Secure SSH access for teams
Flotte makes SSH access easier to manage with short-lived certificates, group-based permissions, and identity-linked operational records.
$ flotte login
✓ Authenticated via SSO
$ ssh production-server
✓ Short-lived certificate issued
✓ Connected to production-server
user@production-server:~$ _
<1 min
Certificate lifetime
Zero
Long-lived keys on machines
100%
SSH activity recorded
Instant
On- and offboarding without missing access
The access problem
Keys and passwords are easy to share—and hard to take back
SSH key sprawl
“Can you show us who can access production right now?”
Answering often means inspecting every server, identifying old keys, finding their owners, and reconciling them against current employees and suppliers.
An offboarding policy is not enough while a former team member's key may still exist on dozens of machines.
$ ssh prod-01
$ cat ~/.ssh/authorized_keys
ssh-ed25519 AAAAC3... alice@company
ssh-ed25519 AAABC3... laptop
# Who owns “laptop”?
# Jeff left three months ago. Is this his key?
# 29 more production servers to check
Why passwords do not solve this
A shared password proves someone knew the secret—not who used it
Once a password is copied into a chat, text file, ticket, password manager, or script, there is no reliable way to know who still has it.
When someone leaves, disabling their company account does not erase the password. You must rotate it everywhere, update dependent automation, and hope no unmanaged copy remains.
team-infra
14 members
Sam · 09:42
Does anyone know the password?
Alex · 09:44
Here is the password for prod:
Read by 14 · ✓✓
Sam · 09:45
Thanks! 👍
Disabling an account does not revoke a shared password.
Permanent credentials spread across servers, scripts, tickets, and chats—making access difficult to attribute and revoke reliably.
The access model
Badges, not spare keys
Traditional SSH keys behave like spare building keys: once copied, they keep opening doors until you change every lock. Flotte issues a short-lived access badge after SSO, scoped to the person, server, and moment.
Copies are hard to get back
Keys end up on laptops, backups, and old machines. If one person leaves, you have to find every copy or rotate access everywhere.
Issued at the door, then expired
Flotte is designed to check identity and permissions, sign a short-lived certificate, and let it expire after its configured lifetime.
Controls for managed SSH access
Built for teams who care about security without sacrificing developer experience.
Short-Lived Certificates
Configurable short-lived certificates reduce reliance on persistent user keys distributed to managed servers.
Group-Based Permissions
Intuitive permission system using groups. Assign access to servers and users with flexible, granular control.
Centralized Access Control
Manage eligibility for Flotte-managed SSH access centrally as people and responsibilities change.
Managed Sudo Access
Manage supported sudo privileges centrally through the Flotte PAM integration.
Operational Access Records
Retain identity-linked records for activity observed through Flotte to support access reviews and investigations.
Managed Access Overview
See who is eligible for Flotte-managed SSH access and update permissions as responsibilities change.
CLI Integration
Use the CLI with an OAuth device flow to request short-lived certificates on demand.
Linux, macOS, and Windows
Use Flotte from the operating system your team already works in. No need to switch machines or change SSH habits.
OIDC Authentication
Native support for Keycloak and Microsoft Entra ID out of the box. Easily extendable to other OIDC-compliant providers.
SSH certificate authentication FAQ
Short facts about Flotte and SSH certificate authentication.
Read the practical SSH certificate guideHow does Flotte work?
Connect your servers and identity provider, then assign users to roles. Flotte configures server trust, checks access, and issues short-lived SSH certificates. Your team keeps using standard SSH while you manage access centrally.
What is SSH certificate authentication?
An SSH certificate authority (CA) signs a user's public key, and your servers trust the CA instead of storing every user's key. This moves access management out of individual servers and into one central place. OpenSSH grants access only when the certificate's signature, expiry, principal, and server rules are valid.
How are SSH certificates different from regular SSH keys?
Both use a public and private key pair. Regular SSH keys must usually be copied to every server and stay valid until removed. Certificates add a trusted CA signature, permitted principals, and an expiry time, reducing persistent user keys across your fleet.
Does Flotte provide SSO and OIDC integration?
Yes. Flotte connects to Microsoft Entra ID or Keycloak through OIDC. Google Workspace, GitHub, and Slack identities can connect through Keycloak. Flotte uses the verified identity and assigned roles to approve access; your provider keeps control of sign-in and MFA.
What happens when someone leaves the company?
If the account is disabled, Flotte denies access and issues no new certificates. Any certificate already issued remains valid only until its short expiry (default less than 30 seconds) time.
Does SSH certificate authentication provide an audit trail?
Flotte records who received a certificate, for what access, and when. These records support access reviews and investigations.
Can Flotte manage sudo access too?
Yes. SSH certificates control server login, and Flotte's PAM module adds centrally managed sudo access. You can use the same Flotte roles to decide who may connect and who may elevate privileges.