Auditable Reverse-SSH Remote Access
Node shell access is granted by short-lived, Vault-rooted SSH certificates instead of distributed static SSH keys.
- access-agent runs a reverse-SSH (rssh) server on each managed node and validates every connecting certificate against the CA’s public key before allowing a session.
- Certificates are scoped to specific principals and time-boxed; an expired certificate is rejected outright.
- Nodes enroll with access-agent automatically as part of Phase 2/3 provisioning — no separate manual step for normally provisioned nodes.