feat: generate dedicated SSH key pair and disable password auth

- Auto-generate Ed25519 SSH key pair in ~/.ggo/ssh/ for TF studio containers
- Remove password authentication (PasswordAuthentication no, PermitRootLogin prohibit-password)
- Delete default password setup (removed: echo "root:ggo-studio" | chpasswd)
- Add IdentityFile to SSH config for seamless key-based authentication
- Display private key path in studio creation output
- Require SSH key for container access (fail if key generation fails)
- Improve security by enforcing key-only authentication

Key security improvements:
- Dedicated key pair for studio containers (not mixing with user's personal SSH keys)
- No password authentication reduces attack surface
- Auto-generated on first use, stored securely with 0600 permissions

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: andystime

cmd/ggo/studio/studio.go

@@ -36,6 +36,9 @@ var (
 	command       []string
 	endpoint      string
 	platform      string // container platform (e.g., linux/amd64, linux/arm64)
+
+	// lastPrivateKeyPath stores the private key path from the most recent buildCreateOptions call
+	lastPrivateKeyPath string
 )
 
 // NewStudioCmd creates the studio command
@@ -212,7 +215,7 @@ Examples:
 	cmd.Flags().StringVarP(&image, "image", "i", "tensorfusion/studio-torch:latest", "Container image")
 	cmd.Flags().StringVarP(&shareLink, "share-link", "s", "", "Share link or share code to remote vGPU worker (recommended for GPU access)")
 	cmd.Flags().StringVar(&serverURL, "server", api.GetDefaultBaseURL(), "Server URL for resolving share links")
-	cmd.Flags().StringVar(&sshKey, "ssh-key", "", "SSH public key to authorize (auto-detects from ~/.ssh/ if not provided)")
+	cmd.Flags().StringVar(&sshKey, "ssh-key", "", "SSH public key to authorize (auto-generates dedicated key pair if not provided)")
 	cmd.Flags().StringArrayVarP(&ports, "port", "p", nil, "Port mappings (host:container)")
 	cmd.Flags().StringArrayVarP(&volumes, "volume", "v", nil, "Volume mounts (host:container[:ro])")
 	cmd.Flags().StringArrayVarP(&envVars, "env", "e", nil, "Environment variables (KEY=VALUE)")
@@ -284,13 +287,6 @@ func runCreate(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	// Inform user about SSH authentication method
-	if !out.IsJSON() && opts.SSHPublicKey != "" {
-		styles := tui.DefaultStyles()
-		out.Printf("%s Using SSH key authentication (password: ggo-studio as fallback)\n",
-			styles.Info.Render("ℹ"))
-	}
-
 	if !out.IsJSON() {
 		styles := tui.DefaultStyles()
 		out.Printf("%s Creating studio environment '%s'...\n",
@@ -345,11 +341,12 @@ Original error: %w`, err)
 		}
 	}
 	return out.Render(&createResult{
-		env:         env,
-		mgr:         mgr,
-		noSSH:       noSSH,
-		backendName: backendName,
-		socketPath:  socketPath,
+		env:            env,
+		mgr:            mgr,
+		noSSH:          noSSH,
+		backendName:    backendName,
+		socketPath:     socketPath,
+		privateKeyPath: lastPrivateKeyPath,
 	})
 }
 
@@ -426,15 +423,28 @@ func buildCreateOptions(name string, shareInfo *api.SharePublicInfo) (*studio.Cr
 		return nil, err
 	}
 
-	// Auto-detect SSH public key if not provided via --ssh-key flag
+	// Get or create dedicated SSH key pair for TF studio containers
 	effectiveSSHKey := sshKey
+	privateKeyPath := ""
 	if effectiveSSHKey == "" {
-		if autoKey := studio.GetUserSSHPublicKey(); autoKey != "" {
-			effectiveSSHKey = autoKey
-			klog.V(2).Info("Using user's SSH public key for authentication")
+		pubKey, privPath, err := studio.GetOrCreateStudioSSHKey()
+		if err != nil {
+			klog.Warningf("Failed to get/create studio SSH key: %v", err)
+		} else {
+			effectiveSSHKey = pubKey
+			privateKeyPath = privPath
+			klog.V(2).Infof("Using TF studio SSH key: %s", privPath)
 		}
 	}
 
+	// Store for use in createResult
+	lastPrivateKeyPath = privateKeyPath
+
+	// Ensure SSH key is available (required for container access)
+	if effectiveSSHKey == "" {
+		return nil, fmt.Errorf("SSH public key is required for container access")
+	}
+
 	// Set GPU connection info from share link
 	gpuWorkerURL := ""
 	hardwareVendor := ""
@@ -535,11 +545,12 @@ func parseEnvVars(envVars []string) (map[string]string, error) {
 
 // createResult implements Renderable for create command output
 type createResult struct {
-	env         *studio.Environment
-	mgr         *studio.Manager
-	noSSH       bool
-	backendName string
-	socketPath  string
+	env            *studio.Environment
+	mgr            *studio.Manager
+	noSSH          bool
+	backendName    string
+	socketPath     string
+	privateKeyPath string
 }
 
 func (r *createResult) RenderJSON() any {
@@ -583,6 +594,10 @@ func (r *createResult) RenderTUI(out *tui.Output) {
 				Add("Port", fmt.Sprintf("%d", env.SSHPort)).
 				Add("User", env.SSHUser)
 
+			if r.privateKeyPath != "" {
+				sshStatus = sshStatus.Add("Private Key", r.privateKeyPath)
+			}
+
 			out.Println(sshStatus.String())
 
 			out.Println()

internal/studio/manager.go

@@ -453,6 +453,13 @@ func (m *Manager) AddSSHConfig(env *Environment) error {
 		existingConfig = string(data)
 	}
 
