From d88a473b4720ba6f3b0e5693d16aed4eb1a2d804 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Fri, 8 Aug 2025 18:12:19 +0700 Subject: [PATCH] Add concept docs for secrets mgmt, secret scanning, ssh --- docs/docs.json | 30 ++- .../concepts/secret-scanning.mdx | 20 ++ .../platform/secret-scanning/overview.mdx | 231 +---------------- .../platform/secret-scanning/usage.mdx | 236 ++++++++++++++++++ .../secrets-mgmt/concepts/dynamic-secrets.mdx | 2 +- .../concepts/secrets-delivery.mdx | 38 ++- .../concepts/secrets-rotation.mdx | 2 +- .../ssh/concepts/ssh-certificates.mdx | 26 ++ docs/documentation/platform/ssh/overview.mdx | 204 +-------------- docs/documentation/platform/ssh/usage.mdx | 201 +++++++++++++++ 10 files changed, 546 insertions(+), 444 deletions(-) create mode 100644 docs/documentation/platform/secret-scanning/concepts/secret-scanning.mdx create mode 100644 docs/documentation/platform/secret-scanning/usage.mdx create mode 100644 docs/documentation/platform/ssh/concepts/ssh-certificates.mdx create mode 100644 docs/documentation/platform/ssh/usage.mdx diff --git a/docs/docs.json b/docs/docs.json index 5656b9c41..8e49b9ee5 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -41,8 +41,6 @@ "group": "Platform Reference", "pages": [ "documentation/platform/organization", - "documentation/platform/event-subscriptions", - "documentation/platform/folder", { "group": "Projects", "pages": [ @@ -145,6 +143,7 @@ } ] }, + "documentation/platform/event-subscriptions", { "group": "Workflow Integrations", "pages": [ @@ -650,12 +649,21 @@ "item": "Secrets Scanning", "groups": [ { - "group": "Secret Scanning", - "pages": ["documentation/platform/secret-scanning/overview"] + "group": "Secrets Scanning", + "pages": [ + "documentation/platform/secret-scanning/overview", + { + "group": "Concepts", + "pages": [ + "documentation/platform/secret-scanning/concepts/secret-scanning" + ] + } + ] }, { - "group": "Datasources", + "group": "Product Reference", "pages": [ + "documentation/platform/secret-scanning/usage", "documentation/platform/secret-scanning/bitbucket", "documentation/platform/secret-scanning/github", "documentation/platform/secret-scanning/gitlab" @@ -695,6 +703,18 @@ "group": "Infisical SSH", "pages": [ "documentation/platform/ssh/overview", + { + "group": "Concepts", + "pages": [ + "documentation/platform/ssh/concepts/ssh-certificates" + ] + } + ] + }, + { + "group": "Platform Reference", + "pages": [ + "documentation/platform/ssh/usage", "documentation/platform/ssh/host-groups" ] } diff --git a/docs/documentation/platform/secret-scanning/concepts/secret-scanning.mdx b/docs/documentation/platform/secret-scanning/concepts/secret-scanning.mdx new file mode 100644 index 000000000..66dcdab19 --- /dev/null +++ b/docs/documentation/platform/secret-scanning/concepts/secret-scanning.mdx @@ -0,0 +1,20 @@ +--- +title: "Secrets Scanning" +description: "Learn what is secret scanning and why it matters for building secure systems." +--- + +## What is Secret Scanning? + +_Secret scanning_ is the process of monitoring code and related systems for exposed secrets — such as API keys, database credentials, and authentication tokens — that may have been accidentally committed or leaked. + +As teams grow and development accelerates, it becomes easy for secrets to slip into version control, CI/CD pipelines, or shared files. Left undetected, secrets can fall into the wrong hands and give attackers direct access to production systems, third-party services, or internal APIs. + +A secret scanning solution helps teams proactively identify and respond to these risks before they result in compromise. Rather than relying on manual review, secret scanning automates detection through pattern matching, entropy analysis, and contextual rules that surface secrets across your infrastructure and repositories. + +## Secret Scanning in Infisical + +Infisical Secret Scanning continuously monitors your source code and connected systems for exposed credentials. It integrates with platforms like [GitHub](/documentation/platform/secret-scanning/github), [GitLab](/documentation/platform/secret-scanning/gitlab), and [Bitbucket](/documentation/platform/secret-scanning/bitbucket) to scan codebases in real-time, detecting leaks as they happen and notifying administrators when action is needed. + +Findings are surfaced with detailed context — including file location, commit metadata, and rule match — and can be tracked through their lifecycle using status labels like `Resolved`, `False Positive`, or `Ignored`. Teams can configure rules, exclusions, and thresholds to reduce noise and tailor detection to their environment. + +In addition to real-time monitoring, Infisical supports both full repository scans and lightweight diff scans, as well as local pre-commit scanning via the [Infisical CLI](/cli/commands/scan). This allows teams to prevent secret leaks before they ever reach production. diff --git a/docs/documentation/platform/secret-scanning/overview.mdx b/docs/documentation/platform/secret-scanning/overview.mdx index 69bf5a783..0ed90cc24 100644 --- a/docs/documentation/platform/secret-scanning/overview.mdx +++ b/docs/documentation/platform/secret-scanning/overview.mdx @@ -1,230 +1,17 @@ --- title: "Secret Scanning" sidebarTitle: "Overview" -description: "Scan and prevent secret leaks in your code repositories" +description: "Learn how to detect and respond to exposed secrets in code." --- -## Introduction +Infisical Secret Scanning helps teams detect leaked credentials — such as API keys, database passwords, and tokens — across source code and developer systems. It allows organizations to proactively catch exposed secrets before they can be exploited, and respond quickly when incidents occur. -Monitor and detect exposed secrets across your data sources, including code repositories, with Infisical Secret Scanning. +Secret Scanning works across both cloud-connected repositories and local developer environments. It integrates with data sources like [GitHub](/documentation/platform/secret-scanning/github), [GitLab](/documentation/platform/secret-scanning/gitlab), and [Bitbucket](/documentation/platform/secret-scanning/bitbucket) to monitor repositories for exposed secrets in real time, and provides a CLI ([`infisical scan`](/cli/commands/scan)) for scanning local directories, Git history, or CI pipelines before changes are pushed. -For additional security, we recommend using our [CLI Secret Scanner](/cli/scanning-overview#automatically-scan-changes-before-you-commit) to check for exposed secrets before pushing your code changes. +Core capabilities include: - - Secret Scanning is a paid feature. - If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical, - then you should contact team@infisical.com to purchase an enterprise license to use it. - - -## How Secret Scanning Works - -Secret Scanning consists of several components that enable you to quickly respond to secret leaks: - -- **Scanner Engine**: The core component that analyzes your code and detects potential secrets using pattern matching and entropy analysis -- **Real-time Monitoring**: Provides continuous surveillance of your repositories for immediate detection of exposed secrets -- **Alert System**: Notifies organization admins via email when secrets are detected -- **Risk Management**: Allows tracking and managing detected