Demo library › Chapter 3
Admin access to servers without standing credentials
SSH with a short-lived certificate and no key on the laptop, every command recorded, the database console behind the same group, and Postgres closed to everyone else.
The problem
Horizon Inc's admins keep SSH keys on their laptops and share an account on the server. Nothing records what they type. The database console has the same problem.
Lands with: security and platform teams
Before you start
- Lab only.
- The client signed in as
, an IT Admin. Switch towhere a step says so - see Switching who you are. sshandpsqlin a terminal. No SSH key needed.- For the command log: ssh-log-cli and the SSH key from the keys page.
- The database password, also on the keys page.
Run it
Who may log in
| Do | Say |
|---|---|
Zero Trust → Networks → Targets → apps-server. | The server is registered once. |
| Access controls → Applications → SSH to the apps server → its policy. | Two named IT Admins may log in, as one Unix account: sysadmin. That is decided here, not by keys on the server. |
Whybackground, if you are asked
Who may become sysadmin is decided in one policy, not by whose key is in an authorized_keys file on every server. Leavers lose access when the identity provider says so, and there are no keys to rotate.
SSH with nothing on the laptop
| Do | Say |
|---|---|
As Rickie: ssh sysadmin@apps.corp.internal. Sign in if a browser opens. | No key was used. Cloudflare issued a certificate for this session, and the account has no password. |
In the session: cat README, then sudo docker ps. | A real shell, deliberately without root. |
| As Alice, the same command. | Refused. SSH to this server is not hers. |
Whybackground, if you are asked
The server trusts Cloudflare's SSH certificate authority, and sysadmin has no password, so a short-lived certificate is the only way in. One line of server config does it: /etc/ssh/sshd_config.d/60-cloudflare-access.conf.
The shell is deliberately not root. The point is reaching a server without a standing credential, not what you can do once there.
Every command, on record
| Do | Say |
|---|---|
Insights → Logs → SSH command logs → Rickie's session → Download, then ssh-log-cli decrypt -i <file> -k sshkey --replay. | The session plays back. It is encrypted with the company's key, so Cloudflare cannot read it. |
Whybackground, if you are asked
The session is encrypted with a public key the company uploaded. Cloudflare records it but cannot read it, because the private key never left the company.
The database console
| Do | Say |
|---|---|
As Rickie, open https://pgadmin.corp.internal. | Access asks why. That reason goes in the audit log. |
| In pgAdmin, choose Horizon Inc SSO. | pgAdmin's own login is federated to Access, so this sign-in is silent. |
Expand Horizon Inc reporting → backlog → tickets, and run SELECT reference, description FROM tickets; | No database password typed. Note BKL-1043: a customer's card number, which chapter 6 picks up. |
| As Alice, the same address. | Refused before pgAdmin's login page. |
Whybackground, if you are asked
pgAdmin is an off-the-shelf app with its own login, so there are two objects: an Access application that decides who may reach it, and an Access for SaaS (OIDC) app that tells pgAdmin who they are. The second sign-in is silent because the first already happened.
The reason Rickie types is the part of the audit log a person actually reads.
The database port
| Do | Say |
|---|---|
| Traffic policies → Firewall policies → Network → Postgres: IT Admins only. | Postgres has no login page for Access, so a network policy blocks everyone but the IT Admins. |
As Alice: psql -h db.corp.internal -U backlog backlog | Refused before it reaches the database. |
| As Rickie, the same command. | A password prompt. The network lets him through, and the database still asks who he is. |
Whybackground, if you are asked
Not every protocol has a login page for Access to stand in front of. Postgres is closed by a network policy instead, so Alice cannot even try a password. Two layers, each doing one job.
What the audience should see
- A shell as
sysadminwith no key on the laptop. - Alice refused for SSH, pgAdmin and Postgres.
- Rickie's session replayed from the command log.
Where the evidence is
Access authentication logs for the SSH and pgAdmin sign-ins and Rickie's reason; Gateway network logs for Alice's blocked Postgres connection; the SSH command log.
Known limitations
- The SSH and Postgres policies name the two IT Admins by email address. Infrastructure apps cannot use the IT Admins group.
- SSH command logs are decrypted with
ssh-log-cli, not in the dashboard.
Part of: Replace the VPN · The full tour