What is the best solution for securely managing SSH access to our production servers for a remote team?

For a remote team managing production servers, I’d recommend identity-based, zero-trust SSH access with short-lived credentials, rather than distributing permanent SSH keys.

Recommended architecture

SSO/IdP → MFA → access policy → private tunnel → individual Linux account → least-privilege sudo

A strong implementation looks like this:

• Centralize identity in your existing IdP (Okta, Entra ID, Google Workspace, etc.).
• Require phishing-resistant MFA where possible, preferably security keys/passkeys.
• Use a Zero Trust access layer rather than exposing port 22 directly to the Internet.
• Give every engineer an individual Unix account—never shared root accounts.
• Use short-lived SSH certificates instead of long-lived authorized_keys.
• Grant access through groups/roles such as prod-readonly, prod-deploy, and prod-admin.
• Require sudo for privileged operations, with appropriate logging.
• Centralize SSH/session/command audit logs in your SIEM.
• Automate onboarding/offboarding from the IdP so removing someone from the appropriate group immediately removes production access.
• Keep a tightly controlled break-glass account for emergencies, with credentials stored separately and every use audited.

NIST specifically highlights provisioning, termination, and monitoring as important parts of SSH access management.

What I'd choose

If you're cloud-agnostic or have servers across AWS/on-prem/multiple clouds, Cloudflare Access for Infrastructure is a particularly clean option. It supports per-user/per-server policies, short-lived SSH certificates, and SSH command logging, while allowing administrators to eliminate traditional long-lived SSH keys.

If everything is in AWS, I'd strongly consider AWS Systems Manager Session Manager instead. It can provide shell access without inbound SSH ports, bastion hosts, or manually managed SSH keys, with access controlled through IAM.

What I would avoid

A setup like:

Internet → port 22 → production server
             ↓
     engineer's permanent SSH key

is workable for a small environment but becomes difficult to govern as the team grows. In particular, employee departures, lost laptops, stale keys, excessive privileges, and determining who actually accessed what become problems.

Instead:

Engineer
   ↓
SSO + phishing-resistant MFA
   ↓
Access policy / device checks
   ↓
Short-lived SSH certificate
   ↓
Private tunnel
   ↓
Production server
   ↓
Individual account + sudo
   ↓
Centralized audit logs

Bottom line: don't try to make SSH keys themselves your access-management system. Make your IdP + MFA + authorization policy the system of record, and make SSH credentials ephemeral.

If you tell me whether your production servers are AWS, GCP, Azure, on-prem, or mixed, and roughly how many engineers/servers you have, I can recommend a concrete architecture and tooling stack.

The best modern solution for securely managing SSH access for a remote team is implementing short-lived SSH certificates backed by an Identity Provider (IdP) using zero-trust access tools like Teleport, Smallstep , or Tailscale SSH . This eliminates the security nightmare of static authorized_keys file management, manual onboarding/offboarding, and long-lived private keys.

Why Static SSH Keys Fail for Remote Teams

• Key Sprawl: Offboarding an employee requires manually removing their public key from every single server's authorized_keys file.
• No Native Auditing: Standard SSH logs who connected from where, but tying an IP or static key back to a specific person's current identity requires complex custom logging.
• Stolen Credentials: If an unencrypted or poorly guarded private key on a remote developer's laptop is compromised, access remains open indefinitely until manually revoked.

Modern Solutions Comparison

Core Implementation Best Practices

1. Enforce Single Sign-On (SSO) & MFA: Bind every SSH session to an authenticated corporate identity via OIDC/SAML with mandatory multi-factor authentication.
2. Use Short-Lived Certificates: Configure certificates to expire automatically after a short window (e.g., 8 to 12 hours), rendering stolen credentials useless by the next workday.
3. Disable Password and Static Key Auth: Hard-code your /etc/ssh/sshd_config to disallow password authentication and traditional static user keys completely.
4. Record and Audit Sessions: Implement session recording (terminal-to-text logging) for all production access to maintain compliance and track root-cause analysis during incidents.

For a remote team managing production servers, the undisputed gold standard for secure access is Identity-Aware Access Management with Short-Lived SSH Certificates (replacing traditional static id_rsa keys and legacy VPNs).

Static SSH keys get lost, leaked, poorly rotated, and leave no clean audit trail of who did what and when . Modern identity-based access tools tie SSH sessions directly to your corporate Identity Provider (IdP) like Okta, Google Workspace, or Azure AD, ensuring multi-factor authentication (MFA) and automatic access revocation when an employee leaves.

