Prerequisites
- The Admin role on the folder you’ll add the account to
- Root access on the server
- A Gateway that can reach the server on its SSH port
Step 1: Create the SSH account
1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder and an SSH Account Template, then select Next.
3
Enter a Name, and the server’s Host and Port. If the template doesn’t set a Gateway, select one under Gateway.
4
Select Certificate as the Auth Method, enter the Username to log in as, and select Create.
Step 2: Configure the server to trust the account’s CA
1
On the Accounts page, open the options menu of the account you created and select Configure. Under SSH CA setup required, select Copy install command.
2
Run the command on the server. The command downloads a setup script and runs it as root.The script adds the account’s CA public key to the file that the
TrustedUserCAKeys setting in sshd_config points to. If sshd_config has no TrustedUserCAKeys setting, the script adds the key to /etc/ssh/infisical_ca.pub and adds the setting. It then checks the configuration with sshd -t and restarts the SSH service.3
Check that the server trusts the CA file:
The command contains your Infisical access token, which it uses to download the script. To read the script before you run it, run the command without
| sudo bash.Step 3: Connect to the server
Anyone with access to the account can now launch a session on it from the Accounts page, in the browser or through the CLI. To learn how, see Connect to an account. If a session fails to authenticate, check that the account’s Username exists on the server and that the setup script finished without errors.Next steps
Access control
Control who can manage PAM and who can connect to each account.
Sessions
Review and end the connections that people and agents make to your accounts.