Tutorial Interactive user access

Palo Alto Networks SSH Manager · vSSH CLI

Tutorial: interactive user access to a fleet

Goal: give engineers short-lived SSH access to a set of hosts, with no static keys in authorized_keys. When a session expires, access ends on its own.

This tutorial connects the whole chain: what an administrator sets up in SSH Manager, what a server admin does on each host, and what an engineer runs day to day.

On the SSH Manager side

An administrator sets these up once. Exact screens are in the product documentation; the pieces you need are:

• An SSH certificate issuance template for user logins, for example Users - Web Admins, with the allowed principals and a short maximum validity.
• The certificate authority the template signs with.
• An authentication method for your users, such as browser SSO through your identity provider.

Note the template name and the service URL, for example https://tpp.example.com. Engineers and server admins both need them.

Step 1: server admins trust the CA

On each host, trust the CA that signs user certificates. Retrieve the CA key and point sshd_config at it:

vssh service ca retrieve \
  --use-to-configure openssh_server \
  --out-file /etc/ssh/trusted_user_ca_keys \
  --template "Users - Web Admins"

Add the trust line to sshd_config, then validate and reload:

TrustedUserCAKeys /etc/ssh/trusted_user_ca_keys

sudo sshd -t && sudo systemctl reload sshd

Confirm the result:

sudo vssh openssh server show

For per-host principal mapping and host-key trust, see SSH server administration.

Step 2: the engineer installs and configures a profile

Install vSSH (see Installing or updating to the latest version), then save the connection details so you do not repeat them:

vssh profile set url=https://tpp.example.com

See Working with configuration profiles.

Step 3: authenticate and load a certificate

vssh login --auth browser

vSSH opens your browser and shows a one-time code. Complete sign-in, including MFA, with your identity provider. On success it loads a short-lived certificate into your OpenSSH agent and prints the identity and time left:

Enrolled certificate for Users - Web Admins
  Principals: web-admins
  Valid for:  11h59m

The default session length is 12 hours. Change it with --session-time. See login.

Step 4: connect

Use ssh as normal. The agent presents the certificate.

ssh deploy@app01.example.com

Check what is loaded and how long it is valid:

vssh status

Step 5: end the session

The certificate expires on its own. To clear it early:

vssh logout

What you achieved

• No engineer public key sits in any authorized_keys file.
• Access is bounded by the certificate lifetime, not by a manual offboarding step.
• Every login is authenticated through your identity provider and recorded centrally.

Related pages

• login
• Enrolling SSH certificates for interactive logins to remote hosts
• Securing SSH access
• SSH server administration