Native SSH

Summary

Native SSH access over Netmaker networks so users can reach private hosts without managing separate SSH bastions or exposing SSH publicly.

Goals

• Provide secure SSH sessions to network resources via Netmaker identity and access controls
• Enforce least-privilege access using existing roles, groups, ACLs, and JIT workflows where applicable
• Support session auditability (who connected, to what, when)
• Reduce reliance on traditional bastion hosts for remote admin access

Scope (initial)

• Authenticated SSH access to nodes/resources on Netmaker networks
• Integration with Netmaker user identity (and IdP where configured)
• Basic session logging and admin visibility

Out of scope (for now)

• Full session recording (planned later)
• Browser-based private access (planned later)

Success criteria

• Admins can grant/revoke SSH access through Netmaker policy
• Users can SSH to allowed hosts without public SSH exposure
• Access attempts and sessions are visible in audit/activity logs