secrets with different status options -- **Data Sources**: Integrates with various data sources and version control systems -- **Customizable Rules**: Supports ignore patterns and custom configurations to reduce false positives - -These components work together to provide comprehensive secret detection and incident response capabilities. - -### Data Sources - -Data sources are configured integrations with external platforms, such as a GitHub organization or a GitLab group, that establish secure connections for scanning purposes using [App Connections](/integrations/app-connections/overview). - -A data source acts as a secure intermediary between the external system and the scanner engine. It manages a collection of scannable resources (such as repositories) and handles the authentication and communication required for scanning operations. - -![data sources](/images/platform/secret-scanning/secret-scanning-data-sources.png) - -### Resources - -Resources are the atomic, scannable units, such as a repository, that can be monitored for secret exposure. Resources are added automatically when a data source is scanned and updated when scanning events are triggered, such as when a user pushes changes to GitHub. - -Each resource maintains its own scanning history and status, allowing for granular monitoring and management of secret scanning across your organization. - -![resources](/images/platform/secret-scanning/secret-scanning-resources.png) - -### Scans - -Scans can be initiated in two ways: - -1. **Full Scan** - Manually triggered scan that comprehensively checks either all resources associated with a data source or a single selected resource. - -2. **Diff Scan** - Automatically executed when **Auto-Scan** is enabled on a data source. This scan type specifically focuses on updates to existing resources. - -All scan activities can be monitored in real-time through the Infisical UI, which displays: -- Current scan status -- Timestamp of the scan -- Resource(s) being scanned -- Detection results (whether any secrets were found) - -![scans](/images/platform/secret-scanning/secret-scanning-scans.png) - -### Findings - -Findings are automatically generated when secret leaks are detected during scanning operations. Each finding contains comprehensive information including: -- The specific scanning rule that identified the leak -- File location and line number where the secret was found -- Resource-specific details (e.g., commit hash and author for Git repositories) - -Findings are initially marked as **Unresolved** and can be updated to one of the following statuses with additional remarks: -- **Resolved** - The issue has been addressed -- **False Positive** - The detection was incorrect -- **Ignore** - The finding can be safely disregarded - -These status options help teams effectively track and manage the lifecycle of detected secret leaks. - -![findings](/images/platform/secret-scanning/secret-scanning-findings.png) - -### Configuration - -You can configure custom scanning rules and exceptions by updating your project's scanning configuration via the UI or API. - -The configuration options allow you to: -- Define custom scanning patterns and rules -- Set up ignore patterns to reduce false positives -- Specify file path exclusions -- Configure entropy thresholds for secret detection -- Add allowlists for known safe patterns - -For detailed configuration options, expand the example configuration below. - - - ```toml - # Title for the configuration file - title = "Some title" - - - # This configuration is the foundation that can be expanded. If there are any overlapping rules - # between this base and the expanded configuration, the rules in this base will take priority. - # Another aspect of extending configurations is the ability to link multiple files, up to a depth of 2. - # "Allowlist" arrays get appended and may have repeated elements. - # "useDefault" and "path" cannot be used simultaneously. Please choose one. - [extend] - # useDefault will extend the base configuration with the default config: - # https://raw.githubusercontent.com/Infisical/infisical/main/cli/config/infisical-scan.toml - useDefault = true - # or you can supply a path to a configuration. Path is relative to where infisical cli - # was invoked, not the location of the base config. - path = "common_config.toml" - - # An array of tables that contain information that define instructions - # on how to detect secrets - [[rules]] - - # Unique identifier for this rule - id = "some-identifier-for-rule" - - # Short human readable description of the rule. - description = "awesome rule 1" - - # Golang regular expression used to detect secrets. Note Golang's regex engine - # does not support lookaheads. - regex = '''one-go-style-regex-for-this-rule''' - - # Golang regular expression used to match paths. This can be used as a standalone rule or it can be used - # in conjunction with a valid `regex` entry. - path = '''a-file-path-regex''' - - # Array of strings used for metadata and reporting purposes. - tags = ["tag","another tag"] - - # A regex match may have many groups, this allows you to specify the group that should be used as (which group the secret is contained in) - # its entropy checked if `entropy` is set. - secretGroup = 3 - - # Float representing the minimum shannon entropy a regex group must have to be considered a secret. - # Shannon entropy measures how random a data is. Since secrets are usually composed of many random characters, they typically have high entropy - entropy = 3.5 - - # Keywords are used for pre-regex check filtering. - # If rule has keywords but the text fragment being scanned doesn't have at least one of it's keywords, it will be skipped for processing further. - # Ideally these values should either be part of the identifier or unique strings specific to the rule's regex - # (introduced in v8.6.0) - keywords = [ - "auth", - "password", - "token", - ] - - # You can include an allowlist table for a single rule to reduce false positives or ignore commits - # with known/rotated secrets - [rules.allowlist] - description = "ignore commit A" - commits = [ "commit-A", "commit-B"] - paths = [ - '''go\.mod''', - '''go\.sum''' - ] - # note: (rule) regexTarget defaults to check the _Secret_ in the finding. - # if regexTarget is not specified then _Secret_ will be used. - # Acceptable values for regexTarget are "match" and "line" - regexTarget = "match" - regexes = [ - '''process''', - '''getenv''', - ] - # note: stopwords targets the extracted secret, not the entire regex match - # if the extracted secret is found in the stopwords list, the finding will be skipped (i.e not included in report) - stopwords = [ - '''client''', - '''endpoint''', - ] - - - # This is a global allowlist which has a higher order of precedence than rule-specific allowlists. - # If a commit listed in the `commits` field below is encountered then that commit will be skipped and no - # secrets will be detected for said commit. The same logic applies for regexes and paths. - [allowlist] - description = "global allow list" - commits = [ "commit-A", "commit-B", "commit-C"] - paths = [ - '''gitleaks\.toml''', - '''(.*?)