg.Owners[:len(cfg.Owners)-1]
+		return nil, fmt.Errorf("persist owner: %w", err)
+	}
+	s.config = cfg
+	log.Infof("added owner %q to the active profile", principal)
+	return &proto.AddOwnerResponse{}, nil
+}
+
+// ResetOwner clears the active profile's owner list (and shared flag), returning
+// it to the unowned state so the next caller re-claims via trust-on-first-use.
+// Privileged-only, so co-owners cannot evict each other.
+func (s *Server) ResetOwner(ctx context.Context, _ *proto.ResetOwnerRequest) (*proto.ResetOwnerResponse, error) {
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok || !id.IsPrivileged() {
+		return nil, gstatus.Error(codes.PermissionDenied, "reset-owner requires root/administrator")
+	}
+
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	cfg.Owners = nil
+	cfg.Shared = false
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		return nil, fmt.Errorf("persist owner reset: %w", err)
+	}
+	s.config = cfg
+	log.Infof("active profile owner list reset; next caller will re-claim (trust-on-first-use)")
+	return &proto.ResetOwnerResponse{}, nil
+}
+
+// ShareProfile marks the active profile shared or unshared. The interceptor has
+// already confirmed the caller is an owner or privileged.
+func (s *Server) ShareProfile(_ context.Context, msg *proto.ShareProfileRequest) (*proto.ShareProfileResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	cfg, err := s.activeConfigLocked()
+	if err != nil {
+		return nil, fmt.Errorf("load active profile config: %w", err)
+	}
+	cfg.Shared = msg.GetShared()
+	if err := s.persistActiveProfileConfigLocked(cfg); err != nil {
+		return nil, fmt.Errorf("persist shared flag: %w", err)
+	}
+	s.config = cfg
+	log.Infof("active profile shared flag set to %t", msg.GetShared())
+	return &proto.ShareProfileResponse{}, nil
+}

client/server/profile_authz.go

@@ -0,0 +1,53 @@
+package server
+
+import (
+	"context"
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// bindCallerUsername enforces that a non-privileged caller may only operate on
+// its OWN user's profiles. Profiles live in per-username directories, but the
+// username is a client-supplied gRPC field the server historically never
+// checked; binding it to the caller's kernel identity closes the "pass another
+// user's username" hole. Privileged callers (root / elevated-admin) may manage
+// any user's profiles.
+func (s *Server) bindCallerUsername(ctx context.Context, requested string) error {
+	if requested == "" {
+		return nil // handlers validate emptiness themselves; nothing to bind
+	}
+
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok {
+		return gstatus.Error(codes.PermissionDenied, "caller identity could not be verified")
+	}
+	if id.IsPrivileged() {
+		return nil
+	}
+
+	caller, err := usernameForIdentity(id)
+	if err != nil {
+		log.Warnf("profile authz: resolve caller username for %s: %v", id, err)
+		return gstatus.Error(codes.PermissionDenied, "could not resolve caller identity to a username")
+	}
+	if !usernamesEqual(requested, caller) {
+		return gstatus.Errorf(codes.PermissionDenied,
+			"not authorized to operate on another user's profiles (caller %q requested %q)", caller, requested)
+	}
+	return nil
+}
+
+// usernamesEqual compares usernames case-insensitively on Windows (domain
+// accounts) and exactly on Unix.
+func usernamesEqual(a, b string) bool {
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(a, b)
+	}
+	return a == b
+}

client/server/profile_authz_unix.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package server
+
+import (
+	"strconv"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/shell"
+)
+
+// usernameForIdentity resolves a Unix caller's UID to its username via NSS
+// (getent), so LDAP/AD users resolve correctly under CGO_ENABLED=0.
+func usernameForIdentity(id ipcauth.Identity) (string, error) {
+	u, err := shell.GetUserFromGetent(strconv.FormatUint(uint64(id.UID), 10))
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}

client/server/profile_authz_windows.go

@@ -0,0 +1,18 @@
+//go:build windows
+
+package server
+
+import (
+	"os/user"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// usernameForIdentity resolves a Windows caller's SID to its account name.
+func usernameForIdentity(id ipcauth.Identity) (string, error) {
+	u, err := user.LookupId(id.SID)
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}

client/server/server.go

@@ -23,6 +23,7 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
 	"github.com/netbirdio/netbird/client/mdm"
@@ -402,6 +403,12 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		}
 	}
 
