Add secure dashboard-managed SSH public-key access

Replace server-generated key escrow with public-key-only enable/disable
tasks. Validate ED25519 keys, atomically reconcile one marked
authorized_keys entry, preserve operator keys, and never handle
private keys. Return real task errors and add lifecycle tests.

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.4.0] - 23-09-2026
+
+* Added dashboard-managed SSH public-key access.
+* Validates ED25519 public keys and reports their SHA256 fingerprints.
+* Atomically installs or removes only the marked Edgebox key while preserving all other authorized keys.
+* Never generates, reads, stores, logs, or returns SSH private keys.
+
 ## [1.3.2] - 08-12-2024
 
 * Fix to Browser Dev feature:
@@ -20,4 +27,3 @@
 ### Missing Past Releases
 
 Release notes for past versions are not available in this file. Please refer to the [GitHub releases](https://hithub.com/edgebox-iot/edgeboxctl/releases) for more information. Feel free to contribute to this file by adding missing release notes.
-

Makefile

@@ -67,7 +67,7 @@ run:
 install:
 	@echo "📦 Installing edgeboxctl service (${RELEASE}) for ${GOOS} (${GOARCH})\n"
 	
-	@echo "🚧 Stopping edgeboxctl service if it is running"
+	@echo "�🚧 Stopping edgeboxctl service if it is running"
 	sudo systemctl stop edgeboxctl || true
 
 	@echo "\n🗑️ Removing old edgeboxctl binary and service"

README.md

@@ -59,10 +59,12 @@ To get a local copy up and running follow these simple steps.
 If you're running for development purposes, a docker container suffices, so make sure you have:
 
 * docker
-* docker compose
+* docker compose (docker-compose-v2 package)
 
 Check the following links for more info on [Docker](https://www.docker.com/) and [Docker Compose](https://docs.docker.com/compose/).
 
+**Note:** If you don't have `docker compose` available, install it with: `sudo apt-get install docker-compose-v2`
+
 Aditionally, `edgeboxctl` needs the following bash commands available wherever it runs:
 
 * `arm-linux-gnueabi-gcc` (`sudo apt-get install gcc-arm*`)
@@ -79,10 +81,10 @@ Aditionally, `edgeboxctl` needs the following bash commands available wherever i
 ```sh
 git clone https://github.com/edgebox-iot/edgeboxctl.git
 ```
-2. Run Docker-Compose
+2. Run Docker Compose
-```sh
+
-docker-compose up
 ```
+docker compose up
 
 
 

go.mod

@@ -4,14 +4,15 @@ go 1.15
 
 require (
 	github.com/StackExchange/wmi v0.0.0-20210224194228-fe8f1750fd46 // indirect
+	github.com/dariubs/percent v0.0.0-20200128140941-b7801cf1c7e2 // indirect
+	github.com/dustin/go-humanize v1.0.0 // indirect
 	github.com/go-ole/go-ole v1.2.5 // indirect
-	github.com/go-sql-driver/mysql v1.9.0
+	github.com/go-sql-driver/mysql v1.5.0
-	github.com/go-yaml/yaml v2.1.0+incompatible
+	github.com/go-yaml/yaml v2.1.0+incompatible // indirect
 	github.com/joho/godotenv v1.3.0
-	github.com/mattn/go-sqlite3 v1.14.7
+	github.com/mattn/go-sqlite3 v1.14.7 // indirect
-	github.com/shirou/gopsutil v3.21.4+incompatible
+	github.com/shirou/gopsutil v3.21.4+incompatible // indirect
-	github.com/stretchr/testify v1.10.0 // indirect
 	github.com/tklauser/go-sysconf v0.3.6 // indirect