(jpg|gif|doc)''' - ] - - # note: (global) regexTarget defaults to check the _Secret_ in the finding. - # if regexTarget is not specified then _Secret_ will be used. - # Acceptable values for regexTarget are "match" and "line" - regexTarget = "match" - - regexes = [ - '''219-09-9999''', - '''078-05-1120''', - '''(9[0-9]{2}|666)-\d{2}-\d{4}''', - ] - # note: stopwords targets the extracted secret, not the entire regex match - # if the extracted secret is found in the stopwords list, the finding will be skipped (i.e not included in report) - stopwords = [ - '''client''', - '''endpoint''', - ] - ``` - - -![config](/images/platform/secret-scanning/secret-scanning-config.png) - -## Ignoring Known Secrets -If you're intentionally committing a test secret that the secret scanner might flag, you can instruct Infisical to overlook that secret with the methods listed below. - -### infisical-scan:ignore - -To ignore a secret contained in line of code, simply add `infisical-scan:ignore ` at the end of the line as comment in the given programming. - -```js example.js -function helloWorld() { - console.log("8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ"); // infisical-scan:ignore -} -``` - -### .infisicalignore -An alternative method to exclude specific findings involves creating a .infisicalignore file at your repository's root. -You can then add the fingerprints of the findings you wish to exclude. The [Infisical scan](/cli/scanning-overview) report provides a unique Fingerprint for each secret found. -By incorporating these Fingerprints into the .infisicalignore file, Infisical will skip the corresponding secret findings in subsequent scans. - -```.ignore .infisicalignore -bea0ff6e05a4de73a5db625d4ae181a015b50855:frontend/components/utilities/attemptLogin.js:stripe-access-token:147 -bea0ff6e05a4de73a5db625d4ae181a015b50855:backend/src/json/integrations.json:generic-api-key:5 -1961b92340e5d2613acae528b886c842427ce5d0:frontend/components/utilities/attemptLogin.js:stripe-access-token:148 -``` +- Integrated Scanning Across Environments: Monitor secrets in real time across connected repositories like GitHub, GitLab, and Bitbucket, or scan locally using the infisical scan CLI. +- Detection Engine: Identify potential secrets using pattern matching, entropy analysis, and custom rules tailored to your codebase and workflows. +- Flexible Scan Modes: Run full scans manually or configure automatic diff scans triggered by new commits. CLI scans support Git history, file directories, or staged changes in CI pipelines. +- Findings and Lifecycle Management: Track detected secrets with context like file path, commit hash, and scanning rule. Findings can be resolved, ignored, or marked as false positives — with full visibility into scan results over time. +- Custom Configuration and Noise Reduction: Fine-tune scanning behavior with custom patterns, ignore rules (infisical-scan:ignore, .infisicalignore), entropy thresholds, and excluded paths to reduce false positives. diff --git a/docs/documentation/platform/secret-scanning/usage.mdx b/docs/documentation/platform/secret-scanning/usage.mdx new file mode 100644 index 000000000..1bbcc65ed --- /dev/null +++ b/docs/documentation/platform/secret-scanning/usage.mdx @@ -0,0 +1,236 @@ +--- +title: "Usage" +description: "Learn what is secret scanning and why it matters for building secure systems." +--- + +## Introduction + +Monitor and detect exposed secrets across your data sources, including code repositories, with Infisical Secret Scanning. + +For additional security, we recommend using our [CLI Secret Scanner](/cli/scanning-overview#automatically-scan-changes-before-you-commit) to check for exposed secrets before pushing your code changes. + + + Secret Scanning is a paid feature. If you're using Infisical Cloud, then it is + available under the **Enterprise Tier**. If you're self-hosting Infisical, + then you should contact team@infisical.com to purchase an enterprise license + to use it. + + +## How Secret Scanning Works + +Secret Scanning consists of several components that enable you to quickly respond to secret leaks: + +- **Scanner Engine**: The core component that analyzes your code and detects potential secrets using pattern matching and entropy analysis +- **Real-time Monitoring**: Provides continuous surveillance of your repositories for immediate detection of exposed secrets +- **Alert System**: Notifies organization admins via email when secrets are detected +- **Risk Management**: Allows tracking and managing detected secrets with different status options +- **Data Sources**: Integrates with various data sources and version control systems +- **Customizable Rules**: Supports ignore patterns and custom configurations to reduce false positives + +These components work together to provide comprehensive secret detection and incident response capabilities. + +### Data Sources + +Data sources are configured integrations with external platforms, such as a GitHub organization or a GitLab group, that establish secure connections for scanning purposes using [App Connections](/integrations/app-connections/overview). + +A data source acts as a secure intermediary between the external system and the scanner engine. It manages a collection of scannable resources (such as repositories) and handles the authentication and communication required for scanning operations. + +![data sources](/images/platform/secret-scanning/secret-scanning-data-sources.png) + +### Resources + +Resources are the atomic, scannable units, such as a repository, that can be monitored for secret exposure. Resources are added automatically when a data source is scanned and updated when scanning events are triggered, such as when a user pushes changes to GitHub. + +Each resource maintains its own scanning history and status, allowing for granular monitoring and management of secret scanning across your organization. + +![resources](/images/platform/secret-scanning/secret-scanning-resources.png) + +### Scans + +Scans can be initiated in two ways: + +1. **Full Scan** - Manually triggered scan that comprehensively checks either all resources associated with a data source or a single selected resource. + +2. **Diff Scan** - Automatically executed when **Auto-Scan** is enabled on a data source. This scan type specifically focuses on updates to existing resources. + +All scan activities can be monitored in real-time through the Infisical UI, which displays: + +- Current scan status +- Timestamp of the scan +- Resource(s) being scanned +- Detection results (whether any secrets were found) + +![scans](/images/platform/secret-scanning/secret-scanning-scans.png) + +### Findings + +Findings are automatically generated when secret leaks are detected during scanning operations. Each finding contains comprehensive information including: + +- The specific scanning rule that identified the leak +- File location and line number where the secret was found +- Resource-specific details (e.g., commit hash and author for Git repositories) + +Findings are initially marked as **Unresolved** and can be updated to one of the following statuses with additional remarks: + +- **Resolved** - The issue has been addressed +- **False Positive** - The detection was incorrect +- **Ignore** - The finding can be safely disregarded + +These status options help teams effectively track and manage the lifecycle of detected secret leaks. + +![findings](/images/platform/secret-scanning/secret-scanning-findings.png) + +### Configuration + +You can configure custom scanning rules