SSH Gatekeeper replaces them with short-lived, CA-signed certificates issued on demand — optionally behind an approval gate, always with the full audit trail your compliance reviewer is looking for.
Engineer asks for a short-lived cert via the CLI or the web UI. Reason can be required.
$ hostatlas ssh keywest --reason "p1 disk"Per-server policy. Self-service mode hands out the cert immediately. Approval mode pages the right person.
Signed against your tenant's dedicated CA — embeds key-id, principals, source-IP, TTL.
ttl=15m · max=4h · scopedStandard ssh — no proxy, no agent in the loop. The cert authenticates the user against the host's sshd.
No revocation needed for happy paths. For incidents, KRL push reaches every host inside ~30 seconds.
Production gets the gate. Dev gets out of the way. Same audit trail either way.
For development, staging, or environments where unblocking matters more than four-eyes. Still bounded by TTL, principals, source-IP and full audit log.
For prod, regulated systems, anywhere a human should look first. Approval lands as in-app notification, fan-out to your channels, and signed 1-click email link.
The CA and the agent do the heavy lifting. The settings stay legible.
Default 15 minutes. Max ceiling per server. Engineers can request shorter; they cannot request longer.
Pin which Unix users a cert may authenticate as. Multi-user (root + deploy + app) supported.
Optional. When on, the cert refuses to authenticate from anywhere else — mitigates lift-and-shift.
Free-text, but mandatory. Surfaces in the audit log and in the approval email so the approver knows why.
Revoke any active cert from the audit log. Hosts pull the Key Revocation List every 30 s — there's no waiting on a human to log in and clean up.
If someone bypasses the Gatekeeper and logs in via a trusted_keys fallback, the agent flags it within seconds — auth.log + journalctl scanned, event raised.
Optional per server. The cert carries a force-command that runs the recording wrapper before the shell — failure-tolerant, replayable, retained as long as you need.
Interactive shells captured as asciinema casts. Non-interactive commands logged with full stdout / stderr. Both replayable in the browser; both pruneable by retention rules.
The artefacts the framework asks for, generated automatically and exportable.
Audit page with filters by user, server, status, date range. Stream-export to CSV for evidence packs.
Engineers register their public SSH key once — like adding a key on GitHub. The platform never sees the private half.
Each tenant gets a dedicated ed25519 CA, encrypted at rest. Hosts trust only your CA — there is no shared signer.
Short-lived, scoped, audited — without making engineers wait.