 	golang.org/x/sys v0.0.0-20210531080801-fdfd190a6549 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0
 )

go.sum

@@ -1,45 +1,74 @@
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/StackExchange/wmi v0.0.0-20210224194228-fe8f1750fd46 h1:5sXbqlSomvdjlRbWyNqkPsJ3Fg+tQZCbgeX1VGljbQY=
 github.com/StackExchange/wmi v0.0.0-20210224194228-fe8f1750fd46/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
+github.com/dariubs/percent v0.0.0-20200128140941-b7801cf1c7e2 h1:5EPE4Uk7ucthLTJAZqZxu6LZluox5/AqXUxJDpzgJjg=
+github.com/dariubs/percent v0.0.0-20200128140941-b7801cf1c7e2/go.mod h1:NDZpkezJ8QqyIW/510MywB5T2KdC8v/0oTlEoPcMsRM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/go-ole/go-ole v1.2.5 h1:t4MGB5xEDZvXI+0rMjjsfBsD7yAgp/s9ZDkL1JndXwY=
 github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-sql-driver/mysql v1.9.0 h1:Y0zIbQXhQKmQgTp44Y1dp3wTXcn804QoTptLZT1vtvo=
+github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
-github.com/go-sql-driver/mysql v1.9.0/go.mod h1:pDetrLJeA3oMujJuvXc8RJoasr589B6A9fwzD3QMrqw=
+github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-yaml/yaml v2.1.0+incompatible h1:RYi2hDdss1u4YE7GwixGzWwVo47T8UQwnTLB6vQiq+o=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/mattn/go-sqlite3 v1.14.7 h1:fxWBnXkxfM6sRiuH3bqJ4CfzZojMOLVc0UTsTglEghA=
 github.com/mattn/go-sqlite3 v1.14.7/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/shirou/gopsutil v3.21.4+incompatible h1:fuHcTm5mX+wzo542cmYcV9RTGQLbnHLI5SyQ5ryTVck=
 github.com/shirou/gopsutil v3.21.4+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tklauser/go-sysconf v0.3.6 h1:oc1sJWvKkmvIxhDHeKWvZS4f6AW+YcoguSfRF2/Hmo4=
 github.com/tklauser/go-sysconf v0.3.6/go.mod h1:MkWzOF4RMCshBAMXuhXJs64Rte09mITnppBXY/rYEFI=
 github.com/tklauser/numcpus v0.2.2 h1:oyhllyrScuYI6g+h/zUvNXNp1wy7x8qQy3t/piefldA=
 github.com/tklauser/numcpus v0.2.2/go.mod h1:x3qojaO3uyYt0i56EW/VUYs7uBvdl2fkfZFu0T9wgjM=
+go.uber.org/atomic v1.6.0 h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=
+go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/multierr v1.5.0 h1:KCa4XfM8CWFCpxXRGok+Q0SS/0XBhMDbHHGABQLvD2A=
+go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
+go.uber.org/zap v1.16.0 h1:uFRZXykJGK9lLY4HtgSw44DnIcAM+kRBP7x5m+NpAOM=
+go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210531080801-fdfd190a6549 h1:OL5GcZ2XPkte3dpfuFQ9o884vrE3BZQhajdntNMruv4=
 golang.org/x/sys v0.0.0-20210531080801-fdfd190a6549/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/edgeapps/edgeapps.go

@@ -489,7 +489,7 @@ func GetEdgeAppServices(ID string) []EdgeAppService {
 		// Check if the service is actually running
 		if shouldBeRunning {
 			cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "exec", "-T", serviceID, "echo", "'Service Check'"}
-			cmdResult := utils.Exec(wsPath, "docker-compose", cmdArgs)
+			cmdResult := utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 			if cmdResult != "" {
 				isRunning = true
 			}
@@ -511,7 +511,7 @@ func RunEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "start", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...
@@ -529,7 +529,7 @@ func StopEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "stop", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...