and exceptions by updating your project's scanning configuration via the UI or API. + +The configuration options allow you to: + +- Define custom scanning patterns and rules +- Set up ignore patterns to reduce false positives +- Specify file path exclusions +- Configure entropy thresholds for secret detection +- Add allowlists for known safe patterns + +For detailed configuration options, expand the example configuration below. + + + ```toml + # Title for the configuration file + title = "Some title" + + # This configuration is the foundation that can be expanded. If there are any overlapping rules + # between this base and the expanded configuration, the rules in this base will take priority. + # Another aspect of extending configurations is the ability to link multiple files, up to a depth of 2. + # "Allowlist" arrays get appended and may have repeated elements. + # "useDefault" and "path" cannot be used simultaneously. Please choose one. + [extend] + # useDefault will extend the base configuration with the default config: + # https://raw.githubusercontent.com/Infisical/infisical/main/cli/config/infisical-scan.toml + useDefault = true + # or you can supply a path to a configuration. Path is relative to where infisical cli + # was invoked, not the location of the base config. + path = "common_config.toml" + + # An array of tables that contain information that define instructions + # on how to detect secrets + [[rules]] + + # Unique identifier for this rule + id = "some-identifier-for-rule" + + # Short human readable description of the rule. + description = "awesome rule 1" + + # Golang regular expression used to detect secrets. Note Golang's regex engine + # does not support lookaheads. + regex = '''one-go-style-regex-for-this-rule''' + + # Golang regular expression used to match paths. This can be used as a standalone rule or it can be used + # in conjunction with a valid `regex` entry. + path = '''a-file-path-regex''' + + # Array of strings used for metadata and reporting purposes. + tags = ["tag","another tag"] + + # A regex match may have many groups, this allows you to specify the group that should be used as (which group the secret is contained in) + # its entropy checked if `entropy` is set. + secretGroup = 3 + + # Float representing the minimum shannon entropy a regex group must have to be considered a secret. + # Shannon entropy measures how random a data is. Since secrets are usually composed of many random characters, they typically have high entropy + entropy = 3.5 + + # Keywords are used for pre-regex check filtering. + # If rule has keywords but the text fragment being scanned doesn't have at least one of it's keywords, it will be skipped for processing further. + # Ideally these values should either be part of the identifier or unique strings specific to the rule's regex + # (introduced in v8.6.0) + keywords = [ + "auth", + "password", + "token", + ] + + # You can include an allowlist table for a single rule to reduce false positives or ignore commits + # with known/rotated secrets + [rules.allowlist] + description = "ignore commit A" + commits = [ "commit-A", "commit-B"] + paths = [ + '''go\.mod''', + '''go\.sum''' + ] + # note: (rule) regexTarget defaults to check the _Secret_ in the finding. + # if regexTarget is not specified then _Secret_ will be used. + # Acceptable values for regexTarget are "match" and "line" + regexTarget = "match" + regexes = [ + '''process''', + '''getenv''', + ] + # note: stopwords targets the extracted secret, not the entire regex match + # if the extracted secret is found in the stopwords list, the finding will be skipped (i.e not included in report) + stopwords = [ + '''client''', + '''endpoint''', + ] + + + # This is a global allowlist which has a higher order of precedence than rule-specific allowlists. + # If a commit listed in the `commits` field below is encountered then that commit will be skipped and no + # secrets will be detected for said commit. The same logic applies for regexes and paths. + [allowlist] + description = "global allow list" + commits = [ "commit-A", "commit-B", "commit-C"] + paths = [ + '''gitleaks\.toml''', + '''(.*?)(jpg|gif|doc)''' + ] + + # note: (global) regexTarget defaults to check the _Secret_ in the finding. + # if regexTarget is not specified then _Secret_ will be used. + # Acceptable values for regexTarget are "match" and "line" + regexTarget = "match" + + regexes = [ + '''219-09-9999''', + '''078-05-1120''', + '''(9[0-9]{2}|666)-\d{2}-\d{4}''', + ] + # note: stopwords targets the extracted secret, not the entire regex match + # if the extracted secret is found in the stopwords list, the finding will be skipped (i.e not included in report) + stopwords = [ + '''client''', + '''endpoint''', + ] + ``` + + + +![config](/images/platform/secret-scanning/secret-scanning-config.png) + +## Ignoring Known Secrets + +If you're intentionally committing a test secret that the secret scanner might flag, you can instruct Infisical to overlook that secret with the methods listed below. + +### infisical-scan:ignore + +To ignore a secret contained in line of code, simply add `infisical-scan:ignore ` at the end of the line as comment in the given programming. + +```js example.js +function helloWorld() { + console.log("8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ"); // infisical-scan:ignore +} +``` + +### .infisicalignore + +An alternative method to exclude specific findings involves creating a .infisicalignore file at your repository's root. +You can then add the fingerprints of the findings you wish to exclude. The [Infisical scan](/cli/scanning-overview) report provides a unique Fingerprint for each secret found. +By incorporating these Fingerprints into the .infisicalignore file, Infisical will skip the corresponding secret findings in subsequent scans. + +```.ignore .infisicalignore +bea0ff6e05a4de73a5db625d4ae181a015b50855:frontend/components/utilities/attemptLogin.js:stripe-access-token:147 +bea0ff6e05a4de73a5db625d4ae181a015b50855:backend/src/json/integrations.json:generic-api-key:5 +1961b92340e5d2613acae528b886c842427ce5d0:frontend/components/utilities/attemptLogin.js:stripe-access-token:148 +``` diff --git a/docs/documentation/platform/secrets-mgmt/concepts/dynamic-secrets.mdx b/docs/documentation/platform/secrets-mgmt/concepts/dynamic-secrets.mdx index 634ab1a34..c2363db5b 100644 --- a/docs/documentation/platform/secrets-mgmt/concepts/dynamic-secrets.mdx +++ b/docs/documentation/platform/secrets-mgmt/concepts/dynamic-secrets.mdx @@ -1,6 +1,6 @@ --- title: "Dynamic Secrets" -description: "Understand what dynamic secrets are, why they're useful, and how Infisical enables them." +description: "Learn what dynamic secrets are, why they're useful, and how Infisical enables them." --- ## What is a Dynamic Secret? diff --git a/docs/documentation/platform/secrets-mgmt/concepts/secrets-delivery.mdx b/docs/documentation/platform/secrets-mgmt/concepts/secrets-delivery.mdx index cd559552d..f7ac0d545 100644 --- a/docs/documentation/platform/secrets-mgmt/concepts/secrets-delivery.mdx +++ b/docs/documentation/platform/secrets-mgmt/concepts/secrets-delivery.mdx @@ -5,27 +5,25 @@ description: "Learn how to get secrets out of Infisical and into the systems, ap Once secrets are stored and scoped in Infisical, the next step is delivering them securely to the systems and applications