# Flotte — Consolidated Site Content Canonical URL: https://flotte.sh/ Flotte is an SSH certificate-management product for teams. It centralizes SSH access eligibility, authenticates users through an OIDC identity provider, and issues configurable short-lived OpenSSH certificates for managed servers. This document represents every public content page on the Flotte website. The linked HTML pages remain canonical. Markdown endpoints are used where the site provides them. ## Product overview Page: https://flotte.sh/ Markdown: https://flotte.sh/index.md ### Capabilities - Configurable short-lived SSH certificates reduce reliance on persistent user public keys installed on managed servers. - Group-based permissions map eligible users and groups to the managed servers they need. - Central access eligibility controls who may request future certificates. - OIDC authentication uses the company's configured identity provider and its MFA policy. - Identity-linked permission and certificate-issuance records describe managed activity. - Standard OpenSSH certificates work with servers configured to trust the applicable certificate authority. - The access-control service is designed to run within infrastructure operated by the customer. Removing eligibility prevents new certificates from being issued. Certificates already issued remain valid until their configured expiry. Flotte does not control access paths configured outside the product. Permission and certificate-issuance records do not by themselves prove that an SSH connection occurred and are not audit attestations. ## Employee onboarding and offboarding Page: https://flotte.sh/usecase/onboarding-offboarding/ Flotte provides a focused SSH access lifecycle rather than a general employee-lifecycle suite. Teams connect their company identity provider, define access through people or groups, let eligible engineers request short-lived certificates, and remove future eligibility centrally when a role changes or a person leaves. The product complements rather than replaces identity providers, HR systems, device management, local server authorization, and broader SaaS onboarding and offboarding processes. Its purpose is to make the answer to “who may obtain SSH access to which managed servers?” easier to manage and review. ## Supply chain resilience for SSH access Page: https://flotte.sh/usecase/supply-chain-resilience/ Recent npm supply-chain incidents have shown that a malicious dependency can execute on a developer workstation or build system and steal SSH keys, passwords, tokens, cloud credentials, and other local secrets. Flotte is designed to reduce the infrastructure blast radius for SSH access to managed servers by replacing persistent user public keys with identity-linked, scoped, configurable short-lived OpenSSH certificates. A leaked private key alone does not grant access to Flotte-managed servers; it also requires a valid certificate issued for that key. A stolen key and certificate remain usable only for the configured certificate lifetime, and future certificate issuance can be revoked centrally. This can narrow SSH credential cleanup after an endpoint incident, but does not prevent package compromise, malware execution, endpoint compromise, credential theft, or use of a valid certificate before it expires. The page cites the 2025 s1ngularity/Nx, Shai-Hulud, and Shai-Hulud 2.0 incidents as examples of software supply-chain credential theft. It also describes complementary measures such as dependency review, endpoint protection, secret management, least privilege, phishing-resistant MFA, monitoring, and incident response. ## ISO 27001 use case Page: https://flotte.sh/usecase/iso-27001/ Flotte can support a limited part of an organisation's SSH access-control process and contribute operational records to wider access reviews and control testing. Central permissions, short-lived certificates, identity-provider authentication, and permission and issuance history may support an organisation's controls and evidence collection. Product use alone does not demonstrate ISO/IEC 27001 conformity. Flotte is not a certification body or compliance adviser, and acceptance of product records by an auditor is not guaranteed. Official references: - ISO/IEC 27001: https://www.iso.org/standard/27001 - ISO/IEC 27002: https://www.iso.org/standard/75652.html ## NIS2 use case Page: https://flotte.sh/usecase/nis2/ Checklist: https://flotte.sh/nis2-ssh-access-control-checklist.md Flotte can support a limited set of SSH server-access controls within a wider cybersecurity risk-management programme. It can help centralize current permissions, issue time-limited credentials, apply