suSSHi Documentation
Welcome to the official online manual of the suSSHi Suite.
About suSSHi
In large-scale infrastructures, administrative access is typically spread across a rapidly growing number of heterogeneous systems, including physical servers, virtual machines, cloud instances, and container-based workloads. As the number of managed assets increases, so does the complexity of maintaining a consistent and enforceable security model across all entry points.
Without a centralized control mechanism, organizations often rely on fragmented SSH configurations, local user accounts, and manually managed access rules. This leads to inconsistent policy enforcement, increased risk of privilege creep, and a lack of standardized authentication and authorization workflows.
From a security and compliance perspective, maintaining comprehensive audit trails across such environments is equally difficult. Logging mechanisms may vary between systems, may not be centrally aggregated, or may lack the required level of detail to reliably reconstruct administrative activity across the infrastructure.
suSSHi addresses these challenges by providing a centralized SSH access management platform for data center, cloud, and hybrid infrastructure environments.
While suSSHi is often described as an SSH gateway solution, its capabilities extend beyond traditional gateway functionality. suSSHi provides a flexible authentication and authorization framework that supports multiple authentication methods on both the client and target side, including Public Key Authentication, Password Authentication, and Keyboard-Interactive Authentication. These methods can be combined in various ways to meet organizational security and compliance requirements.
A key feature of suSSHi is the integration of all authentication workflows into the SSH authentication phase. This allows authentication prompts to be handled through standard SSH mechanisms, improving compatibility with SSH clients and simplifying client-side error handling. Graphical SSH clients can therefore present authentication dialogs correctly instead of displaying prompts within the terminal session.
For environments with specialized requirements, the authentication and authorization process can be extended through suSSHi’s plug-in architecture, allowing organizations to implement custom workflows and integrations.
Chef Cuisine
suSSHi Chef is the central administration and access management component of the suSSHi Suite. Its web-based administrative interface enables administrators to manage users, authentication settings, access policies, gateways, and other system components from a single location.
suSSHi Chef provides a wide range of advanced features, integrations, and automation capabilities. For example, its comprehensive REST API enables administrators to manage and automate all aspects of the system configuration.
Protocol Deep Inspection and Logging
Each session passing through a suSSHi Gateway is subject to deep packet inspection of all SSH protocol messages. Specialized protocol dissectors analyze SSH traffic and generate protocol-aware audit logs for supported SSHv2 protocols and features. This allows suSSHi to enforce fine-grained access policies and protocol-specific logging rules. Administrative control can be applied to interactive sessions, file transfers, port forwarding, SSH agent forwarding, tunneling, and other SSH capabilities, providing comprehensive visibility and governance of SSH-based operations.
Flexible User Mapping
One of the key strengths of suSSHi is its ability to map individual users to shared administrative accounts, such as root, while preserving user accountability and complete audit trails. Built-in regex-based mapping rules allow these associations to be defined dynamically using flexible naming patterns, simplifying administration in large environments.
Flexible Targets
suSSHi supports multiple target types to accommodate different infrastructure and operational requirements.
Static Targets provide a fixed mapping to specific IP addresses with pre-configured or scanned host keys. Because both the target address and host key are explicitly defined, this is the most secure target configuration method.
Dynamic Targets use fully qualified domain names (FQDNs) instead of fixed IP addresses. Host keys can either be pre-configured or learned dynamically by the gateway. Dynamically learned host keys require explicit acceptance and are stored individually for each user.
Domain Targets allow access to hosts within a specified DNS domain. Host keys are learned dynamically by the gateway, providing the flexibility required for highly dynamic environments such as cloud infrastructures where systems are frequently added, removed, or replaced.
Network Targets operate similarly to Domain Targets but are based on IPv4 or IPv6 CIDR networks rather than DNS domains. This allows targets to be identified by IP address ranges, making them suitable for environments where DNS-based identification is not available or not desired.
Gateway Performance and Scale-out
suSSHi is designed to provide high-performance SSH access with minimal overhead. Establishing a connection through a suSSHi Gateway typically adds less than 100 milliseconds compared to a direct SSH connection. During active sessions, the Gateway operates near wire speed, ensuring that users experience virtually no noticeable impact on latency, throughput, or responsiveness.
To minimize the impact on interactive and file transfer sessions, all session reporting and audit processing are performed asynchronously. This prevents reporting operations from blocking session I/O and ensures consistent performance with negligible latency and jitter.
The suSSHi architecture is designed for horizontal scalability. Additional Gateway instances can be deployed at any time to increase session capacity and distribute load across multiple systems. Gateways operate independently and can be deployed across different Layer 3 network segments.
The suSSHi Chef component also supports scalable deployments and can be operated as multiple instances, allowing management services to scale alongside the Gateway infrastructure.
IPv4 and IPv6 support
suSSHi supports both IPv4 and IPv6 and allows flexible mixed-mode deployments. The IP protocol used between the client and the suSSHi Gateway is independent of the protocol used between the Gateway and the target system. This enables seamless cross-protocol connectivity, for example allowing clients in an IPv4-only network to access IPv6-only target systems and vice versa. Port forwarding can also be used across both IP versions in either direction.
suSSHi implements an enhanced version of the “Happy Eyeballs” approach (RFC 6555), providing configurable connection behavior for dual-stack environments. Administrators can define a preferred IP version, and suSSHi will attempt connections accordingly. When DNS resolution returns multiple addresses, suSSHi evaluates and traverses the address list based on the configured preference and fallback strategy.