that need them. -Infisical supports multiple delivery methods to match a wide range of environments — from [local development](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#local-development%2C-scripts%2C-and-one-off-tasks) to [Kubernetes workloads](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#kubernetes-workloads), [CI/CD pipelines](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#ci%2Fcd-pipelines), [infrastructure-as-code tools](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#infrastructure-as-code-and-automation-tools), and more. +Infisical supports many delivery methods to match a wide range of environments — from [local development](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#local-development%2C-scripts%2C-and-one-off-tasks) to [Kubernetes workloads](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#kubernetes-workloads), [CI/CD pipelines](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#ci%2Fcd-pipelines), [infrastructure-as-code tools](/documentation/platform/secrets-mgmt/concepts/secrets-delivery#infrastructure-as-code-and-automation-tools), and more. -The right delivery method depends on how your infrastructure runs and how secrets are expected to be consumed. +The table below provides a quick overview of which delivery method may be suitable to use based on your environment and how secrets are consumed: -The table below provides a quick overview of which delivery method to use based on your environment and how secrets are consumed: - -| Use Case / Environment | Recommended Method(s) | Consumes Secrets As | Notes | -| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------ | -| Local development or scripting | [`infisical run`](/cli/commands/run), [CLI](/cli/overview) | Environment variables | Easiest way to inject secrets during local dev or debugging | -| Application code fetching at runtime | [SDKs](/sdks/overview), [HTTP API](/api-reference/overview/introduction) | In-memory / API call | Full control in app code; supports dynamic or ephemeral fetching | -| VMs, containers, or CI jobs needing preloaded secrets | [Infisical Agent](/integrations/platforms/infisical-agent) | Env vars or files | Good for non-interactive workloads; avoids inline secret fetch | -| GitHub Actions | [Secrets Action](https://github.com/Infisical/secrets-action), [Secret Syncs](/integrations/secret-syncs/github) | Env vars or files | Use Action for dynamic fetch; use Syncs to preload into GitHub | -| GitLab CI, Jenkins, other CI | [CLI](/cli/overview), [Agent](/integrations/platforms/infisical-agent), [Secret Syncs](/integrations/secret-syncs/gitlab) | Env vars or files | Choose based on timing — fetch at runtime vs. pre-populate ahead | -| Kubernetes (declarative secrets) | [Kubernetes Operator](/integrations/platforms/kubernetes/overview) | Kubernetes Secrets | Syncs from Infisical into native Kubernetes Secrets | -| Kubernetes (ESO-based workflows) | [ESO](/integrations/platforms/external-secrets) | Kubernetes Secrets | Reuses existing ESO setup; Infisical acts as a provider | -| Kubernetes (file-based, no K8s secrets) | [Agent Injector](/integrations/platforms/kubernetes-injector) | Mounted files | Injects secrets via init container into volume at pod startup | -| Kubernetes (file-based, with rotation) | [CSI Provider](/integrations/platforms/kubernetes-csi) | Mounted files | Uses CSI driver to mount secrets as files with automatic rotation | -| Image builds (VMs or containers) | [Packer Plugin](/integrations/frameworks/packer) | Env vars or files | Inject secrets at image build time | -| Ansible automation | [Ansible Collection](/integrations/platforms/ansible) | Variables | Runtime secret fetching in playbooks using lookup plugin | -| Terraform / Pulumi | [Terraform Provider](/integrations/frameworks/terraform), [Pulumi](/integrations/frameworks/pulumi) | Inputs / ephemeral resources | Use ephemeral for security; avoids storing secrets in state | -| Third-party platforms (GitHub, AWS, etc.) | [Secret Syncs](/integrations/secret-syncs/overview) | Preloaded secrets | Push secrets to platforms that can't fetch directly from Infisical | +| Use Case / Environment | Recommended Method(s) | Consumes Secrets As | Notes | +| ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------ | +| Local development or scripting | [Infisical CLI](/cli/overview) | Environment variables | Easiest way to inject secrets during local dev or debugging | +| Application code fetching at runtime | [SDKs](/sdks/overview), [HTTP API](/api-reference/overview/introduction) | In-memory / API call | Full control in app code; supports dynamic or ephemeral fetching | +| VMs, containers, or CI jobs needing preloaded secrets | [Infisical Agent](/integrations/platforms/infisical-agent) | Env vars or files | Good for non-interactive workloads; avoids inline secret fetch | +| GitHub Actions | [Secrets Action](https://github.com/Infisical/secrets-action), [Secret Syncs](/integrations/secret-syncs/github) | Env vars or files | Use Action for dynamic fetch; use Syncs to preload into GitHub | +| GitLab CI, Jenkins, other CI | [Infisical CLI](/cli/overview), [Infisical Agent](/integrations/platforms/infisical-agent), [Secret Syncs](/integrations/secret-syncs/gitlab) | Env vars or files | Choose based on timing — fetch at runtime vs. pre-populate ahead | +| Kubernetes (declarative secrets) | [Kubernetes Operator](/integrations/platforms/kubernetes/overview) | Kubernetes Secrets | Syncs from Infisical into native Kubernetes Secrets | +| Kubernetes (ESO-based workflows) | [External Secrets Operator (ESO)](https://external-secrets.io/latest/provider/infisical/) | Kubernetes Secrets | Reuses existing ESO setup; Infisical acts as a provider | +| Kubernetes (file-based, no K8s secrets) | [Kubernetes Agent Injector](/integrations/platforms/kubernetes-injector) | Mounted files | Injects secrets via init container into volume at pod startup | +| Kubernetes (file-based, with rotation) | [Kubernetes CSI Provider](/integrations/platforms/kubernetes-csi) | Mounted files | Uses CSI driver to mount secrets as files with automatic rotation | +| Image builds (VMs or containers) | [Packer Plugin](/integrations/frameworks/packer) | Env vars or files | Inject secrets at image build time | +| Ansible automation | [Ansible Collection](/integrations/platforms/ansible) | Variables | Runtime secret fetching in playbooks using lookup plugin | +| Terraform / Pulumi | [Terraform Provider](/integrations/frameworks/terraform), [Pulumi](/integrations/frameworks/pulumi) | Inputs / ephemeral resources | Use ephemeral for security; avoids storing secrets in state | +| Third-party platforms (GitHub, AWS, etc.) | [Secret Syncs](/integrations/secret-syncs/overview) | Preloaded secrets | Push secrets to platforms that can't fetch directly from Infisical | From here, you can explore the delivery method that best matches your environment: @@ -64,7 +62,7 @@ For CI/CD pipelines, the right method depends on the platform. - On GitHub Actions, the [Infisical Secrets Action](https://github.com/Infisical/secrets-action) provides a native integration that injects secrets as environment variables or `.env` files during workflows. It supports authentication via [AWS IAM](/documentation/platform/identities/aws-auth), [OIDC](/documentation/platform/identities/oidc-auth/github), or [Universal