Skip to content

Home

Jump to bottom
Atanas Chuchev edited this page Aug 25, 2026 · 17 revisions
Palo Alto Networks

SSH Manager · vSSH CLI

Apache 2.0 License Compatible with TPP 23.1+

vSSH CLI

vSSH CLI is a command line tool that requests SSH certificates from Palo Alto Networks SSH Manager and puts them to work. It authenticates to the service, gets a short-lived SSH certificate from an issuance template, and loads it into your OpenSSH agent or writes it to disk. It also configures OpenSSH servers to trust the SSH certificate authority (CA), retrieves CA public keys, and manages access tokens.

The tool replaces long-lived SSH keys with certificates that expire on their own. There is no key to rotate manually and no authorized_keys file to maintain per host. A server trusts the CA once, and every valid certificate the CA issues is accepted until it expires.

Who this is for

You are on a... Start here
Security team Securing SSH access with certificates
DevOps / platform team CI/CD automation
Team that runs SSH servers SSH server administration
New to the tool Interactive user access tutorial

How it works

  1. You authenticate to SSH Manager (password, browser SSO, an access token, or a JWT from a CI system).
  2. vSSH requests a certificate from an issuance template that defines the policy (principals, validity, allowed source addresses, and so on).
  3. vSSH loads the private key and certificate into your OpenSSH agent, or writes them to disk for an application or host.
  4. You connect with ssh. The server accepts the certificate because it trusts the CA that signed it.

Compatibility

vSSH CLI is tested against the latest release of Palo Alto Networks SSH Manager. General functionality works with SSH Manager (TPP) 23.1 or higher.

Quick installation

Linux (x64) — download, unzip, and move onto your PATH (may require sudo):

curl -L "https://github.com/Venafi/vssh-cli/releases/latest/download/vssh_linux_amd64.zip" -o vssh.zip && unzip -o vssh.zip && sudo install -m 0755 vssh /usr/local/bin/vssh

macOS (Apple silicon):

curl -L "https://github.com/Venafi/vssh-cli/releases/latest/download/vssh_darwin_arm64.zip" -o vssh.zip && unzip -o vssh.zip && sudo install -m 0755 vssh /usr/local/bin/vssh

For Windows, download and extract the archive:

Full instructions are in Installing or updating to the latest version.

Quick start: interactive login

Configure a profile once, then log in and connect.

$ vssh profile configure --url https://tpp.example.com --user alice --template-login "Users - Web Admins"
? Profile name: default
? Service URL: https://tpp.example.com
? Username for authentication: alice
? [Login Operation] Template name: Users - Web Admins
? [Enroll Operation] Template name:
? Do you want to configure more settings? No
? Do you want to save the configuration (as 'default')? Yes
  Configuration profile 'default' was successfully saved.
$ vssh login
  Logging in as alice...
? Enter password for user alice: ************
  Authenticating...
  Logged in as alice
  One template (Users - Web Admins) found. Using it.
  Your identity is alice
  Your role is Users - Web Admins (expires in 12 hours)
  Credentials have been added to your OpenSSH agent.
  Now you can perform SSH logins to remote servers.
$ ssh alice@web.example.com
alice@web:~$

Before this works, an administrator completes the prerequisites and the target host trusts the CA. See SSH server administration.

Documentation

Getting started

Configuration

Authentication

Guides

Tutorials (end to end)

Task tutorials

Command reference

License

Copyright © Palo Alto Networks, Inc. All rights reserved.

vSSH CLI is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Palo Alto Networks SSH Manager · vSSH CLI. Licensed under the Apache License, Version 2.0. To report a problem or share an idea, use Issues.

vSSH CLI

Getting started

Configuration

Authentication

Guides

Tutorials

Command reference

Reference

Clone this wiki locally