+	// M-SSHGATE: turning on SSH root login / disabling SSH auth requires a
+	// privileged caller (root or elevated admin).
+	if err := requirePrivilegedForDangerousSSH(callerCtx, msg.EnableSSHRoot, msg.DisableSSHAuth); err != nil {
+		return nil, err
+	}
+
 	// MDM gate: refuse the whole request if any of its fields is enforced
 	// by the active MDM policy. The error carries an MDMManagedFields-
 	// Violation detail listing the offending key names. Non-conflicting
@@ -537,6 +544,12 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}
 
+	// M-SSHGATE: turning on SSH root login / disabling SSH auth requires a
+	// privileged caller (root or elevated admin).
+	if err := requirePrivilegedForDangerousSSH(callerCtx, msg.EnableSSHRoot, msg.DisableSSHAuth); err != nil {
+		return nil, err
+	}
+
 	s.mutex.Lock()
 	if s.actCancel != nil {
 		s.actCancel()
@@ -943,6 +956,17 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	}
 	s.config = config
 
+	// --owner: explicitly claim ownership of the active profile for the caller.
+	if msg != nil && msg.GetClaimOwner() {
+		if id, ok := ipcauth.IdentityFromContext(callerCtx); ok {
+			if err := s.claimForCallerLocked(id, s.config); err != nil {
+				s.mutex.Unlock()
+				log.Errorf("failed to claim profile ownership: %v", err)
+				return nil, fmt.Errorf("claim owner: %w", err)
+			}
+		}
+	}
+
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
@@ -1048,6 +1072,16 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 	}
 
 	if msg != nil && msg.ProfileName != nil {
+		targetUsername := ""
+		if msg.Username != nil {
+			targetUsername = *msg.Username
+		}
+		// The interceptor already gated this against the CURRENT active profile;
+		// also bind the TARGET profile's username so a caller can't switch into
+		// another user's profile.
+		if err := s.bindCallerUsername(callerCtx, targetUsername); err != nil {
+			return nil, err
+		}
 		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
 			log.Errorf("failed to switch profile: %v", err)
 			return nil, err
@@ -2005,7 +2039,18 @@ func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and username must be provided")
 	}
 
-	created, err := s.profileManager.AddProfile(msg.ProfileName, msg.Username)
+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
+	// Auto-isolate the new profile to its creator. When root/admin creates it we
+	// leave it unowned so the intended user claims it via trust-on-first-use.
+	var initialOwners []string
+	if id, ok := ipcauth.IdentityFromContext(ctx); ok && !id.IsPrivileged() {
+		initialOwners = []string{ipcauth.OwnerPrincipalForIdentity(id)}
+	}
+
+	created, err := s.profileManager.AddProfile(msg.ProfileName, msg.Username, initialOwners)
 	if err != nil {
 		log.Errorf("failed to create profile: %v", err)
 		return nil, fmt.Errorf("failed to create profile: %w", err)
@@ -2028,6 +2073,10 @@ func (s *Server) RenameProfile(ctx context.Context, msg *proto.RenameProfileRequ
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name, username and new profile name must be provided")
 	}
 
+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	resolved, err := s.resolveProfileHandle(msg.Handle, msg.Username)
 	if err != nil {
 		return nil, err
@@ -2057,6 +2106,10 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name must be provided")
 	}
 
+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	resolved, err := s.resolveProfileHandle(msg.ProfileName, msg.Username)
 	if err != nil {
 		return nil, err
@@ -2125,6 +2178,10 @@ func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesReques
 		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided")
 	}
 