Auth](/documentation/platform/identities/universal-auth) using a Machine Identity. - On other CI platforms like GitLab CI, CircleCI, or Jenkins, the CLI or Agent may be used depending on how secrets are consumed — whether at runtime or during setup. -Some CI/CD systems also support [Secret Syncs](/integrations/secret-syncs/overview) as an alternative. Instead of fetching secrets dynamically, you can configure Infisical to forward secrets into GitHub Actions, GitLab CI, and similar platforms ahead of time — allowing them to be used as native environment secrets during jobs. +Some CI/CD systems also support [Secret Syncs](/integrations/secret-syncs/overview) as an alternative. Instead of fetching secrets dynamically, you can configure Infisical to forward secrets into [GitHub Actions](/integrations/secret-syncs/github), [GitLab CI](/integrations/secret-syncs/gitlab), and similar platforms ahead of time — allowing them to be used as native environment secrets during jobs. ## Kubernetes Workloads diff --git a/docs/documentation/platform/secrets-mgmt/concepts/secrets-rotation.mdx b/docs/documentation/platform/secrets-mgmt/concepts/secrets-rotation.mdx index e608605c1..bb03a7515 100644 --- a/docs/documentation/platform/secrets-mgmt/concepts/secrets-rotation.mdx +++ b/docs/documentation/platform/secrets-mgmt/concepts/secrets-rotation.mdx @@ -1,6 +1,6 @@ --- title: "Secrets Rotation" -description: "Understand what secrets rotation is, why it matters, and how Infisical enables it." +description: "Learn what secrets rotation is, why it matters, and how Infisical enables it." --- ## What is Secrets Rotation? diff --git a/docs/documentation/platform/ssh/concepts/ssh-certificates.mdx b/docs/documentation/platform/ssh/concepts/ssh-certificates.mdx new file mode 100644 index 000000000..74bfca228 --- /dev/null +++ b/docs/documentation/platform/ssh/concepts/ssh-certificates.mdx @@ -0,0 +1,26 @@ +--- +title: "SSH Certificates" +description: "Learn what SSH certificates are, why they're useful, and how they enable secure, scalable infrastructure access." +--- + +SSH access is ubiquitous — It's how engineers, scripts, and platforms across the world remotely administer Linux systems. That said, as teams and systems grow, managing access with static SSH keys becomes brittle and issues like key sprawl, unclear boundaries, and poor revocation hygiene start to emerge. + +_SSH certificates_ offer an alternative approach to securing and managing access at scale. + +## What is an SSH Certificate? + +An _SSH certificate_ is a short-lived, signed credential that proves a user or host’s identity. Unlike static SSH keys, which are distributed and managed manually, SSH certificates rely on a centralized certificate authority (CA) to vouch for identities. +There are two types of SSH certificates: + +- User certificates: Issued to users to authenticate with remote hosts +- Host certificates: Issued to hosts so clients can verify they're trusted + +Because certificates are time-bound and centrally managed, they’re easier to audit, revoke, and scale across infrastructure. + +## SSH with Infisical + +Infisical SSH gives you a secure, scalable way to manage infrastructure access using SSH certificates — without the overhead of running your own certificate authority, wiring trust across hosts, or building issuance workflows from scratch. + +It replaces long-lived SSH keys with short-lived, identity-bound certificates and handles all the moving parts for you: operating CAs, configuring trust between users and hosts, and issuing certificates on demand. With Infisical SSH, you can register a host with [`infisical ssh add-host`](/docs/cli/commands/ssh#infisical-ssh-add-host), then connect with [`infisical ssh connect`](/docs/cli/commands/ssh#infisical-ssh-connect) — that’s all it takes. + +The result is centralized, auditable SSH access that’s easy to use and built to scale with your infrastructure. diff --git a/docs/documentation/platform/ssh/overview.mdx b/docs/documentation/platform/ssh/overview.mdx index d9606214d..9de14478e 100644 --- a/docs/documentation/platform/ssh/overview.mdx +++ b/docs/documentation/platform/ssh/overview.mdx @@ -1,201 +1,15 @@ --- -title: "Overview" +title: "Infisical SSH" sidebarTitle: "Overview" -description: "Learn how to securely provision user SSH access to your infrastructure using SSH certificates." +description: "Learn how to manage secure, short-lived SSH access to infrastructure using certificates." --- -## Concept +Infisical SSH provides a secure, certificate-based solution for managing SSH access to infrastructure. +It replaces long-lived SSH keys with short-lived, identity-bound certificates to reduce key sprawl, simplify access control, and improve auditability. -Infisical SSH can be configured to provide users on your team short-lived, secure SSH access to infrastructure. Under the hood, it uses SSH certificates -and improves upon traditional SSH key-based authentication by mitigating private key compromise, static key management, -unauthorized access, and SSH key sprawl. +Core capabilities include: -The following entities are important to understand when configuring and using Infisical SSH: - -- Administrator: An individual on your team who is responsible for configuring Infisical SSH. -- Users: Other individuals that gain access to remote hosts through Infisical SSH. -- Host: A remote machine (e.g. EC2 instance, GCP VM, Azure VM, on-prem Linux server, Raspberry Pi, VMware VM, etc.) that users need SSH access to that is registered with Infisical SSH. - -## Workflow - -The typical workflow for using Infisical SSH consists of the following steps: - -1. The administrator registers a remote host with Infisical using the Infisical CLI via the `infisical ssh add-host` command. -2. The administrator configures Infisical SSH to grant users access to the remote host. -3. User(s) access the remote host using the Infisical CLI via the `infisical ssh connect` command. - -## Admin Guide for Configuring Infisical SSH - -In the following steps, we explore how to configure Infisical SSH to control and streamline your team's SSH access to infrastructure. As part of this guide, -we will register a remote host with Infisical through a [machine identity](/documentation/platform/identities/machine-identities) and configure Infisical to grant user(s) access to the remote host. - - - - Start by creating a new Infisical SSH project in Infisical. - - ![ssh project create](/images/platform/ssh/v2/ssh-create-project.png) - - - 2.1. Follow the instructions [here](/documentation/platform/identities/universal-auth) to configure a [machine identity](/documentation/platform/identities/machine-identities) in Infisical with Universal Auth. - - By the end of this step, you should have a **Client ID** and **Client Secret** on hand as part of the Universal Auth configuration for the identity to authenticate with Infisical - as part of registering a remote host in step 3. - - - You may use other authentication methods as suitable (e.g. [AWS Auth](/documentation/platform/identities/aws-auth), [Azure Auth](/documentation/platform/identities/azure-auth), [GCP Auth](/documentation/platform/identities/gcp-auth), etc.) as part of the machine identity configuration but, to keep this example simple, we will be using Universal Auth. - - - 2.2. Add the machine identity to the Infisical SSH