Pingtower
Docs
sshcheck
Open an SSH session with a key, optionally run one command, and time every stage. Key-based auth only.
privileged Add sshcheck to agent.enable_addons.
An sshcheck check runs only from the agent’s local config. Its parameters choose things on the box itself: a command, a key file, a known_hosts file. The person who writes checks in Pingtower may not be the person who owns that box. So the agent refuses an sshcheck check that Pingtower assigns to it, even when enable_addons names the addon: it logs assignment rejected, counts the assignment as rejected, and runs the rest of its checks. The API refuses with a 400 to create one, to change one’s with, or to switch a check to either addon, and the MCP create and update tools refuse it too. A sshcheck check stored in Pingtower before Release 1 is kept but no longer assigned to any agent: reading it shows paused with the reason local_only. Move it into the agent’s config and delete it there, as Upgrading to Release 1 describes.
Parameters
| Parameter | Default | Meaning |
|---|---|---|
address | port 22 | host:port. |
userREQUIRED | ||
key_fileREQUIRED | Private key readable by the addons user. | |
known_hosts | ~/.ssh/known_hosts | Expanded against the agent’s home. |
command | Run after auth. | |
expect_exit_code | 0 | Only with command. |
expect_output | Substring the output must contain. Only with command. | |
max_command | Command time above this is degraded. Only with command. |
No password, passphrase or host-key-bypass parameter exists. A host key that does not match known_hosts is down, because that is a real finding about the target. An unreadable key or a missing known_hosts file is a config error, not a verdict. Setting any expect_* without a command is refused at startup. Output past 4 KiB is dropped.
Measurements
connect_ms, handshake_ms, auth_ms, command_ms, exit_code.