Floo is an open-source tool written in bash designed for temporary remote access to Linux machines. It allows a user to grant a helper terminal access without opening ports or leaving permanent credentials. The tool operates by establishing a connection to a relay server, which then facilitates a secure tunnel between the client and the helper.
The system supports two authentication modes. The default mode uses SSH certificates signed by a Certificate Authority (CA), while the public mode uses a 13-character base32 code as a password. In public mode, the relay stores only the SHA-256 hash of the code and uses HMAC for verification, ensuring that the relay owner cannot access the session content.
Security features include session logging to the client's disk, which records both filtered and raw streams. The tool also includes a cleanup mechanism to terminate orphan processes and SSH sessions upon exit. Recent updates, such as version 0.7.3, introduced enhanced verification where the pin includes both the relay host key and the operator's CA fingerprint.
The project maintains a 'Don't trust us — read us' philosophy, keeping the codebase in bash to ensure it remains readable. The developer utilizes automated testing, shellcheck, and security scanners like VVAH and codex-security to identify vulnerabilities. The tool is distributed via a single file or a simple curl command for ease of use.