+	// Get home directory for private key path
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return errors.Wrap(err, "failed to get user home directory")
+	}
+	privateKeyPath := filepath.Join(homeDir, ".ggo", "ssh", "id_ed25519")
+
 	// Generate new entry
 	hostName := fmt.Sprintf("ggo-%s", env.Name)
 	entry := fmt.Sprintf(`
@@ -461,9 +468,10 @@ Host %s
     HostName %s
     Port %d
     User %s
+    IdentityFile %s
     StrictHostKeyChecking no
     UserKnownHostsFile /dev/null
-`, env.Name, hostName, env.SSHHost, env.SSHPort, env.SSHUser)
+`, env.Name, hostName, env.SSHHost, env.SSHPort, env.SSHUser, privateKeyPath)
 
 	// Keep a single entry per studio host by removing any existing one first.
 	existingConfig = m.removeSSHConfigEntry(existingConfig, hostName)

internal/studio/ssh_key.go

@@ -1,43 +1,79 @@
 package studio
 
 import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/pem"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"golang.org/x/crypto/ssh"
 	"k8s.io/klog/v2"
 )
 
-// GetUserSSHPublicKey attempts to read user's SSH public key from standard locations
-// Returns the public key content or empty string if not found
-func GetUserSSHPublicKey() string {
+// GetOrCreateStudioSSHKey gets or creates a dedicated SSH key pair for TF studio containers
+// Returns the public key content, private key path, and error if any
+func GetOrCreateStudioSSHKey() (publicKey string, privateKeyPath string, err error) {
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
-		klog.V(2).Infof("Failed to get user home directory: %v", err)
-		return ""
+		return "", "", fmt.Errorf("failed to get user home directory: %w", err)
 	}
 
-	// Try common SSH public key files in order of preference
-	keyPaths := []string{
-		filepath.Join(homeDir, ".ssh", "id_ed25519.pub"),
-		filepath.Join(homeDir, ".ssh", "id_ecdsa.pub"),
-		filepath.Join(homeDir, ".ssh", "id_rsa.pub"),
-		filepath.Join(homeDir, ".ssh", "id_dsa.pub"),
-	}
+	// Store dedicated SSH keys in ~/.ggo/ssh/
+	sshDir := filepath.Join(homeDir, ".ggo", "ssh")
+	privateKeyPath = filepath.Join(sshDir, "id_ed25519")
+	publicKeyPath := filepath.Join(sshDir, "id_ed25519.pub")
 
-	for _, keyPath := range keyPaths {
-		if content, err := os.ReadFile(keyPath); err == nil {
-			publicKey := strings.TrimSpace(string(content))
-			if publicKey != "" {
-				klog.V(2).Infof("Found SSH public key: %s", keyPath)
-				return publicKey
-			}
+	// Check if key pair already exists
+	if pubContent, err := os.ReadFile(publicKeyPath); err == nil {
+		publicKey = strings.TrimSpace(string(pubContent))
+		if publicKey != "" {
+			klog.V(2).Infof("Using existing TF studio SSH key: %s", publicKeyPath)
+			return publicKey, privateKeyPath, nil
 		}
 	}
 
-	klog.V(2).Info("No SSH public key found in standard locations")
-	return ""
+	// Generate new Ed25519 key pair
+	klog.Infof("Generating new SSH key pair for TF studio containers...")
+	if err := os.MkdirAll(sshDir, 0700); err != nil {
+		return "", "", fmt.Errorf("failed to create SSH directory: %w", err)
+	}
+
+	pubKey, privKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to generate SSH key: %w", err)
+	}
+
+	// Convert to SSH format
+	sshPubKey, err := ssh.NewPublicKey(pubKey)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to create SSH public key: %w", err)
+	}
+
+	// Write public key
+	publicKeyData := ssh.MarshalAuthorizedKey(sshPubKey)
+	if err := os.WriteFile(publicKeyPath, publicKeyData, 0644); err != nil {
+		return "", "", fmt.Errorf("failed to write public key: %w", err)
+	}
+
+	// Write private key in PEM format
+	privKeyBytes, err := ssh.MarshalPrivateKey(privKey, "")
+	if err != nil {
+		return "", "", fmt.Errorf("failed to marshal private key: %w", err)
+	}
+
+	privKeyPEM := pem.EncodeToMemory(privKeyBytes)
+	if err := os.WriteFile(privateKeyPath, privKeyPEM, 0600); err != nil {
+		return "", "", fmt.Errorf("failed to write private key: %w", err)
+	}
+
+	publicKey = strings.TrimSpace(string(publicKeyData))
+	klog.Infof("Generated new SSH key pair: %s", publicKeyPath)
+	klog.Infof("Private key saved to: %s", privateKeyPath)
+
+	return publicKey, privateKeyPath, nil
 }
 
 // FormatSSHPublicKey formats and validates an SSH public key

internal/studio/ssh_setup.go

@@ -70,10 +70,10 @@ HostKey /etc/ssh/ssh_host_ecdsa_key
 HostKey /etc/ssh/ssh_host_ed25519_key
 
 # Authentication
-PermitRootLogin yes
+PermitRootLogin prohibit-password
 PubkeyAuthentication yes
 AuthorizedKeysFile .ssh/authorized_keys
-PasswordAuthentication yes
+PasswordAuthentication no
 PermitEmptyPasswords no
 ChallengeResponseAuthentication no
 
@@ -94,9 +94,6 @@ UsePAM yes
 Subsystem sftp /usr/lib/openssh/sftp-server
 SSHD_EOF
 
-# Set a default password for root (can be overridden with SSH key)
-echo "root:ggo-studio" | chpasswd
-
 echo "SSH setup completed successfully"
 `