Skip to content

14 Glossary

This glossary defines common SSH Teams terms used across chapters so operators and security reviewers can read the guides consistently.

14.1 Identity and Access Terms

  • Principal: The UNIX account name requested in the SSH certificate (for example ubuntu, deploy, root).
  • User account: A person identity in SSH Teams used for login, policy targeting, and auditing.
  • Device: A registered CLI client identity that can request signing tokens and certificates.
  • Scope: OAuth permission boundary for tokens. Common values are join (server enrollment) and signing (certificate issuance).

14.2 Token and Proof Terms

  • Device authorization flow: OAuth flow where CLI gets a device code, user approves in browser, then CLI receives token.
  • Access token: Short-lived token used to call protected APIs.
  • Refresh token: Longer-lived token used to obtain new access tokens without repeating browser approval.
  • DPoP: Demonstration of Proof-of-Possession. A signed proof that binds token usage to the device key.
  • DPoP proof: Per-request signed JWT used with DPoP-bound token validation.

14.3 Server and Trust Terms

  • Join flow: Process that registers a server into SSH Teams trust and returns CA trust material.
  • Server fingerprint: SSH host-key fingerprint used for server identity and policy matching.
  • TrustedUserCAKeys: SSH server trust file that lists CA public keys allowed to sign user certificates.
  • Team CA: Certificate authority key material used by SSH Teams to sign short-lived user certificates.

14.4 Policy and Operations Terms

  • Policy priority: Evaluation order for policies. Lower numbers are evaluated first.
  • Time restrictions: Allowed issuance windows in DAY,HH:mm,HH:mm format.
  • Source IP constraints: Allowed client source ranges (IPv4/IPv6/CIDR) for certificate issuance.
  • Break-glass policy: Narrow emergency policy used for controlled incident access.

14.5 Runtime and Environment Terms

  • Nitrate mode: Embedded persistence mode for quick startup and smaller deployments.
  • Mongo mode: External MongoDB-backed persistence mode for independent DB lifecycle management.
  • SSL conf directory: Runtime path storing TLS and related configuration material (SSHTEAM_SSL_CONF_DIR).
  • Default server: Preferred SSH Teams CA endpoint used when --server is omitted in CLI commands.

14.6 Pro Tip

  • Treat this glossary as a control vocabulary. If you update term meaning in one chapter, update this glossary first, then align the rest of the docs.