Configure SSH proxy and command logs
Cloudflare Zero Trust supports SSH proxying and command logging using Secure Web Gateway and the WARP client.
You can create network policies to manage and monitor SSH access to your applications. When a device connects to your origin server over SSH, a session log will be generated showing which user connected, the session duration, and optionally a full replay of all commands run during the session.
1. Ensure Unix usernames match user SSO identities
Cloudflare Gateway will take the identity from a token and, using short-lived certificates, authorize the user on the target infrastructure.
In order to match a user to their SSO identity, the user’s Unix username must match their email address prefix. For example,
jdoe must be registered in your Okta or GSuite organization as
You can create a user entry with duplicate
gid, and home directory to link an identity to an existing user with a different username. You will need to create a password for it separately and add it to the same groups to replicate permissions.
For testing purposes, you can run the following command to generate a Unix user on the machine:
$ sudo adduser jdoe
2. Generate a Gateway SSH proxy CA
Instead of traditional SSH keys, Gateway uses short-lived certificates to authenticate traffic between Cloudflare and your origin.
To generate a Gateway SSH proxy CA and get its public key:
- curl -X POST "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/access/gateway_ca"\-H "X-Auth-Email: <EMAIL>" \-H "X-Auth-Key: <API_KEY>"
A success response will include a
public_keyvalue. Save the key for configuring your server.
3. Save your public key
- Copy the
public_keyvalue returned by the API request in Step 2.
Use the following command to change directories to the SSH configuration directory on the remote target machine:$ cd /etc/ssh
Once there, you can use the following command to both generate the file and open a text editor to input/paste the public key.$ vim ca.pub
ca.pubfile, paste the public key without any modifications.
ca.pubfile can hold multiple keys, listed one per line. Empty lines and comments starting with
#are also allowed.
ca.pubfile. In some systems, you may need to use the following command to force the file to save depending on your permissions::w !sudo tee %:q!
4. Modify your SSHD config
The following procedure makes two changes to the
sshd_config file on the remote target machine. The first change requires that you uncomment a field already set in most default configurations; the second change adds a new field.
While staying within the
/etc/sshdirectory on the remote machine, open the
sshd_configfile.$ vim /etc/ssh/sshd_config
Navigate to the row named
PubkeyAuthentication. In most default configurations, the row will appear commented out as follows:# PubkeyAuthentication yes
Remove the # symbol to uncomment the line; keep the setting
Next, add a new line below
PubkeyAuthenticationas follows:TrustedUserCAKeys /etc/ssh/ca.pub
Save the file and quit the editor. You might need to use the following command again to save and exit.:w !sudo tee %:q!
5. Check your SSH port number
Cloudflare’s SSH proxy only works with servers running on the default port 22. Open the
sshd_config file and verify that no other
Port values are specified.
6. Restart your SSH server
Once you have modified your SSHD configuration, you still need to restart the SSH service on the remote machine.
$ sudo service ssh restart$ sudo systemctl restart ssh
$ sudo service sshd restart$ sudo systemctl restart sshd
7. Create an Audit SSH policy
In the Network tab, create a new network policy.
Add any other conditions to your policy. If a user does not meet the criteria, they will be blocked by default.
In the Action dropdown, select Audit SSH.
Save the policy.
8. Connect as a user
Users can use any SSH client to connect to the target resource, as long as they are logged into the WARP client on their device. Cloudflare Zero Trust will authenticate, proxy, and optionally encrypt and record all SSH traffic through Gateway.
(Optional) Configure SSH Command Logging
ssh-log-cliutility, generate a public and private key pair.$ ./ssh-log-cli generate-key-pair -o sshkey$ lsREADME.md ssh-log-cli sshkey sshkey.pub
This command outputs two files, an
sshkey.pubpublic key and a matching
In the SSH encryption public key field, paste the contents of
sshkey.puband click Save. Note that this a different public key from the
ca.pubfile you used to configure the origin server.
View SSH Logs
On the Zero Trust dashboard, navigate to Logs > Gateway > SSH.
If you enabled the SSH Command Logging feature, you can Download a session’s command log.
- $ ./ssh-log-cli decrypt -i sshlog -k sshkey
This command outputs a
sshlog-decrypted.zipfile with the decrypted logs.