identity-provider authentication, revoke future certificate eligibility, and retain managed permission and issuance records. It does not make an organisation NIS2 compliant. Applicable duties depend on the organisation, sector, jurisdiction, risk profile, national implementation, and other applicable law. Records outside Flotte—including identity-provider, server, SIEM, approval, and connection logs—may also be needed. The accompanying checklist contains twelve review questions covering access inventories, credential ownership, shared accounts, revocation, credential lifetime, authentication, approvals, change records, contractor access, offboarding verification, incident reconstruction, and periodic reviews. Official references: - NIS2 Directive: https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng - Commission Implementing Regulation (EU) 2024/2690: https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng ## Blog Blog index: https://flotte.sh/blog/ The Flotte blog publishes engineering notes and practical SSH and infrastructure-security guidance. ### What Are SSH Certificates, Anyway? Article: https://flotte.sh/blog/what-are-ssh-certs-anyway/ Published: 2026-07-05 Author: Julian — https://github.com/k0in Topics: SSH, security, best practices An SSH certificate contains a public key plus signed information such as allowed principals, a validity window, critical options, and a certificate-authority signature. Instead of installing every user's public key in `authorized_keys`, a server can trust a certificate authority through OpenSSH's `TrustedUserCAKeys` configuration. This changes access management from copying long-lived keys to applying policy at issuance time: who may receive a certificate, for which server or principal, and for how long. Short validity windows limit how long an already-issued credential remains usable after future issuance is disabled. Server-side logs are still required to establish whether a connection occurred. The article compares passwords, raw SSH keys, and SSH certificates; explains certificate-authority trust; describes team access and offboarding; and discusses Flotte's role around identity, permissions, issuance records, server trust, and centrally managed sudo rights. ### A Practical Guide on SSH Port Forwarding Article: https://flotte.sh/blog/ssh-port-forwarding-without-the-mystery/ Published: 2026-07-02 Author: Julian — https://github.com/k0in Topics: SSH, networking, infrastructure, cheat sheet Local forwarding (`ssh -L`) opens a port on the client and sends traffic through SSH to a destination reachable from the server. Remote forwarding (`ssh -R`) opens a port on the remote side and sends traffic back to a destination reachable from the client. The guide covers bind addresses, `GatewayPorts`, `PermitListen`, destination-side DNS resolution, Ollama sharing examples, `-N`, `-f`, `ExitOnForwardFailure`, SSH keepalives, `autossh`, and reusable `~/.ssh/config` definitions. Public remote binds such as `0.0.0.0` can expose a service to the internet and should only be used with appropriate authentication and firewall restrictions. ## Waitlist Page: https://flotte.sh/waitlist/ Markdown: https://flotte.sh/waitlist.md Flotte is in pre-launch. The waitlist provides early-access and product-availability updates. Signup asks for an email address, an optional name, acceptance of the privacy notice, and confirmation through double opt-in. The form submits to a self-hosted listmonk instance. ## Privacy policy Page: https://flotte.sh/datenschutz/ Markdown: https://flotte.sh/datenschutz.md The German privacy policy identifies NullSoft UG (haftungsbeschränkt) as controller and describes email contact, hosting and server logs, netcup as hosting processor, self-hosted cookie-free Umami analytics, the self-hosted mailing list, retention, data-subject rights, security, and contact details. The canonical policy contains the complete and current legal text. ## Legal notice Page: https://flotte.sh/impressum/ Markdown: https://flotte.sh/impressum.md The German legal notice contains the provider, representation, register, contact, editorial-responsibility, liability, copyright, and dispute-resolution disclosures. The canonical notice contains the complete and current legal text. ## Site resources - Curated LLM index: https://flotte.sh/llms.txt - Compatibility LLM index: https://flotte.sh/llm.txt - XML sitemap: https://flotte.sh/sitemap.xml - Crawler policy: https://flotte.sh/robots.txt - Flotte GitHub organisation: https://github.com/flotte-sh The compliance-related material is general product information, not legal, regulatory, audit, certification, or professional security advice.