Skip to content

Glossary

This glossary explains common SSH Teams terms so everyone can read the guides the same way.

Identity and Access

  • Principal: The UNIX account name requested in the SSH certificate, for example ubuntu, deploy, or root.
  • User account: A person's identity in SSH Teams, used for login, policy targeting, and auditing.
  • Device: A registered CLI client that can request signing tokens and certificates.
  • Scope: An OAuth permission boundary for tokens. Common values are join (server enrollment) and signing (certificate issuance).

Tokens and Proofs

  • Device authorization flow: The OAuth flow where the CLI gets a device code, the user approves it in a browser, and the CLI receives a token.
  • Access token: A short-lived token used to call protected APIs.
  • Refresh token: A longer-lived token used to get new access tokens without repeating browser approval.
  • DPoP: Demonstration of Proof-of-Possession. A signed proof that binds token use to the device key.
  • DPoP proof: A per-request signed JWT used when validating DPoP-bound tokens.

Servers and Trust

  • Join flow: The process that registers a server with SSH Teams and returns CA trust material.
  • Server fingerprint: An SSH host-key fingerprint used to identify a server and match it to policies.
  • TrustedUserCAKeys: An SSH server trust file that lists the CA public keys allowed to sign user certificates.
  • Team CA: The certificate authority used by SSH Teams to sign short-lived user certificates.

Policy and Operations

  • Policy priority: The order in which policies are evaluated. Lower numbers are evaluated first.
  • Time restrictions: Allowed issuance windows in DAY,HH:mm,HH:mm format.
  • Source IP constraints: Allowed client source ranges, written as IPv4/IPv6 addresses or CIDR blocks.
  • Break-glass policy: A narrow emergency policy used for controlled access during an incident.

Runtime and Environment

  • Nitrate mode: Embedded persistence mode for quick startup and smaller deployments.
  • Mongo mode: External MongoDB-backed persistence mode for independent database lifecycle management.
  • SSL conf directory: The runtime path that stores TLS and related configuration material, controlled by SSHTEAM_SSL_CONF_DIR.
  • Default server: The preferred SSH Teams CA endpoint used when --server is omitted from CLI commands.

Pro Tip

  • Treat this glossary as the shared vocabulary for your team. If a term's meaning changes, update this page first, then align the rest of the docs.