feat(pam): ssh session log parsing in gateway

[x032205]

Description 📣

Moves SSH session log parsing to the gateway

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-415

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-371-feat-pam-ssh-session-log-parsing-in-gateway

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[veria-ai]

PR overview

This pull request adds SSH session log parsing to the PAM gateway, including terminal-line and prompt-aware input handling for session recordings.

Five issues have been addressed, but one credential-handling edge case remains. An unusually long echo-disabled password or token prompt can evade secret-prompt detection and cause the entered credential to be stored in plaintext in the session recording.

Open issues (1)

• Low: Long secret prompts leak entered credentials — packages/pam/handlers/ssh/terminal.go:71

Fixed/addressed: 5 · PR risk: 4/10

[greptile-apps]

Greptile Summary

This PR moves SSH terminal rendering and command-echo interpretation into the gateway and marks rendered session events for downstream replay.

• Adds a stateful ANSI terminal transcript and input escape-sequence filter.
• Adds echo-aware command recording intended to avoid storing unechoed secrets.
• Converts SSH session events to display-ready text and adds the rendered event field.
• Adds terminal parsing and session-recording tests.

Confidence Score: 3/5

The PR should not merge until terminal and echo-tracking state is isolated per SSH channel, because concurrent channels can bypass secret redaction.

A single SSH connection can run multiple channel goroutines against shared input, output, and echo state, allowing one channel to alter how another channel's buffered input is classified and recorded.

Files Needing Attention: packages/pam/handlers/ssh/proxy.go, packages/pam/handlers/ssh/terminal.go

Security Review

Concurrent SSH channels share terminal and echo-tracking state, allowing channel attribution races to bypass the new echo-off redaction and record shell secrets as raw non-shell input.

Important Files Changed

Filename	Overview
packages/pam/handlers/ssh/proxy.go	Integrates gateway-side rendering and echo-aware logging, but keeps channel-sensitive parser and buffer state on the connection-wide proxy.
packages/pam/handlers/ssh/terminal.go	Adds bounded ANSI rendering and echo suppression, although its state is unsafe when shared across concurrent SSH channels.
packages/pam/handlers/ssh/terminal_test.go	Covers parsing and single-channel recording behavior but does not exercise concurrent channels on one SSH connection.
packages/pam/session/logger.go	Extends the session-event schema with a backward-compatible rendered marker.
go.mod	Adds the ANSI parser dependency and its transitive dependency updates.

_{Reviews (1): Last reviewed commit: "feat(pam): ssh session log parsing in ga..." | Re-trigger Greptile}

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
30250094	Triggered	Generic Password	d9f772d	e2e/pam/redis_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}