internal/tasks/ssh_access.go

@@ -0,0 +1,217 @@
+package tasks
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/edgebox-iot/edgeboxctl/internal/utils"
+)
+
+const (
+	sshDirectory      = "/root/.ssh"
+	managedSSHComment = "edgebox-dashboard-managed"
+)
+
+type sshAccessResult struct {
+	Status      string `json:"status"`
+	PublicKey   string `json:"public_key,omitempty"`
+	Fingerprint string `json:"fingerprint,omitempty"`
+}
+
+func taskEnableSSHAccess(args taskEnableSSHAccessArgs) (string, error) {
+	if err := verifyRootSSHAccess(); err != nil {
+		return "", err
+	}
+
+	publicKey, fingerprint, err := parseSSHEd25519PublicKey(args.PublicKey)
+	if err != nil {
+		return "", err
+	}
+
+	if err := reconcileManagedSSHKey(sshDirectory, publicKey); err != nil {
+		return "", err
+	}
+
+	utils.WriteOption("SSH_ACCESS_ENABLED", "true")
+	utils.WriteOption("SSH_PUBLIC_KEY", publicKey)
+	utils.WriteOption("SSH_KEY_FINGERPRINT", fingerprint)
+
+	result, err := json.Marshal(sshAccessResult{
+		Status:      "enabled",
+		PublicKey:   publicKey,
+		Fingerprint: fingerprint,
+	})
+	if err != nil {
+		return "", err
+	}
+
+	return string(result), nil
+}
+
+func taskDisableSSHAccess() (string, error) {
+	if err := reconcileManagedSSHKey(sshDirectory, ""); err != nil {
+		return "", err
+	}
+
+	utils.WriteOption("SSH_ACCESS_ENABLED", "false")
+	utils.DeleteOption("SSH_PUBLIC_KEY")
+	utils.DeleteOption("SSH_KEY_FINGERPRINT")
+
+	result, err := json.Marshal(sshAccessResult{Status: "disabled"})
+	if err != nil {
+		return "", err
+	}
+
+	return string(result), nil
+}
+
+func parseSSHEd25519PublicKey(input string) (string, string, error) {
+	trimmed := strings.TrimSpace(input)
+	if trimmed == "" || strings.ContainsAny(trimmed, "\r\n") {
+		return "", "", fmt.Errorf("provide exactly one SSH public key")
+	}
+
+	fields := strings.Fields(trimmed)
+	if len(fields) < 2 || len(fields) > 3 || fields[0] != "ssh-ed25519" {
+		return "", "", fmt.Errorf("only one ssh-ed25519 public key is supported")
+	}
+
+	keyBlob, err := base64.StdEncoding.DecodeString(fields[1])
+	if err != nil || !validEd25519KeyBlob(keyBlob) {
+		return "", "", fmt.Errorf("invalid ssh-ed25519 public key")
+	}
+
+	digest := sha256.Sum256(keyBlob)
+	publicKey := "ssh-ed25519 " + base64.StdEncoding.EncodeToString(keyBlob) + " " + managedSSHComment
+	fingerprint := "SHA256:" + base64.RawStdEncoding.EncodeToString(digest[:])
+
+	return publicKey, fingerprint, nil
+}
+
+func validEd25519KeyBlob(blob []byte) bool {
+	if len(blob) < 4 {
+		return false
+	}
+
+	typeLength := int(binary.BigEndian.Uint32(blob[:4]))
+	if typeLength != len("ssh-ed25519") || len(blob) < 4+typeLength+4 {
+		return false
+	}
+	if string(blob[4:4+typeLength]) != "ssh-ed25519" {
+		return false
+	}
+
+	keyLengthOffset := 4 + typeLength
+	keyLength := int(binary.BigEndian.Uint32(blob[keyLengthOffset : keyLengthOffset+4]))
+	return keyLength == 32 && len(blob) == keyLengthOffset+4+keyLength
+}
+
+func reconcileManagedSSHKey(directory string, publicKey string) error {
+	if info, err := os.Lstat(directory); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return fmt.Errorf("SSH directory is not a regular directory")
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect SSH directory: %w", err)
+	} else if err := os.MkdirAll(directory, 0700); err != nil {
+		return fmt.Errorf("create SSH directory: %w", err)
+	}
+
+	if err := os.Chmod(directory, 0700); err != nil {
+		return fmt.Errorf("secure SSH directory: %w", err)
+	}
+
+	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