+	if err := s.bindCallerUsername(ctx, msg.Username); err != nil {
+		return nil, err
+	}
+
 	profiles, err := s.profileManager.ListProfiles(msg.Username)
 	if err != nil {
 		log.Errorf("failed to list profiles: %v", err)

client/server/ssh_gate.go

@@ -0,0 +1,44 @@
+package server
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// requirePrivilegedForDangerousSSH enforces M-SSHGATE: enabling SSH root login
+// or disabling SSH authentication turns the root/LocalSystem daemon's SSH server
+// into an unauthenticated root shell (local-to-remote-root escalation), so only
+// a privileged caller (Unix root, or Windows elevated-admin/LocalSystem) may set
+// these flags to true over the local IPC.
+//
+// It gates the request fields, not the resulting config: a value already
+// persisted (e.g. set previously by root, or by MDM/managed config) is untouched;
+// only a new attempt to turn them on via SetConfig/Login is checked.
+//
+// When the caller identity cannot be verified (e.g. the daemon is on a TCP
+// control channel with no peer credentials) it fails closed — refusing rather
+// than letting an unauthenticated local caller flip these flags.
+func requirePrivilegedForDangerousSSH(ctx context.Context, enableSSHRoot, disableSSHAuth *bool) error {
+	dangerous := (enableSSHRoot != nil && *enableSSHRoot) || (disableSSHAuth != nil && *disableSSHAuth)
+	if !dangerous {
+		return nil
+	}
+
+	id, ok := ipcauth.IdentityFromContext(ctx)
+	if !ok {
+		log.Warnf("denying SSH root/no-auth config change: caller identity unavailable on this control channel")
+		return gstatus.Error(codes.PermissionDenied,
+			"enabling SSH root login or disabling SSH authentication requires root/administrator, but the caller identity could not be verified on this daemon control channel")
+	}
+	if !id.IsPrivileged() {
+		log.Warnf("denying SSH root/no-auth config change from non-privileged caller %s", id)
+		return gstatus.Errorf(codes.PermissionDenied,
+			"enabling SSH root login or disabling SSH authentication requires root/administrator (caller %s is not privileged); rerun as root/administrator", id)
+	}
+	return nil
+}

client/server/ssh_gate_test.go

@@ -0,0 +1,52 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+func ctxWithIdentity(id ipcauth.Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{AuthInfo: ipcauth.AuthInfo{Identity: id}})
+}
+
+func boolPtr(b bool) *bool { return &b }
+
+func TestRequirePrivilegedForDangerousSSH(t *testing.T) {
+	root := ipcauth.Identity{UID: 0}
+	user := ipcauth.Identity{UID: 1000}
+
+	tests := []struct {
+		name           string
+		ctx            context.Context
+		enableSSHRoot  *bool
+		disableSSHAuth *bool
+		wantDenied     bool
+	}{
+		{"no flags, no identity", context.Background(), nil, nil, false},
+		{"flags false, non-priv", ctxWithIdentity(user), boolPtr(false), boolPtr(false), false},
+		{"enableSSHRoot by root", ctxWithIdentity(root), boolPtr(true), nil, false},
+		{"enableSSHRoot by non-priv", ctxWithIdentity(user), boolPtr(true), nil, true},
+		{"disableSSHAuth by non-priv", ctxWithIdentity(user), nil, boolPtr(true), true},
+		{"enableSSHRoot no identity (fail closed)", context.Background(), boolPtr(true), nil, true},
+		{"both by root", ctxWithIdentity(root), boolPtr(true), boolPtr(true), false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := requirePrivilegedForDangerousSSH(tt.ctx, tt.enableSSHRoot, tt.disableSSHAuth)
+			if tt.wantDenied {
+				assert.Error(t, err)
+				assert.Equal(t, codes.PermissionDenied, gstatus.Code(err))
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

client/ssh/server/command_execution_unix.go

@@ -20,6 +20,8 @@ import (
 	"github.com/creack/pty"
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // ptyManager manages Pty file operations with thread safety
@@ -146,10 +148,10 @@ func (s *Server) createShellCommand(ctx context.Context, shell string, args []st
 
 // prepareCommandEnv prepares environment variables for command execution on Unix
 func (s *Server) prepareCommandEnv(_ *log.Entry, localUser *user.User, session ssh.Session) []string {
-	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/command_execution_windows.go

@@ -15,6 +15,7 @@ import (
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
 
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 	"github.com/netbirdio/netbird/client/ssh/server/winpty"
 )
 