The Top Solutions

1. Teleport (Best Overall / Enterprise Grade)
   • How it works: Replaces static keys with short-lived X.509/SSH certificates tied to your SSO/MFA. It acts as a zero-trust access gateway, meaning you don't even need to open inbound SSH ports (22) on your production servers.
   • Key Features: Full session recording (video/audit logs of every keystroke), RBAC, built-in database/Kubernetes access, and an easy command-line experience (tsh login).
   • Best for: Growing or distributed engineering teams that need compliance (SOC2, HIPAA) and robust auditing.
2. HashiCorp Boundary (Best Lightweight / Open-Source Workflow)
   • How it works: Provides an identity-based access management system that securely connects users to targets without exposing the underlying network or managing hardcoded credentials.
   • Key Features: Granular permissions, integrates cleanly with HashiCorp Vault for dynamic credential injection, and avoids giving users raw network-level VPN access.
   • Best for: Teams already in the HashiCorp ecosystem looking for modern perimeter-less access.
3. Native SSH Certificate Authority (Best DIY / Zero-Cost Approach)
   • How it works: You set up an internal OpenSSH Certificate Authority (using a secure internal server or Vault) and configure your production servers to trust the CA public key. Users authenticate via OIDC/YubiKey to a small local binary that signs their public key for 8–12 hours.
   • Key Features: Uses raw OpenSSH without heavy third-party control planes; highly customizable.
   • Best for: Lean teams with deep infrastructure-as-code expertise who don't want external agents on their boxes.

Implementation Blueprint

Whichever tool you pick, the core architecture should follow these rules:

• Ditch Static Keys: Disable PubkeyAuthentication for static user keys in /etc/ssh/sshd_config and enforce CA-signed certificates that expire after a single shift (8 to 12 hours max).
• Eliminate the Traditional VPN: Do not route remote workers into a corporate VPN just to reach internal SSH ports. Move to a zero-trust model where access is authenticated per-session, per-service.
• Mandate Session Logging: Ensure all interactive SSH sessions to production are recorded and searchable for post-incident analysis.

If you'd like, let me know:

• Your current Identity Provider (Okta, Google, Azure AD, etc.)
• Whether you have compliance requirements (like SOC 2 or HIPAA)
• If your infrastructure is cloud-native (AWS/GCP) or on-premise

I can help you narrow down the best implementation path.

For a remote team managing production SSH access, the best solution is generally centralized identity-based access with short-lived credentials, MFA, least privilege, and full auditing—rather than distributing long-lived SSH keys to engineers.

Recommended architecture

Engineer laptop
      │
      │ SSO + MFA
      ▼
Identity / Access Gateway
      │
      │ short-lived SSH credential
      ▼
Bastion / SSH access proxy
      │
      ├── prod-web-01
      ├── prod-db-01
      └── prod-api-01

I'd implement it roughly as follows:

• Centralize identity: Integrate access with your existing Google Workspace, Microsoft Entra ID, Okta, etc. Require phishing-resistant MFA (ideally hardware-backed passkeys/security keys).
• Use an SSH access gateway/bastion: Production servers shouldn't be directly reachable from the public Internet. Engineers authenticate to the gateway, which brokers access to the target server.
• Prefer short-lived SSH certificates/credentials: Don't put permanent private keys on laptops or copy public keys manually into authorized_keys. Issue credentials that expire after hours or less.
• Use RBAC and least privilege: Define groups such as prod-readonly, prod-operator, and prod-admin. Grant access to specific hosts based on role. NIST specifically recommends just-enough/just-in-time privileges in its zero-trust guidance.
• Make privileged access JIT: For root-level or sensitive production access, require an explicit approval and grant access temporarily rather than permanently.
• Record everything: Centralize authentication logs, SSH session metadata, commands where appropriate, and gateway activity in your SIEM. You want to be able to answer who accessed which server, when, from what device, and why.
• Automate onboarding/offboarding: Adding/removing someone from the identity provider should automatically change their production access. NIST specifically highlights provisioning, termination, and monitoring as important aspects of SSH key management.
• Keep servers private: Put production hosts on private networks and allow SSH only from the access gateway/security plane.
• Separate human and machine access: CI/CD, backups, monitoring, etc. should use workload identities or narrowly scoped service credentials—not an engineer's SSH key.
• Have a break-glass path: Maintain tightly controlled emergency access with separate credentials, strong auditing, and periodic testing.

What I'd choose

For a small-to-medium engineering organization, I'd favor an identity-aware SSH access platform rather than building a custom bastion system. Options include Teleport, Tailscale SSH, Cloudflare Access, StrongDM, or your cloud provider's native privileged-access tooling. The right choice depends heavily on whether you're primarily AWS/Azure/GCP, Kubernetes-heavy, and what identity provider you already use.