+	if info, err := os.Lstat(authorizedKeysPath); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("authorized_keys must not be a symbolic link")
+	} else if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("inspect authorized_keys: %w", err)
+	}
+
+	existing, err := os.ReadFile(authorizedKeysPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read authorized_keys: %w", err)
+	}
+
+	lines := strings.Split(string(existing), "\n")
+	kept := make([]string, 0, len(lines)+1)
+	for _, line := range lines {
+		if strings.TrimSpace(line) == "" || isManagedSSHKey(line) {
+			continue
+		}
+		kept = append(kept, line)
+	}
+	if publicKey != "" {
+		kept = append(kept, publicKey)
+	}
+
+	contents := ""
+	if len(kept) > 0 {
+		contents = strings.Join(kept, "\n") + "\n"
+	}
+
+	temporary, err := os.CreateTemp(directory, ".authorized_keys-*")
+	if err != nil {
+		return fmt.Errorf("create authorized_keys temporary file: %w", err)
+	}
+	temporaryPath := temporary.Name()
+	defer os.Remove(temporaryPath)
+
+	if err := temporary.Chmod(0600); err != nil {
+		temporary.Close()
+		return fmt.Errorf("secure authorized_keys temporary file: %w", err)
+	}
+	if _, err := temporary.WriteString(contents); err != nil {
+		temporary.Close()
+		return fmt.Errorf("write authorized_keys: %w", err)
+	}
+	if err := temporary.Sync(); err != nil {
+		temporary.Close()
+		return fmt.Errorf("sync authorized_keys: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return fmt.Errorf("close authorized_keys: %w", err)
+	}
+	if err := os.Rename(temporaryPath, authorizedKeysPath); err != nil {
+		return fmt.Errorf("replace authorized_keys: %w", err)
+	}
+
+	return nil
+}
+
+func isManagedSSHKey(line string) bool {
+	fields := strings.Fields(line)
+	return len(fields) == 3 && fields[2] == managedSSHComment
+}
+
+func verifyRootSSHAccess() error {
+	sshdPath, err := exec.LookPath("sshd")
+	if err != nil {
+		sshdPath = "/usr/sbin/sshd"
+		if _, statErr := os.Stat(sshdPath); statErr != nil {
+			return fmt.Errorf("OpenSSH server is not installed")
+		}
+	}
+
+	output, err := exec.Command(sshdPath, "-T").Output()
+	if err != nil {
+		return fmt.Errorf("could not verify the effective SSH server configuration")
+	}
+
+	settings := string(output)
+	if !strings.Contains(settings, "pubkeyauthentication yes") {
+		return fmt.Errorf("SSH public-key authentication is disabled")
+	}
+	if strings.Contains(settings, "permitrootlogin no") {
+		return fmt.Errorf("SSH root login is disabled")
+	}
+
+	return nil
+}

internal/tasks/ssh_access_test.go

@@ -0,0 +1,111 @@
+package tasks
+
+import (
+	"encoding/base64"
+	"encoding/binary"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func testPublicKey(t *testing.T) string {
+	t.Helper()
+	blob := make([]byte, 4+len("ssh-ed25519")+4+32)
+	binary.BigEndian.PutUint32(blob[:4], uint32(len("ssh-ed25519")))
+	copy(blob[4:], "ssh-ed25519")
+	offset := 4 + len("ssh-ed25519")
+	binary.BigEndian.PutUint32(blob[offset:offset+4], 32)
+	for index := 0; index < 32; index++ {
+		blob[offset+4+index] = byte(index + 1)
+	}
+	return "ssh-ed25519 " + base64.StdEncoding.EncodeToString(blob) + " workstation"
+}
+
+func TestParseSSHEd25519PublicKey(t *testing.T) {
+	publicKey, fingerprint, err := parseSSHEd25519PublicKey(testPublicKey(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasSuffix(publicKey, " "+managedSSHComment) {
+		t.Fatalf("public key does not have managed marker: %q", publicKey)
+	}
+	if !strings.HasPrefix(fingerprint, "SHA256:") {
+		t.Fatalf("unexpected fingerprint: %q", fingerprint)
+	}
+}
+
+func TestParseSSHEd25519PublicKeyRejectsUnsafeInput(t *testing.T) {
+	inputs := []string{
+		"",
+		"-----BEGIN OPENSSH PRIVATE KEY-----",