@@ -247,10 +248,10 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
-		env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+		env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 		env = append(env, prepareSSHEnv(session)...)
 		for _, v := range session.Environ() {
-			if acceptEnv(v) {
+			if shellutil.AcceptEnv(v) {
 				env = append(env, v)
 			}
 		}
@@ -260,7 +261,7 @@ func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, sess
 	env := userEnv
 	env = append(env, prepareSSHEnv(session)...)
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}
@@ -273,7 +274,7 @@ func (s *Server) handlePtyLogin(logger *log.Entry, session ssh.Session, privileg
 		return false
 	}
 
-	shell := getUserShell(privilegeResult.User.Uid)
+	shell := shellutil.GetUserShell(privilegeResult.User.Uid)
 	logger.Infof("starting interactive shell: %s", shell)
 
 	s.executeCommandWithPty(logger, session, nil, privilegeResult, ptyReq, nil)
@@ -384,7 +385,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 	}
 
 	username, domain := s.parseUsername(localUser.Username)
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{
 		Shell:    shell,

client/ssh/server/getent_cgo_unix.go

@@ -1,24 +0,0 @@
-//go:build cgo && !osusergo && !windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent with CGO delegates directly to os/user.Lookup.
-// When CGO is enabled, os/user uses libc (getpwnam_r) which goes through
-// the NSS stack natively. If it fails, the user truly doesn't exist and
-// getent would also fail.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent with CGO delegates directly to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// groupIdsWithFallback with CGO delegates directly to user.GroupIds.
-// libc's getgrouplist handles NSS groups natively.
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/ssh/server/getent_windows.go

@@ -1,26 +0,0 @@
-//go:build windows
-
-package server
-
-import "os/user"
-
-// lookupWithGetent on Windows just delegates to os/user.Lookup.
-// Windows does not use NSS/getent; its user lookup works without CGO.
-func lookupWithGetent(username string) (*user.User, error) {
-	return user.Lookup(username)
-}
-
-// currentUserWithGetent on Windows just delegates to os/user.Current.
-func currentUserWithGetent() (*user.User, error) {
-	return user.Current()
-}
-
-// getShellFromGetent is a no-op on Windows; shell resolution uses PowerShell detection.
-func getShellFromGetent(_ string) string {
-	return ""
-}
-
-// groupIdsWithFallback on Windows just delegates to u.GroupIds().
-func groupIdsWithFallback(u *user.User) ([]string, error) {
-	return u.GroupIds()
-}

client/ssh/server/ssh_env.go

@@ -0,0 +1,35 @@
+package server
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/gliderlabs/ssh"
+)
+
+// prepareSSHEnv prepares SSH protocol-specific environment variables
+// These variables provide information about the SSH connection itself
+func prepareSSHEnv(session ssh.Session) []string {
+	remoteAddr := session.RemoteAddr()
+	localAddr := session.LocalAddr()
+
+	remoteHost, remotePort, err := net.SplitHostPort(remoteAddr.String())
+	if err != nil {
+		remoteHost = remoteAddr.String()
+		remotePort = "0"
+	}
+
+	localHost, localPort, err := net.SplitHostPort(localAddr.String())
+	if err != nil {
+		localHost = localAddr.String()
+		localPort = strconv.Itoa(InternalSSHPort)
+	}
+
+	return []string{
+		// SSH_CLIENT format: "client_ip client_port server_port"
+		fmt.Sprintf("SSH_CLIENT=%s %s %s", remoteHost, remotePort, localPort),
+		// SSH_CONNECTION format: "client_ip client_port server_ip server_port"
+		fmt.Sprintf("SSH_CONNECTION=%s %s %s %s", remoteHost, remotePort, localHost, localPort),
+	}
+}

client/ssh/server/user_utils.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 var (
@@ -23,8 +25,8 @@ func isPlatformUnix() bool {
 
