Command login
Palo Alto Networks SSH Manager · vSSH CLI
Authenticate to SSH Manager and enroll one or more certificates for interactive SSH logins. By default the private key and certificate go into your running OpenSSH agent, so you can ssh to a host right away without pointing at a key file.
Aliases: l, li
vssh login [username] [template] [flags]
| Argument | Description |
|---|---|
username |
Username to authenticate with. Overrides --user and the profile value. |
template |
Issuance template name. Overrides --template. |
| Flag | Default | Description |
|---|---|---|
--template |
* |
Name of the issuance template. Use * to choose from all templates you are allowed to use. |
--session-time |
12h |
Requested validity of the certificate. |
--add-keys-to |
auto |
Where to store the credential: auto, agent, or disk. auto uses the agent when it is running and falls back to disk. |
-o, --out-file
|
(none) | Base name for the output files. Use only with --add-keys-to disk. |
--create-ssh-config |
false |
Also write an SSH client config file. Use only with --add-keys-to disk. |
--ssh-config-name |
ssh_config |
Name of the SSH client config file. Use only with --create-ssh-config. |
--browser |
auto |
Browser to use for browser (SSO) login. |
--public-key |
auto |
Public key source. For login, auto requests a key generated by the service. You can also pass a file path, local, service, or paste. |
--legacy-client |
auto-detected | Use only with an SSH client older than OpenSSH 7.3. |
Global authentication flags such as --url, --user, --auth, --token, and --jwt-file also apply. See Command reference and Authentication methods.
Log in with the default profile:
vssh loginLog in as a specific user and template against a specific service:
vssh login alice --template "Users - Web Admins" --url https://tpp.example.comWrite the credential to disk instead of the agent (for a host with no agent):
vssh login --add-keys-to disk --out-file ~/.ssh/id_ssh_manager --create-ssh-configLog in from a CI job with a JWT (no interactive prompt):
VSSH_JWT=$CI_JOB_JWT vssh login --auth jwt --url https://tpp.example.com- When more than one template matches, vSSH asks you to pick one unless you pass
--no-prompt. - Each successful login can enroll several certificates (one per matching template). vSSH prints the identity (principals) and role (template) for each, with the time left before expiry.
- The session token vSSH mints to talk to the service is revoked when the command finishes, unless you authenticated with a token you supplied yourself. See Authentication methods.