SSH Terminal
Osprey provides a browser-based SSH terminal to connect directly to network devices.
- Right-click a device on the canvas and select SSH to [device name].
- Or click the SSH button in the Node Detail Panel.
- Type your username at the
Login:prompt and press Enter. - Osprey connects to the device, and the device's own banner and password prompt are relayed into the terminal — type your password there, exactly as in a native SSH client. A wrong password re-prompts against the device.
The terminal uses xterm.js with full interactive support. The SSH connection is proxied through the Osprey API server via WebSocket. The SSH proxy can be completely disabled by an administrator via Admin > System Settings > Security > Transport > Disable SSH Terminal Proxy. When disabled, the SSH context menu item and SSH button are hidden across the UI, and WebSocket connections are rejected at the API level.
Telnet fallback is available but disabled by default for security (telnet transmits credentials in cleartext). To enable it, set Allow Telnet Fallback in Admin > System Settings > Security. When enabled and SSH fails, the proxy falls back to telnet (port 23) with a warning displayed to the user.
The SSH proxy negotiates modern, strong crypto first, but also appends a set of legacy fallback algorithms after the modern defaults: CBC/3DES ciphers, SHA-1 key exchange, the hmac-sha1-96 MAC, and the ssh-rsa host key. Older network gear (Cisco IOS/IOL and similar) that previously failed the handshake with "no common algorithm" now connects, while capable devices still negotiate strong algorithms. RC4 and DSA are deliberately excluded, and host-key trust-on-first-use pinning still applies.
On the first connection to a device, Osprey records its SSH host key (Trust On First Use). On later connections it checks the device still presents the same key. If the key has changed, Osprey refuses the connection and shows a red banner in the terminal — this protects against man-in-the-middle attacks.
If the change is expected — the device was re-keyed or replaced (RMA, certificate rotation) — an administrator can resolve it from the terminal. The banner shows the stored and offered key fingerprints; verify out-of-band that the offered fingerprint is the device's real new key, then click Clear stored key & reconnect and confirm. Osprey removes the stored key, reconnects, and trusts the device's current key. The action is recorded in the audit log (who cleared which key, and when). Non-administrators see the warning but must ask an administrator to clear the key.
If enabled by an administrator via Admin > System Settings > Security > Transport > Record terminal sessions (the ssh.session_recording system setting), the device output of SSH/telnet sessions — including the banner and login prompts — is recorded for audit purposes. Typed input (passwords) is never recorded. Administrators can review recordings under Admin > Device Sessions. Session log retention is configurable in Admin > System Settings > Retention > SSH Session Logs (default: 90 days).
When OSPREY_ENCRYPTION_KEY is configured, session recordings are encrypted at rest using AES-256-GCM before storage. Legacy plaintext recordings are transparently decrypted on read.
Admin > Device Sessions
Browse all SSH sessions with:
- Device, Protocol, User, Client IP, Started, Duration, and bytes sent/received
- Terminal-style log viewer for recorded sessions (click a row, or View Log)
- Filter by protocol, and search across device name, router ID and user
The Device column shows the device's hostname; when none was recorded it falls back to the router ID, shown dimmed. User is the Osprey account that opened the session — it reflects the account's current name, so renaming a user also changes it on their earlier sessions.