+		testPublicKey(t) + "\n" + testPublicKey(t),
+		"command=whoami " + testPublicKey(t),
+		"ssh-rsa AAAA invalid",
+	}
+	for _, input := range inputs {
+		if _, _, err := parseSSHEd25519PublicKey(input); err == nil {
+			t.Fatalf("expected input to be rejected: %q", input)
+		}
+	}
+}
+
+func TestReconcileManagedSSHKeyPreservesUnrelatedKeys(t *testing.T) {
+	directory := t.TempDir()
+	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
+	original := "# operator key\nssh-ed25519 AAAAoperator operator\n"
+	if err := os.WriteFile(authorizedKeysPath, []byte(original), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	publicKey, _, err := parseSSHEd25519PublicKey(testPublicKey(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
+		t.Fatal(err)
+	}
+
+	contents, err := os.ReadFile(authorizedKeysPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Count(string(contents), managedSSHComment) != 1 {
+		t.Fatalf("managed key is not idempotent: %s", contents)
+	}
+	if !strings.Contains(string(contents), original) {
+		t.Fatalf("unrelated content was changed: %s", contents)
+	}
+	if info, err := os.Stat(authorizedKeysPath); err != nil || info.Mode().Perm() != 0600 {
+		t.Fatalf("authorized_keys mode is not 0600: %v, %v", info, err)
+	}
+
+	if err := reconcileManagedSSHKey(directory, ""); err != nil {
+		t.Fatal(err)
+	}
+	contents, err = os.ReadFile(authorizedKeysPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(contents) != original {
+		t.Fatalf("disable changed unrelated content: %q", contents)
+	}
+}
+
+func TestReconcileManagedSSHKeyRejectsSymlink(t *testing.T) {
+	directory := t.TempDir()
+	target := filepath.Join(directory, "target")
+	if err := os.WriteFile(target, []byte("preserve me"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(directory, "authorized_keys")); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := reconcileManagedSSHKey(directory, ""); err == nil {
+		t.Fatal("expected symlink to be rejected")
+	}
+}

internal/tasks/tasks.go

@@ -1,16 +1,16 @@
 package tasks
 
 import (
+	"bufio"
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"log"
-	"strconv"
-	"time"
-	"os/exec"
-	"strings"
 	"os"
-	"bufio"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
 
 	"github.com/edgebox-iot/edgeboxctl/internal/diagnostics"
 	"github.com/edgebox-iot/edgeboxctl/internal/edgeapps"
@@ -77,7 +77,7 @@ type taskSetEdgeAppOptionsArgs struct {
 }
 
 type taskSetEdgeAppBasicAuthArgs struct {
-	ID string `json:"id"`
+	ID    string        `json:"id"`
 	Login TaskBasicAuth `json:"login"`
 }
 
@@ -99,10 +99,10 @@ type taskEnablePublicDashboardArgs struct {
 }
 
 type taskSetupBackupsArgs struct {
-	Service string `json:"service"`
+	Service            string `json:"service"`
-	AccessKeyID string `json:"access_key_id"`
+	AccessKeyID        string `json:"access_key_id"`
-	SecretAccessKey string `json:"secret_access_key"`
+	SecretAccessKey    string `json:"secret_access_key"`
-	RepositoryName string `json:"repository_name"`
+	RepositoryName     string `json:"repository_name"`
 	RepositoryPassword string `json:"repository_password"`
 }
 
@@ -114,6 +114,9 @@ type taskSetBrowserDevPasswordArgs struct {
 	Password string `json:"password"`
 }
 
+type taskEnableSSHAccessArgs struct {
+	PublicKey string `json:"public_key"`
+}
 
 const STATUS_CREATED int = 0
 const STATUS_EXECUTING int = 1
@@ -274,7 +277,7 @@ func ExecuteTask(task Task) Task {
 			log.Println("Stopping Cloudflare Tunnel...")
 			taskResult := taskStopTunnel()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
-		
+
 		case "disable_tunnel":
 
 			log.Println("Disabling Cloudflare Tunnel...")