project you created in the previous step and assign it the **SSH Host Bootstrapper** role. - - This role grants the ability to **Create** and **Issue Host Certificates** on the **SSH Host** resource; this will enable the linked machine identity to bootstrap a remote host with Infisical - and establish the necessary configuration on it. - - - If you plan to use a custom role to bootstrap SSH hosts, ensure the role has the **Create** and **Issue Host Certificates** on the **SSH Host** resource. - - - ![ssh add identity to project](/images/platform/ssh/v2/ssh-add-identity-to-project.png) - - - - 3.1. Follow the instructions [here](/cli/overview) to install the Infisical CLI onto the remote host. - - 3.2. Run the commands below to register the remote host with Infisical. - - Use the **Client ID** and **Client Secret** from the machine identity you created in step 2.1 as part of the `infisical login` command - to obtain an access token and save it as an environment variable. - - ```bash - export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain) - ``` - - Next, use the `infisical ssh add-host` command to register the remote host with Infisical. As part of this command, input the ID of the Infisical SSH project you created in step 1 for the `--projectId` flag and the hostname of the remote host for the `--hostname` flag. - - ```bash - sudo infisical ssh add-host --projectId= --hostname= --token="$INFISICAL_TOKEN" --write-user-ca-to-file --write-host-cert-to-file --configure-sshd - ``` - - - Note that if you're self-hosting Infisical, you can use the `--domain` flag on the `infisical login` command to specify the domain of your Infisical instance. - - For more information on the `infisical ssh add-host` command, please refer to the Infisical CLI [documentation](/cli/overview). - - - If successful, you should see output similar to the following: - - ```bash - ✅ Successfully registered host: - 📁 Wrote User CA public key to: /etc/ssh/infisical_user_ca.pub - 📁 Wrote host certificate to: /etc/ssh/ssh_host_ed25519_key-cert.pub - 📄 Updated sshd_config entries - ``` - - Finally, use the following command to reload the SSH daemon on the remote host to apply the changes: - - ```bash - sudo systemctl reload sshd - ``` - - - The command may differ depending on the host. For older versions of Ubuntu/Debian/CentOS, you may need to use `sudo service ssh reload` instead; - for Alpine or minimal systems, `/etc/init.d/sshd reload`. - - - Back in Infisical, you should now see the remote host you just registered in the Infisical SSH project you created in step 1 under the **Hosts** tab. - - ![ssh hosts](/images/platform/ssh/v2/ssh-added-hosts.png) - - - - 4.1. Add the user(s) you wish to grant access to the remote host to the Infisical SSH project under Access Control > Users. - - ![ssh hosts](/images/platform/ssh/v2/ssh-add-user.png) - - 4.2. On the registered host in the **Hosts** tab, click **Edit SSH Host** and add a login mapping for the user(s) you added in step 4.1. - - The login mapping dictates what user(s) will be allowed access to the remote host and under a specific login user; in the allowed principals, - you should select user(s) part of the Infisical SSH project that will be allowed to login to the remote host as the login user. - - For instance, if you add a mapping with the login user `ec2-user` to some users John and Alice in Infisical, then they will be allowed to login to the remote host as `ec2-user` which is a system user that - exists on the remote host. - - ![ssh host mappings](/images/platform/ssh/v2/ssh-host-login-mappings.png) - - - Note that you should configure authorized principals files for each login user you add to the remote host. - - - - - -## User Guide for SSHing to a Host - -Once Infisical SSH is configured by an administrator, users can SSH to the remote host using the Infisical CLI. - - - - Follow the instructions [here](/cli/overview) to install the Infisical CLI onto your local machine. - - - The `infisical ssh connect` command can be used in either interactive or non-interactive mode to connect to a remote host. - - - - In interactive mode, you'll first need to authenticate with Infisical by running: - - ```bash - infisical login - ``` - - Then simply run: - - ```bash - infisical ssh connect - ``` - - You'll be prompted to select an SSH Host from a list of accessible hosts; this is based on project membership and login mappings configured on hosts by - the administrator. - - ```bash - Use the arrow keys to navigate: ↓ ↑ → ← - ? Select an SSH Host: - ▸ ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com - ``` - - After selecting a host, you'll be prompted to select a login user from a list of allowed login users: - - ```bash - ? Select Login User: - ▸ ec2-user - ``` - - If successful, you should be able to SSH to the remote host. - - ```bash - ✔ ec2-54-199-104-116.ap-northeast-1.compute.amazonaws.com - ✔ ec2-user - ✔ SSH credentials successfully added to agent - Connecting to ec2-user@ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com... - ``` - - - For CI/CD pipelines or automation scenarios, you can use the non-interactive mode with an Infisical token: - - ```bash - infisical ssh connect \ - --hostname ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com \ - --login-user ec2-user \ - --out-file-path ~/.ssh/id_rsa-cert.pub \ - --token - ``` - - This will: - - Connect to the specified hostname - - Use the specified login user - - Write the SSH credentials to the specified path instead of adding them to the SSH agent - - Authenticate using the provided Infisical token - - - - - +- Certificate Authority (CA): Managed CA infrastructure for issuing short-lived SSH certificates. +- Centralized Access Management: View all registered hosts, see who has access to each, and control permissions from a single interface. +- Easy Host Registration & Connection: Quickly register hosts and connect using short-lived certificates without manual key distribution. +- Audit Logging: Detailed records of certificate issuance and SSH access activity. diff --git a/docs/documentation/platform/ssh/usage.mdx b/docs/documentation/platform/ssh/usage.mdx new file mode 100644 index 000000000..d9606214d --- /dev/null +++ b/docs/documentation/platform/ssh/usage.mdx @@ -0,0 +1,201 @@ +--- +title: "Overview" +sidebarTitle: "Overview" +description: "Learn how to securely provision user SSH access to your infrastructure using SSH certificates." +--- + +## Concept + +Infisical SSH can be configured to provide users on your team short-lived, secure SSH access to infrastructure. Under the hood, it uses SSH certificates +and improves upon traditional SSH key-based authentication by mitigating private key compromise, static key management, +unauthorized access, and SSH key sprawl. + +The following entities are important to understand when configuring and using Infisical SSH: + +- Administrator: An individual on your team who is responsible for configuring Infisical SSH. +- Users: Other individuals that gain access to remote hosts through Infisical SSH. +- Host: A remote machine (e.g. EC2 instance, GCP VM, Azure VM, on-prem Linux server, Raspberry Pi, VMware VM, etc.) that users need SSH access to that is registered with Infisical SSH. + +## Workflow + +The typical workflow for using Infisical SSH consists of the following steps: + +1. The