jadaptive/sshteam repository overview

⁠SSH Teams

Free, self-hosted SSH certificate authority for secure, short-lived SSH access.

SSH Teams replaces the distribution and management of permanent SSH keys with short-lived SSH certificates issued on demand.

Run it in your own infrastructure, define who can access what, and let authorised users obtain temporary SSH credentials when they need them.

No permanent SSH keys to distribute. No user limits. No registration. No trial.

⁠Stop distributing permanent SSH keys

Traditional SSH access usually means copying public keys onto servers and then trying to keep track of who has access, where those keys are installed, and whether they should still be there.

SSH Teams takes a different approach.

Servers trust your SSH certificate authority. Users authenticate with SSH Teams and receive a short-lived certificate authorising the access they need.

When the certificate expires, the access expires with it.

No key removal exercise. No forgotten authorized_keys entries.

⁠What can it do?

SSH Teams lets you:

• Issue short-lived SSH certificates on demand
• Replace permanent user SSH keys with temporary credentials
• Control SSH access using policy
• Centrally manage who can access your SSH infrastructure
• Support modern Ed25519 and RSA SSH keys
• Run your SSH certificate authority in your own environment
• Simplify onboarding and removal of SSH users
• Integrate certificate-based SSH access into automation and agent workflows

⁠Why SSH Teams?

⁠Short-lived SSH access

SSH certificates are deliberately temporary.

Rather than granting access with credentials that may remain valid for months or years, SSH Teams issues certificates with a limited lifetime.

If somebody no longer needs access, there isn't a permanent public key scattered across your servers waiting to be discovered and removed.

⁠Policy-based access

Define which users are allowed to access which SSH resources.

SSH Teams evaluates access before issuing a certificate, allowing SSH permissions to be managed centrally rather than independently on every server.

⁠Self-hosted

Run SSH Teams inside your own infrastructure.

Your SSH certificate authority, access policies and credentials remain under your control.

⁠Simple server trust

Instead of maintaining individual user keys in authorized_keys, configure your SSH servers to trust the SSH Teams certificate authority.

Once that trust is established, authorised users can receive certificates without requiring their individual public keys to be installed on every server.

⁠Free and unlimited

SSH Teams is free to deploy and use.

There are no artificial user limits designed to force you into a paid tier as your environment grows.

Use it. Scale it.

⁠How does it work?

At a high level:

1. Your SSH servers are configured to trust the SSH Teams certificate authority.
2. A user requests SSH access.
3. SSH Teams evaluates the applicable access policy.
4. If authorised, SSH Teams signs the user's SSH key and issues a short-lived certificate.
5. The user connects to the server using their key and certificate.
6. When the certificate expires, the access automatically expires with it.

The server only needs to trust the certificate authority. It doesn't need an individual permanent public key installed for every user.

⁠Who is it for?

SSH Teams is useful for:

• DevOps and infrastructure teams
• System administrators
• Development teams accessing Linux infrastructure
• Organisations managing access across multiple SSH servers
• Teams that want to eliminate permanent SSH key distribution
• Environments where access should be temporary and policy-controlled
• Organisations that prefer self-hosted security infrastructure

⁠Docker Setup

SSH Teams can be started with a single Docker command using named volumes for persistent configuration and data.

⁠Quick Start

docker run -d \
  --name sshteam \
  -p 8080:8080 \
  -p 8443:8443 \
  -v sshteam_conf:/app/conf.d \
  -v sshteam_data:/app/nitrate/data \
  -e SSHTEAM_PERSISTENCE_BACKEND=nitrate \
  -e HTTP_PORT=8080 \
  -e HTTPS_PORT=8443 \
  jadaptive/sshteam:latest

Docker automatically creates the sshteam_conf and sshteam_data volumes when the container is first started.

Once running, access SSH Teams using:

https://localhost:8443

HTTP is also available on port 8080.

Your browser may display a certificate warning when accessing a new local installation over HTTPS.

⁠Stop

Stop the container:

docker stop sshteam

Start it again:

docker start sshteam

To remove the container:

docker rm -f sshteam

The configuration and application data remain stored in the Docker volumes.

⁠Configuration

The example above uses the following environment variables:

⁠Persistent Data

The container stores persistent configuration and application data in:

Docker named volumes are used in the Quick Start so no host directories need to be created before starting the container.

To inspect the volumes:

docker volume ls

⁠Documentation & Community

Full documentation is available at:

https://docs.jadaptive.com⁠

Learn more about Jadaptive and our free, self-hosted infrastructure and security software:

https://jadaptive.com⁠

Questions, feedback and community support:

https://www.reddit.com/r/jadaptive/⁠

⁠More from Jadaptive

SSH Teams is part of Jadaptive's growing collection of free, self-hosted infrastructure and security software, including:

• Password Express
• Nodal VPN
• Aegis Gateway
• DropPort
• Maverick SSH MCP

Explore the Jadaptive Docker Hub namespace to discover more.

The software is the gift. Our expertise is the paywall.

Use it. Scale it. No artificial limits.