Shared Credential might be restricted by most Information Security Policies but they are still necessary for specific use cases in most organizations. Not o...

step-ssh-ctl uses mTLS to talk to Smallstep's API server—which complicates its use behind a proxy server. It authenticates to the server using the host...

This error could indicate that the config did not complete successfully.  To troubleshoot this issue you can run step ssh check-host <hostname>. T...

This assumes you are using step ssh while you also need to use a hardware-backed GPG key (such as a Yubikey) to derive an SSH key and are using gpg-agent.  ...

Check that you are using a valid host enrollment token (you can generate or re-generate your token on the Hosts page in your team's dashboard.

On your server add the following line to your /etc/ssh/sshd_config:     Port 628 # change me to your new favorite ssh_port Whenever you SSH to your serve...

For Smallstep SSH clients Depending on your install method, uninstall the step CLI, usually through a package manager uninstall. Delete your step config d...

step-ssh-ctl session runs via PAM. It registers the beginning and end of a login or sudo session with the Smallstep API, and exits. It reads from PAM_USER, ...

See our blog post SSH Emergency Access for instructions on adding offline CAs for emergency access.

If you only want certificate logins (via TrustedUserCAKeys CAs), set the following in sshd_config: AuthorizedKeysFile none PasswordAuthentication no