Command service

Palo Alto Networks SSH Manager · vSSH CLI

vssh service

Operations that talk directly to SSH Manager: retrieving CA public keys and managing access tokens.

Aliases: s

Subcommands:

• ca retrieve
• token obtain
• token revoke

---

vssh service ca retrieve

Retrieve the public key of the SSH certificate authority for one or more issuance templates. Use it to tell an OpenSSH server which CA to trust, or to tell an OpenSSH client which host CA to trust.

Aliases: r (for retrieve)

vssh service ca retrieve [flags]

Flag	Default	Description
--template	*	Template names. Repeatable and comma-separated. --template a,b --template c gives a, b, c.
--use-to-configure	(prompt)	Output format: openssh_server (a TrustedUserCAKeys file) or openssh_client (a known_hosts line prefixed with @cert-authority *).
--out-to	(prompt)	Where the keys go: file or display.
-o, --out-file	(prompt)	Output file name when --out-to file is used.

With --no-prompt, you must set --use-to-configure and either --out-to or --out-file, otherwise the command fails.

Examples

Print the CA public key for the server trust file:

vssh service ca retrieve --use-to-configure openssh_server --out-to display

Write the CA public key to a trust file:

vssh service ca retrieve \
  --use-to-configure openssh_server \
  --out-file /etc/ssh/trusted_user_ca_keys \
  --template "Users - Web Admins"

Produce a known_hosts entry so clients trust host certificates from the CA:

vssh service ca retrieve --use-to-configure openssh_client --out-file ~/.ssh/known_hosts

See SSH server administration and Retrieving the public keys of your SSH CAs.

---

vssh service token obtain

Obtain an access token for authentication to SSH Manager. Normal commands revoke their session token when they finish. This command keeps the token so you can reuse it, which is useful for scripts and short-lived automation.

Aliases: o, get, retrieve, getcred

vssh service token obtain [flags]

Flag	Description
--store-to-profile	Name of the profile where the token is saved. The profile must already exist.

Behavior:

• With --store-to-profile, the token is saved into that profile.
• With --no-prompt and no profile, the token is printed so you can capture it.
• Interactively, vSSH asks whether to display the token or store it in a profile.

Examples

Print a token:

vssh service token obtain --no-prompt

Fetch a token and store it in a profile in one step:

vssh service token obtain --store-to-profile env_dev

Security note: A stored token is a bearer credential. Protect the profile file, give the token the smallest scope it needs, and revoke it when you are done.

---

vssh service token revoke

Revoke an access token so it can no longer authenticate.

Aliases: r, invalidate, void, voidcred

vssh service token revoke [flags]

Flag	Description
--token-to-revoke	The token value to revoke.
--token-from-profile	Revoke the token stored in this profile, then clear it from the profile.

With --no-prompt you must pass one of the two flags. Interactively, vSSH asks which token to revoke and confirms first.

Examples

Revoke a specific token:

vssh service token revoke --token-to-revoke 9pxmP4ZZBuhKHnjv8PfNGA==

Revoke the token stored in a profile and remove it from that profile:

vssh service token revoke --token-from-profile env_dev

Related pages

• Authentication methods
• CI/CD automation
• SSH server administration