Source Code & License
Where to read the NetStacks Terminal source code, the license it is published under (Elastic License 2.0), the vault cryptography library, and how the Controller is licensed.
Overview
NetStacks Terminal is free to download and use, and its source code is public, so you can see exactly how your SSH sessions and credentials are handled. Install the signed builds from the download page. The published source is for reading, studying and auditing.
Public Repositories
| Repository | Contents | License |
|---|---|---|
| github.com/netstacks/netstacks-personal | NetStacks Terminal source: the React front end (frontend/src) and the Local Agent (agent/src). It is updated automatically from the main development branch. | Elastic License 2.0 |
| github.com/netstacks/netstacks-crypto | The credential-vault library (netstacks-credential-vault) that both the Local Agent and the Controller use to encrypt secrets. | Apache 2.0 |
A few agent modules are not included in the public repository, such as some integration providers and platform-specific helpers.
License
NetStacks Terminal is published under the Elastic License 2.0 (ELv2). In short:
- You may use NetStacks Terminal for free, including at work.
- You may read, study and audit the source code.
- You may not provide the software to others as a hosted or managed service, and you may not remove or work around license notices.
The full terms are in the LICENSE file in the repository. If they differ from this summary, the LICENSE file applies.
ELv2 is a source-available license, not an OSI-approved open-source license. The software is free of charge and the code is public, but the restrictions above apply.
Vault Cryptography
The standalone vault encrypts each secret with standard building blocks, all implemented in the public netstacks-crypto library:
- Encryption: AES-256-GCM (authenticated encryption)
- Key derivation: Argon2id, from your master password
- Salt: 32 random bytes
- Nonce: 96-bit (12-byte) GCM nonce
- Stored format:
salt || nonce || ciphertext, kept inside the local SQLite database
The derived key is held in memory only while the vault is unlocked and is wiped when it is no longer needed. Without the master password, the encrypted entries in a copied database can't be read. The same is true if the password is lost: there is no recovery. On macOS, the optional Touch ID unlock stores the master password in your login keychain.
Other cryptography in the Terminal uses Rust libraries: russh for SSH, and rustls with the ring backend for TLS. OpenSSL is not linked.
On the Controller, profile secrets are encrypted with the same library. Each organization has its own key, derived from the server's VAULT_MASTER_KEY.
The Controller Enterprise
The NetStacks Controller (server, admin console and plugins) is commercial software. Its source code is not public. It needs a Team or Enterprise license key, which you activate in the admin console under Administration → License. See Introduction for what it includes.
Reporting Security Issues
Please report vulnerabilities privately to [email protected], not in a public GitHub issue. Include a description, steps to reproduce and affected versions if you know them. NetStacks aims to acknowledge reports within 2 business days and follows coordinated disclosure.