@@ -289,7 +292,7 @@ func ExecuteTask(task Task) Task {
 				log.Printf("Error reading arguments or start_shell task: %s", err)
 			} else {
 				taskResult := taskStartShell(args)
-				task.Result = sql.NullString{String: taskResult, Valid: true}												
+				task.Result = sql.NullString{String: taskResult, Valid: true}
 			}
 
 		case "stop_shell":
@@ -450,7 +453,7 @@ func ExecuteTask(task Task) Task {
 
 			log.Println("Updating Edgebox System...")
 			is_updating := utils.ReadOption("UPDATING_SYSTEM")
-			if is_updating == "true"  {
+			if is_updating == "true" {
 				log.Println("Edgebox update was running... Probably system restarted. Finishing update...")
 				utils.WriteOption("UPDATING_SYSTEM", "false")
 				task.Result = sql.NullString{String: "{result: true}", Valid: true}
@@ -484,6 +487,27 @@ func ExecuteTask(task Task) Task {
 			taskResult := taskDeactivateBrowserDev()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
+		case "enable_ssh_access":
+			log.Println("Installing dashboard-managed SSH public key...")
+			var args taskEnableSSHAccessArgs
+			if err := json.Unmarshal([]byte(task.Args.String), &args); err != nil {
+				task.Result = sql.NullString{String: "invalid SSH access task arguments", Valid: false}
+			} else if taskResult, err := taskEnableSSHAccess(args); err != nil {
+				log.Printf("Error enabling SSH access: %s", err)
+				task.Result = sql.NullString{String: err.Error(), Valid: false}
+			} else {
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "disable_ssh_access":
+			log.Println("Removing dashboard-managed SSH public key...")
+			if taskResult, err := taskDisableSSHAccess(); err != nil {
+				log.Printf("Error disabling SSH access: %s", err)
+				task.Result = sql.NullString{String: err.Error(), Valid: false}
+			} else {
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
 		}
 
 	}
@@ -507,7 +531,11 @@ func ExecuteTask(task Task) Task {
 
 	} else {
 		fmt.Println("Error executing task with result: " + task.Result.String)
-		_, err = statement.Exec(STATUS_ERROR, "Error", formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
+		errorResult := task.Result.String
+		if errorResult == "" {
+			errorResult = "Error"
+		}
+		_, err = statement.Exec(STATUS_ERROR, errorResult, formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
 		if err != nil {
 			log.Fatal(err.Error())
 		}
@@ -535,7 +563,7 @@ func ExecuteSchedules(tick int) {
 		taskGetBrowserDevStatus()
 
 		taskCheckSystemUpdates()
-		
+
 		ip := taskGetSystemIP()
 		log.Println("System IP is: " + ip)
 
@@ -564,7 +592,7 @@ func ExecuteSchedules(tick int) {
 		taskStartWs()
 		log.Println(taskGetEdgeApps())
 		taskUpdateSystemLoggerServices()
-		taskRecoverFromUpdate()		
+		taskRecoverFromUpdate()
 	}
 
 	if tick%5 == 0 {
@@ -599,7 +627,7 @@ func ExecuteSchedules(tick int) {
 				} else {
 
 					log.Println("Last backup is " + fmt.Sprint(secondsSinceLastBackup) + " seconds old (less than 1 hour ago), skipping auto backup...")
