Zero Trust SSH with Short-Lived Certificates

Stop Managing SSH Keys

Fail2ban logs full of bots hammering port 22. Your DevOps team's laptops scattered across coffee shops with private keys. Rotating keys across 50 servers takes a weekend. One leaked key compromises everything.

This package eliminates SSH key management entirely. Users authenticate through your identity provider (email, Okta, GitHub, etc.), get a short-lived certificate (~1 hour), and access servers through Cloudflare's network. Port 22 is never exposed publicly. Every login is audited. Keys never leave Cloudflare's infrastructure.

What's Included

• terraform/ — Complete Cloudflare Zero Trust setup: Tunnel, Access app, SSH CA, DNS record, policies (provider v5)
• server/setup-server.sh — Idempotent installation: cloudflared service, sshd CA config, systemd unit (Ubuntu/Debian/RHEL)
• server/99-cloudflare-ca.conf — sshd configuration snippet
• client/ssh-config-snippet — SSH client ProxyCommand setup
• README.md — Full walkthrough with architecture diagram, troubleshooting, audit logging, username/principal mapping

How It Works

User runs ssh prod-ssh → Browser opens for authentication → Cloudflare mints short-lived cert → SSH connects transparently through tunnel → Server trusts Cloudflare's CA → Access logged. No passwords. No key management. No port 22 scanning.

Requirements

• Cloudflare account with Zero Trust / Access plan
• Linux server (Ubuntu 18.04+, Debian 10+, RHEL 8+, Amazon Linux 2+, Raspberry Pi OS)
• Cloudflare One Client on user devices (macOS, Windows, Linux, iOS, Android)
• Terraform 1.0+ on your machine