SSH

Learn how to configure SSH server access through Infisical PAM with support for password, key-based, and certificate-based authentication.

Infisical PAM supports secure, just-in-time access to SSH servers. This allows your team to access Linux/Unix servers without sharing static credentials, while maintaining a complete audit trail of all sessions.

How It Works

SSH access in Infisical PAM uses a Gateway deployed in your network to establish secure connections to your servers. The Gateway acts as a bridge between Infisical and your private infrastructure.

Authentication Methods

Infisical PAM supports three authentication methods for SSH:

Method	Description	Use Case
Password	Traditional username/password authentication	Legacy systems, simple setups
SSH Key	Public key authentication with a private key	Standard secure access
Certificate	SSH certificates signed by a CA	Zero-trust, ephemeral credentials

Certificate-Based Authentication

Certificate-based authentication allows for the use of ephemeral credentials. Infisical generates short-lived SSH certificates on-demand for each session.

Benefits:

• Ephemeral access: Certificates are generated per-session and expire automatically
• Centralized trust: Servers trust the Infisical CA to authorize connections
• Simplified management: Infisical handles the certificate lifecycle for each connection
• Audit trail: Each certificate is tied to a specific user and session

Prerequisites

Before configuring SSH access in Infisical PAM, ensure you have:

1. An Infisical Gateway deployed with network reachability to your SSH servers
2. Network connectivity from the Gateway to your SSH servers on port 22 (or custom SSH port)
3. SSH server credentials (password, private key, or CA setup for certificate auth)

Create the PAM Resource

The PAM Resource represents the SSH server you want to protect.

1. Navigate to Resources

   Go to your PAM project and click on the Resources tab.

2. Add SSH Resource

   Click Add Resource and select SSH.

3. Configure Connection Details

   Fill in the connection details:

   Name · string · required

   A friendly name for this resource (e.g., production-server, bastion-host)

   Gateway · string · required

   Select the Gateway that has network access to this SSH server

   Host · string · required

   The hostname or IP address of the SSH server (e.g., 192.168.1.100 or server.internal.example.com)

   Port · number · required

   The SSH port (default: 22)

4. Create the Resource

   Click Create Resource. Infisical will validate that the Gateway can reach the SSH server.

Create PAM Accounts

A PAM Account represents a specific user account on the SSH server. You can create multiple accounts per resource with different authentication methods.

Password Authentication

1. Navigate to Resource

   Go to the Resources tab in your PAM project and open your SSH resource.

2. Add Account

   Click Add Account.

3. Configure Password Auth

   Name · string · required

   A friendly name for this account (e.g., ubuntu-admin, deploy-user)

   Authentication Method · string · required

   Select Password

   Username · string · required

   The SSH username on the server

   Password · string · required

   The SSH password for this user

SSH Key Authentication

1. Add Account

   Click Add Account and select your SSH resource.

2. Configure Key Auth

   Name · string · required

   A friendly name for this account

   Authentication Method · string · required

   Select SSH Key

   Username · string · required

   The SSH username on the server

   Private Key · string · required

   The private key in OpenSSH format (begins with -----BEGIN OPENSSH PRIVATE KEY-----)

Certificate Authentication

Certificate authentication requires additional setup on your SSH server to trust the Infisical CA.

1. Configure the SSH Server

   Before creating the account, you need to configure your SSH server to trust certificates signed by Infisical.

   Run the following command on your SSH server (requires root/sudo):

   curl -H "Authorization: Bearer <YOUR_TOKEN>" \
     "https://app.infisical.com/api/v1/pam/resources/ssh/<RESOURCE_ID>/ssh-ca-setup" \
     | sudo bash
   

   This script will:

   1. Download the CA public key for your SSH resource
   2. Save it to /etc/ssh/infisical_ca.pub
   3. Add TrustedUserCAKeys /etc/ssh/infisical_ca.pub to /etc/ssh/sshd_config
   4. Validate and restart the SSH service

   First-time setup: The CA key pair is generated automatically when you first call the setup endpoint. Subsequent calls will return the same CA public key.

   Manual setup: If you prefer to configure the server manually, you can download just the CA public key and configure sshd yourself:

   curl -H "Authorization: Bearer <YOUR_TOKEN>" \
     "https://app.infisical.com/api/v1/pam/resources/ssh/<RESOURCE_ID>/ssh-ca-public-key" \
     | sudo tee /etc/ssh/infisical_ca.pub
   

   Then configure sshd:

   1. Add to /etc/ssh/sshd_config:
      TrustedUserCAKeys /etc/ssh/infisical_ca.pub
      
   2. Restart sshd: sudo systemctl restart sshd
2. Add Account in Infisical

   Name · string · required

   A friendly name for this account

   Authentication Method · string · required

   Select Certificate

   Username · string · required

   The SSH username that the certificate will be issued for. This user must exist on the SSH server.

   Unlike password or key authentication, you don’t need to provide any credentials. Infisical will generate a new key pair and certificate for each session.

Access SSH Servers

Once your resource and accounts are configured, users can access SSH servers through the Infisical CLI.

1. Install the CLI

   If you haven’t already, install the Infisical CLI:

   # macOS
   brew install infisical/get-cli/infisical
   
   # Linux
   curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
   sudo apt-get install infisical
   
2. Login to Infisical

   infisical login
   
3. Connect to SSH Server

   Specify the resource name and account name as shown in Infisical:

   infisical pam ssh access --resource <resource-name> --account <account-name> --project-id <project-id> --duration <duration>
   

   For example, to access the account ubuntu-admin on the resource production-server:

   infisical pam ssh access --resource production-server --account ubuntu-admin --project-id 00000000-0000-0000-0000-000000000000 --duration 1h