-		
+
 				}
 			}
 		} else {
@@ -640,17 +668,17 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 	service_found := false
 
 	switch args.Service {
-		case "s3":
+	case "s3":
-			service_url = "s3.amazonaws.com/"
+		service_url = "s3.amazonaws.com/"
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			service_url = ""
+		service_url = ""
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
-			service_url = "s3.wasabisys.com/"
+		service_url = "s3.wasabisys.com/"
 	}
 
 	if !service_found {
@@ -663,14 +691,14 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 	os.Setenv(key_secret_name, args.SecretAccessKey)
 
 	fmt.Println("Creating restic password file")
-	
+
 	system.CreateBackupsPasswordFile(args.RepositoryPassword)
 
 	fmt.Println("Initializing restic repository")
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	cmdArgs := []string{"-r", args.Service + ":" + service_url + args.RepositoryName + ":" + repo_location, "init", "--password-file", utils.GetPath(utils.BackupPasswordFileLocation), "--verbose=3"}
-	
+
 	result := utils.ExecAndStream(repo_location, "restic", cmdArgs)
 
 	utils.WriteOption("BACKUP_IS_WORKING", "0")
@@ -699,9 +727,9 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 
 	// Populate Stats right away
 	taskGetBackupStatus()
-	
+
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskRemoveBackups() string {
@@ -710,12 +738,12 @@ func taskRemoveBackups() string {
 
 	// ...	This deletes the restic repository
 	// cmdArgs := []string{"-r", "s3:https://s3.amazonaws.com/edgebox-backups:/home/system/components/apps/", "forget", "latest", "--password-file", utils.GetPath(utils.BackupPasswordFileLocation), "--verbose=3"}
-	
+
 	utils.WriteOption("BACKUP_STATUS", "")
 	utils.WriteOption("BACKUP_IS_WORKING", "0")
 
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskBackup() string {
@@ -735,14 +763,14 @@ func taskBackup() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -756,7 +784,6 @@ func taskBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
-
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	// ...	This backs up the restic repository
@@ -778,7 +805,7 @@ func taskBackup() string {
 	utils.WriteOption("BACKUP_STATUS", "working")
 	taskGetBackupStatus()
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskRestoreBackup() string {
@@ -798,14 +825,14 @@ func taskRestoreBackup() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -819,7 +846,6 @@ func taskRestoreBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
-
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	fmt.Println("Stopping All EdgeApps")
@@ -828,8 +854,8 @@ func taskRestoreBackup() string {
 
 	// Copy all files in /home/system/components/apps/ to a backup folder
 	fmt.Println("Copying all files in /home/system/components/apps/ to a backup folder")
-	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), 0777)
+	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), 0777)
-	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath + "temp/"))
+	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath+"temp/"))
 
 	fmt.Println("Removing all files in /home/system/components/apps/")
 	os.RemoveAll(utils.GetPath(utils.EdgeAppsPath))
@@ -852,7 +878,7 @@ func taskRestoreBackup() string {
 	if strings.Contains(result, "Fatal:") {
 		// Copy all files from backup folder to /home/system/components/apps/
 		os.MkdirAll(utils.GetPath(utils.EdgeAppsPath), 0777)
-		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), utils.GetPath(utils.EdgeAppsPath))
+		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), utils.GetPath(utils.EdgeAppsPath))
 
 		fmt.Println("Error restoring backup: ")
 		utils.WriteOption("BACKUP_STATUS", "error")
@@ -863,7 +889,7 @@ func taskRestoreBackup() string {
 	utils.WriteOption("BACKUP_STATUS", "working")
 	taskGetBackupStatus()
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskAutoBackup() string {
@@ -876,7 +902,7 @@ func taskAutoBackup() string {
 		return taskBackup()
 	} else {
 		fmt.Println("Backup status is not working... skipping")
-		return "{\"status\": \"skipped\"}"		
+		return "{\"status\": \"skipped\"}"
 	}
 }
 
@@ -897,14 +923,14 @@ func taskGetBackupStatus() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -921,12 +947,12 @@ func taskGetBackupStatus() string {
 	utils.WriteOption("BACKUP_STATS", utils.ExecAndStream(backup_repository_location, "restic", cmdArgs))
 
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskSetupTunnel(args taskSetupTunnelArgs) string {
 	fmt.Println("Executing taskSetupTunnel")
-	wsPath := utils.GetPath(utils.WsPath)	
+	wsPath := utils.GetPath(utils.WsPath)
 
 	// Stop a the service if it is running
 	system.StopService("cloudflared")
@@ -995,14 +1021,14 @@ func taskSetupTunnel(args taskSetupTunnelArgs) string {
 		system.CreateTunnel("/home/system/.cloudflared/config.yml")
 
 		fmt.Println("Creating DNS Routes for @ and *.")