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
-	getCurrentUser         = currentUserWithGetent
-	lookupUser             = lookupWithGetent
+	getCurrentUser         = shellutil.CurrentUserWithGetent
+	lookupUser             = shellutil.LookupWithGetent
 	getCurrentOS           = func() string { return runtime.GOOS }
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 

client/ssh/server/userswitching_unix.go

@@ -16,6 +16,8 @@ import (
 
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // POSIX portable filename character set regex: [a-zA-Z0-9._-]
@@ -160,7 +162,7 @@ func (s *Server) parseUserCredentials(localUser *user.User) (uint32, uint32, []u
 // getSupplementaryGroups retrieves supplementary group IDs for a user.
 // Uses id/getent fallback for NSS users in CGO_ENABLED=0 builds.
 func (s *Server) getSupplementaryGroups(u *user.User) ([]uint32, error) {
-	groupIDStrings, err := groupIdsWithFallback(u)
+	groupIDStrings, err := shellutil.GroupIdsWithFallback(u)
 	if err != nil {
 		return nil, fmt.Errorf("get group IDs for user %s: %w", u.Username, err)
 	}
@@ -196,7 +198,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 		GID:        gid,
 		Groups:     groups,
 		WorkingDir: localUser.HomeDir,
-		Shell:      getUserShell(localUser.Uid),
+		Shell:      shellutil.GetUserShell(localUser.Uid),
 		Command:    session.RawCommand(),
 		PTY:        hasPty,
 	}
@@ -228,7 +230,7 @@ func (s *Server) createPtyCommand(privilegeResult PrivilegeCheckResult, ptyReq s
 func (s *Server) createDirectPtyCommand(session ssh.Session, localUser *user.User, ptyReq ssh.Pty) *exec.Cmd {
 	log.Debugf("creating direct Pty command for user %s (no user switching needed)", localUser.Username)
 
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 	args := s.getShellCommandArgs(shell, session.RawCommand())
 
 	cmd := s.createShellCommand(session.Context(), shell, args)
@@ -245,12 +247,12 @@ func (s *Server) preparePtyEnv(localUser *user.User, ptyReq ssh.Pty, session ssh
 		termType = "xterm-256color"
 	}
 
-	env := prepareUserEnv(localUser, getUserShell(localUser.Uid))
+	env := shellutil.PrepareUserEnv(localUser, shellutil.GetUserShell(localUser.Uid))
 	env = append(env, prepareSSHEnv(session)...)
 	env = append(env, fmt.Sprintf("TERM=%s", termType))
 
 	for _, v := range session.Environ() {
-		if acceptEnv(v) {
+		if shellutil.AcceptEnv(v) {
 			env = append(env, v)
 		}
 	}

client/ssh/server/userswitching_windows.go

@@ -13,6 +13,8 @@ import (
 	"github.com/gliderlabs/ssh"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/windows"
+
+	shellutil "github.com/netbirdio/netbird/client/internal/shell"
 )
 
 // validateUsername validates Windows usernames according to SAM Account Name rules
@@ -104,7 +106,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
 	username, domain := s.parseUsername(localUser.Username)
 
-	shell := getUserShell(localUser.Uid)
+	shell := shellutil.GetUserShell(localUser.Uid)
 
 	rawCmd := session.RawCommand()
 	var command string

client/ui/grpc.go

@@ -3,16 +3,16 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"runtime"
-	"strings"
 	"sync"
 	"time"
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
-	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/netbirdio/netbird/client/cmd"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ui/desktop"
 )
@@ -36,9 +36,7 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 		return c.client, nil
 	}
 
-	cc, err := grpc.NewClient(
-		strings.TrimPrefix(c.addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	opts := []grpc.DialOption{
 		grpc.WithUserAgent(desktop.GetUIUserAgent()),
 		// Cap reconnect backoff at 5s; gRPC's default 120s MaxDelay would
 		// leave the UI waiting 30-60s to notice a freshly-started daemon.
@@ -50,6 +48,12 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 				MaxDelay:   5 * time.Second,
 			},
 		}),
+	}
+
+	cc, err := cmd.DialClientGRPCServer(
+		context.Background(),
+		c.addr,
+		opts...,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("dial daemon: %w", err)
@@ -61,7 +65,7 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 // DaemonAddr returns the default daemon gRPC address: a Unix socket on Linux/macOS, TCP loopback on Windows.
 func DaemonAddr() string {
 	if runtime.GOOS == "windows" {
-		return "tcp://127.0.0.1:41731"
+		return "npipe://netbird"
 	}
 	return "unix:///var/run/netbird.sock"
 }

go.mod

@@ -30,6 +30,7 @@ require (
 
 require (
 	github.com/DeRuina/timberjack v1.4.2
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
@@ -156,7 +157,6 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect