Skip to content

SSH Teams Documentation

SSH Teams replaces brittle, long-lived SSH key distribution with centrally managed, short-lived SSH certificates.

What SSH Teams Does

SSH Teams provides a team-based access control layer for SSH infrastructure:

  • Registers servers into a team trust domain
  • Lets admins define certificate issuance policies
  • Registers user devices through an OAuth device flow
  • Issues short-lived SSH certificates based on policy matches
  • Centralizes lifecycle controls for users, devices, and access rules

Why It Is Better Than Standard SSH Keys

Traditional SSH key management usually means copying public keys to many servers and manually removing keys when users leave. SSH Teams improves this by using certificate-based access with policy-driven issuance.

Key advantages:

  • Short-lived access instead of permanent key trust
  • Central policy enforcement across all joined servers
  • Faster offboarding by revoking device/user access centrally
  • Better operational consistency with a shared trust model
  • Reduced key sprawl in server authorized_keys files
  • Cleaner audit and troubleshooting paths through centralized controls

Quick Start (Docker)

The example below runs SSH Teams in Docker, maps host ports 8080 and 8443, and uses ./nitrate for local persistence by default.

mkdir -p ./nitrate/conf.d ./nitrate/data

docker run -d \
  --name nitrate-sshteam \
  -p 8080:8888 \
  -p 8443:8443 \
  -v "$(pwd)/nitrate/conf.d:/app/conf.d" \
  -v "$(pwd)/nitrate/data:/app/nitrate/data" \
  -e SSHTEAM_PERSISTENCE_BACKEND=nitrate \
  -e HTTP_PORT=8888 \
  -e HTTPS_PORT=8443 \
  jadaptive/sshteam:latest

Then:

  1. Open https://localhost:8443 in your browser.
  2. Complete first-time setup to create your primary team and admin account.
  3. Log in and start joining servers and creating policies.

Licensing

SSH Teams is available as a fully featured Community Edition Docker container with no user-count gates.

This follows Jadaptive's philosophy: "Software is the Gift, Expertise is the Paywall." In practice, that means core software capabilities are production-ready and broadly available, while commercial licensing focuses on organizational complexity and expert support rather than artificial feature lockouts.

Manifesto: Jadaptive Manifesto

Community Edition

  • Fully featured SSH Teams core experience
  • No seat-based user restrictions
  • Docker-first, self-hosted deployment model

Activation Requirement

Community Edition requires connectivity to activation.jadaptive.com to send anonymous telemetry used for activation heartbeat and service continuity.

Example activation heartbeat payload (application-level):

{
  "instance_id": "4f61f4c2-6bb0-4ce4-b5f7-7a6f2f9f9f1e",
  "product_id": "SSH Team",
  "version": "0.0.1--",
  "uptime": 86400,
  "registration_text": "",
  "metrics": {
    "Teams": 1,
    "Users": 20,
    "Devices": 12,
    "Active Devices": 10,
    "Revoked Devices": 2,
    "Servers": 8,
    "Policies": 3,
    "Certificates Issued": 42,
    "RSA Certificates Issued": 10,
    "ED25519 Certificates Issued": 32,
    "join.sh Downloads": 7,
    "join.ps1 Downloads": 5
  }
}

No personally identifiable user fields are included in this application telemetry payload (for example: no email addresses, usernames, phone numbers, or SSH public keys).

When a Commercial License Is Needed

A license is required for scenarios that go beyond standard connected community use, including:

  • Air-gapped or offline deployments
  • Technical support requirements
  • Compliance support requirements
  • Select enterprise capabilities, such as multi-tenancy

Documentation Map