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", "*." + args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", "*."+args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
@@ -1032,23 +1058,23 @@ func taskSetupTunnel(args taskSetupTunnelArgs) string {
 		fmt.Println("Finished running async")
 	}()
 
-    return "{\"url\": \"" + url + "\"}"
+	return "{\"url\": \"" + url + "\"}"
 }
 
 func taskStartTunnel() string {
-    fmt.Println("Executing taskStartTunnel")
+	fmt.Println("Executing taskStartTunnel")
-    
+
-    // Read tunnel status to check if cloudflare is configured
+	// Read tunnel status to check if cloudflare is configured
-    tunnelStatus := utils.ReadOption("TUNNEL_STATUS")
+	tunnelStatus := utils.ReadOption("TUNNEL_STATUS")
 	if tunnelStatus != "" {
 		// Only start cloudflared if we have a tunnel configured
-        system.StartService("cloudflared")
+		system.StartService("cloudflared")
-        domainName := utils.ReadOption("DOMAIN_NAME")
+		domainName := utils.ReadOption("DOMAIN_NAME")
-        status := "{\"status\": \"connected\", \"domain\": \"" + domainName + "\"}"
+		status := "{\"status\": \"connected\", \"domain\": \"" + domainName + "\"}"
-        utils.WriteOption("TUNNEL_STATUS", status)
+		utils.WriteOption("TUNNEL_STATUS", status)
 	}
-    
+
-    return "{\"status\": \"ok\"}"
+	return "{\"status\": \"ok\"}"
 }
 
 func taskStopTunnel() string {
@@ -1110,7 +1136,7 @@ func taskStartShell(args taskStartShellArgs) string {
 
 	go func() {
 		fmt.Println("Running shell async")
-		
+
 		// cmd.Wait()
 
 		// Keep retrying to calculate timeout to know when to kill the process
@@ -1152,7 +1178,7 @@ func taskGetBrowserDevStatus() string {
 		utils.GetPath(utils.WsPath),
 		"sh",
 		[]string{"-c", "systemctl --quiet is-active code-server@root && echo 'active' || echo 'inactive'"},
-	)	
+	)
 	if browserDevStatus == "active" {
 		fmt.Println("Browser Dev Environment is running")
 		utils.WriteOption("BROWSERDEV_STATUS", "running")
@@ -1211,7 +1237,7 @@ func taskDeactivateBrowserDev() string {
 	// Remove the run file
 	os.Remove(utils.GetPath(utils.BrowserDevProxyPath) + ".run")
 	system.StartWs()
-	
+
 	utils.Exec(wsPath, "systemctl", []string{"stop", "code-server@root"})
 	utils.WriteOption("BROWSERDEV_STATUS", "not_running")
 
@@ -1302,7 +1328,6 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 	// Id is the edgeapp id
 	appID := args.ID
 
-
 	// Open the file to write the options,
 	// it is an env file in /home/system/components/apps/<app_id>/edgeapp.env
 
@@ -1333,7 +1358,7 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 			log.Printf("Error writing option to edgeapp.env file: %s", err)
 		}
 	}
-	
+
 	// Close the file
 	err = edgeappEnvFile.Close()
 	if err != nil {
@@ -1353,7 +1378,6 @@ func taskSetEdgeAppBasicAuth(args taskSetEdgeAppBasicAuthArgs) string {
 	// Id is the edgeapp id
 	appID := args.ID
 
-
 	// Open the file to write the options,
 	// it is an env file in /home/system/components/apps/<app_id>/auth.env
 
@@ -1381,7 +1405,7 @@ func taskSetEdgeAppBasicAuth(args taskSetEdgeAppBasicAuthArgs) string {
 	if err != nil {
 		log.Printf("Error writing credentials to auth.env file: %s", err)
 	}
-	
+
 	// Close the file
 	err = edgeappAuthEnvFile.Close()
 	if err != nil {
@@ -1486,7 +1510,7 @@ func taskRecoverFromUpdate() string {
 			filteredTasks = append(filteredTasks, task)
 		}
 	}
-	
+
 	// If tasks is not empty, Get the last task
 	if len(filteredTasks) > 0 {
 		lastTask := filteredTasks[len(filteredTasks)-1]
@@ -1527,7 +1551,7 @@ func taskUpdateSystemLoggerServices() string {
 
 	input = append(input, "edgeboxctl")
 	input = append(input, "tunnel")
-	
+
 	// Run the system logger
 	system.UpdateSystemLoggerServices(input)