Zero Trust SSH

jalth replaces SSH key distribution with Cloudflare Access short-lived certificates. Your IdP (Google, GitHub, Okta, or any OIDC) becomes your SSH authentication.

Enable SSH on a device

jalth ssh enable

Configures the SSH CA, creates an infrastructure Access app, and starts the tunnel route for SSH on this device.

Connect to a device

jalth ssh homeserver

Opens browser SSO (if needed), obtains a short-lived certificate, and connects via ssh.

Note

Your existing authorized_keys keep working unless you remove them. Zero Trust SSH is additive.

Manage access

# Allow an email to SSH into this device
jalth ssh allow alice@team.com

# Allow on another device
jalth ssh allow bob@team.com --device staging-vm

# Revoke access
jalth ssh revoke alice@team.com

# List who can SSH
jalth ssh list

# Register additional UNIX users
jalth ssh add-user deploy
jalth ssh remove-user deploy

# Disable Zero Trust SSH
jalth ssh disable

How it works

1. You run jalth ssh <device>
2. Cloudflare Access authenticates you via SSO
3. A short-lived SSH certificate is issued (minutes, not years)
4. ssh connects through the device’s tunnel with the certificate
5. Revocation is instant — remove the email from Access policies

vs traditional SSH keys

	SSH keys	jalth SSH
Distribution	Copy pubkeys to every machine	None — IdP handles auth
Revocation	Manual removal from every authorized_keys	Remove from Access policy
Expiry	Never (unless rotated)	Short-lived certificates
Audit	Limited	Cloudflare Access logs

Prerequisites

• sshd running on the target device
• ssh client on your machine
• sudo for CA configuration writes
• Device must be on the mesh with a cloudflared tunnel

Run jalth doctor if SSH setup was skipped during init/join.