administrator registers a remote host with Infisical using the Infisical CLI via the `infisical ssh add-host` command. +2. The administrator configures Infisical SSH to grant users access to the remote host. +3. User(s) access the remote host using the Infisical CLI via the `infisical ssh connect` command. + +## Admin Guide for Configuring Infisical SSH + +In the following steps, we explore how to configure Infisical SSH to control and streamline your team's SSH access to infrastructure. As part of this guide, +we will register a remote host with Infisical through a [machine identity](/documentation/platform/identities/machine-identities) and configure Infisical to grant user(s) access to the remote host. + + + + Start by creating a new Infisical SSH project in Infisical. + + ![ssh project create](/images/platform/ssh/v2/ssh-create-project.png) + + + 2.1. Follow the instructions [here](/documentation/platform/identities/universal-auth) to configure a [machine identity](/documentation/platform/identities/machine-identities) in Infisical with Universal Auth. + + By the end of this step, you should have a **Client ID** and **Client Secret** on hand as part of the Universal Auth configuration for the identity to authenticate with Infisical + as part of registering a remote host in step 3. + + + You may use other authentication methods as suitable (e.g. [AWS Auth](/documentation/platform/identities/aws-auth), [Azure Auth](/documentation/platform/identities/azure-auth), [GCP Auth](/documentation/platform/identities/gcp-auth), etc.) as part of the machine identity configuration but, to keep this example simple, we will be using Universal Auth. + + + 2.2. Add the machine identity to the Infisical SSH project you created in the previous step and assign it the **SSH Host Bootstrapper** role. + + This role grants the ability to **Create** and **Issue Host Certificates** on the **SSH Host** resource; this will enable the linked machine identity to bootstrap a remote host with Infisical + and establish the necessary configuration on it. + + + If you plan to use a custom role to bootstrap SSH hosts, ensure the role has the **Create** and **Issue Host Certificates** on the **SSH Host** resource. + + + ![ssh add identity to project](/images/platform/ssh/v2/ssh-add-identity-to-project.png) + + + + 3.1. Follow the instructions [here](/cli/overview) to install the Infisical CLI onto the remote host. + + 3.2. Run the commands below to register the remote host with Infisical. + + Use the **Client ID** and **Client Secret** from the machine identity you created in step 2.1 as part of the `infisical login` command + to obtain an access token and save it as an environment variable. + + ```bash + export INFISICAL_TOKEN=$(infisical login --method=universal-auth --client-id= --client-secret= --silent --plain) + ``` + + Next, use the `infisical ssh add-host` command to register the remote host with Infisical. As part of this command, input the ID of the Infisical SSH project you created in step 1 for the `--projectId` flag and the hostname of the remote host for the `--hostname` flag. + + ```bash + sudo infisical ssh add-host --projectId= --hostname= --token="$INFISICAL_TOKEN" --write-user-ca-to-file --write-host-cert-to-file --configure-sshd + ``` + + + Note that if you're self-hosting Infisical, you can use the `--domain` flag on the `infisical login` command to specify the domain of your Infisical instance. + + For more information on the `infisical ssh add-host` command, please refer to the Infisical CLI [documentation](/cli/overview). + + + If successful, you should see output similar to the following: + + ```bash + ✅ Successfully registered host: + 📁 Wrote User CA public key to: /etc/ssh/infisical_user_ca.pub + 📁 Wrote host certificate to: /etc/ssh/ssh_host_ed25519_key-cert.pub + 📄 Updated sshd_config entries + ``` + + Finally, use the following command to reload the SSH daemon on the remote host to apply the changes: + + ```bash + sudo systemctl reload sshd + ``` + + + The command may differ depending on the host. For older versions of Ubuntu/Debian/CentOS, you may need to use `sudo service ssh reload` instead; + for Alpine or minimal systems, `/etc/init.d/sshd reload`. + + + Back in Infisical, you should now see the remote host you just registered in the Infisical SSH project you created in step 1 under the **Hosts** tab. + + ![ssh hosts](/images/platform/ssh/v2/ssh-added-hosts.png) + + + + 4.1. Add the user(s) you wish to grant access to the remote host to the Infisical SSH project under Access Control > Users. + + ![ssh hosts](/images/platform/ssh/v2/ssh-add-user.png) + + 4.2. On the registered host in the **Hosts** tab, click **Edit SSH Host** and add a login mapping for the user(s) you added in step 4.1. + + The login mapping dictates what user(s) will be allowed access to the remote host and under a specific login user; in the allowed principals, + you should select user(s) part of the Infisical SSH project that will be allowed to login to the remote host as the login user. + + For instance, if you add a mapping with the login user `ec2-user` to some users John and Alice in Infisical, then they will be allowed to login to the remote host as `ec2-user` which is a system user that + exists on the remote host. + + ![ssh host mappings](/images/platform/ssh/v2/ssh-host-login-mappings.png) + + + Note that you should configure authorized principals files for each login user you add to the remote host. + + + + + +## User Guide for SSHing to a Host + +Once Infisical SSH is configured by an administrator, users can SSH to the remote host using the Infisical CLI. + + + + Follow the instructions [here](/cli/overview) to install the Infisical CLI onto your local machine. + + + The `infisical ssh connect` command can be used in either interactive or non-interactive mode to connect to a remote host. + + + + In interactive mode, you'll first need to authenticate with Infisical by running: + + ```bash + infisical login + ``` + + Then simply run: + + ```bash + infisical ssh connect + ``` + + You'll be prompted to select an SSH Host from a list of accessible hosts; this is based on project membership and login mappings configured on hosts by + the administrator. + + ```bash + Use the arrow keys to navigate: ↓ ↑ → ← + ? Select an SSH Host: + ▸ ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com + ``` + + After selecting a host, you'll be prompted to select a login user from a list of allowed login users: + + ```bash + ? Select Login User: + ▸ ec2-user + ``` + + If successful, you should be able to SSH to the remote host. + + ```bash + ✔ ec2-54-199-104-116.ap-northeast-1.compute.amazonaws.com + ✔ ec2-user + ✔ SSH credentials successfully added to agent + Connecting to ec2-user@ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com... + ``` + + + For CI/CD pipelines or automation scenarios, you can use the non-interactive mode with an Infisical token: + + ```bash + infisical ssh connect \ + --hostname ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com \ + --login-user ec2-user \ + --out-file-path ~/.ssh/id_rsa-cert.pub \ + --token + ``` + + This will: + - Connect to the specified hostname + - Use the specified login user + - Write the SSH credentials to the specified path instead of adding them to the SSH agent + - Authenticate using the provided Infisical token + + + + +