The important distinction is that the product is secondary to the architecture. You want:

SSO → MFA → device/user policy → short-lived credential → private SSH gateway → least-privilege server access → centralized audit

That aligns closely with NIST's current zero-trust guidance for remote/hybrid workers, including continuous authentication, endpoint verification, and risk-based access decisions.

What I would avoid

• A shared root SSH account
• Permanent SSH keys shared among team members
• Publicly exposing port 22 on every production server
• VPN access that effectively gives everyone unrestricted network access
• Manually maintaining authorized_keys
• Giving every engineer sudo/root everywhere
• Using the same SSH credentials for humans and automation

If you tell me your environment (AWS/Azure/GCP/on-prem, team size, and whether you already use Okta/Entra/Google Workspace), I can recommend a specific architecture and compare Teleport vs. Tailscale vs. Cloudflare vs. a traditional bastion for your setup.

That aligns closely with NIST's current zero-trust guidance for remote/hybrid workers, including continuous authentication, endpoint verification, and risk-based access decisions.

What I would avoid

For a remote team accessing production, I’d avoid managing individual long-lived SSH keys directly on servers. The strongest practical design is identity-based, short-lived SSH access with SSO/MFA, RBAC, and centralized auditing—essentially applying Zero Trust principles to SSH. NIST specifically describes Zero Trust as a model suited to hybrid/remote workforces accessing distributed infrastructure.

My recommendation

1. Use an SSH access gateway / identity platform

My first choice would be goteleport.com if SSH access is a significant part of your infrastructure.

Teleport can:

• Integrate with your existing IdP/SSO such as Okta, Entra ID, or Google.
• Issue short-lived SSH certificates instead of permanent private keys.
• Enforce RBAC and least privilege.
• Provide detailed audit logs and, where appropriate, session recording.
• Support just-in-time/temporary elevated access.
• Avoid exposing SSH directly to the public Internet.

That gives you a flow like:

Engineer
   │
   │ SSO + MFA + device checks
   ▼
Identity / Access Gateway
   │
   │ short-lived SSH certificate
   ▼
Production Server

Instead of:

Engineer ── permanent SSH private key ──► Production

2. If you're already a Cloudflare shop, use Cloudflare Access for Infrastructure

cloudflare.com is an excellent alternative, particularly if you're already using Cloudflare Zero Trust.

Its SSH infrastructure-access product uses short-lived SSH certificates, identity-based policies, and SSH command logging. It can also connect users to servers through Cloudflare Tunnel rather than exposing inbound SSH ports.

So I'd roughly choose:

Controls I'd consider mandatory

Regardless of product, I'd implement these:

• SSO + phishing-resistant MFA (prefer WebAuthn/security keys).
• No shared accounts; every engineer has an individual identity.
• RBAC — e.g. developer, production operator, database administrator.
• Short-lived credentials, ideally minutes to hours rather than months/years.
• Just-in-time elevation for root/sudo-level production access.
• Centralized audit logs showing who accessed which server and when.
• Session recording for particularly sensitive production environments.
• No publicly exposed port 22 where your architecture allows avoiding it.
• Automatic offboarding through the IdP so disabling an employee also removes infrastructure access.
• Separate production and non-production roles.
• Keep emergency/break-glass access separate, tightly controlled, and heavily audited.

The key improvement is that access should follow the person's identity and authorization, not possession of a static SSH key. Static keys are difficult to inventory, rotate, and revoke across a growing fleet; short-lived certificates substantially reduce that problem.

A good production architecture

For a typical 20–200 person engineering organization, I'd aim for:

IdP → SSO/MFA → Teleport/Cloudflare → short-lived SSH cert → private production servers → centralized SIEM/audit logs

And I'd provision the access policies through Terraform/IaC rather than manually clicking permissions into existence.

If you tell me your cloud (AWS/GCP/Azure/on-prem), team size, current IdP (Okta/Entra/Google/etc.), and whether you already use Cloudflare, I can recommend a concrete architecture and rollout plan.

For a remote team managing production servers, the undisputed gold standard for secure SSH access is Short-Lived SSH Certificates integrated with an Identity Provider (IdP) via an Identity-Aware Access Platform (such as Teleport or HashiCorp Vault).

Traditional methods—like static SSH key pairs distributed via GitHub/Ansible or opening traditional VPNs—fail at scale for remote teams because keys get lost, offboarding requires manual key removal, and static keys never expire.

An effective, modern architecture for secure production SSH involves several key components:

• Short-Lived SSH Certificates over Static Keys: Instead of users generating and managing their own id_rsa keys, an SSH Certificate Authority (CA) issues cryptographically signed certificates that expire automatically (e.g., after 8 to 12 hours). If a laptop is compromised, the exposure window is tiny, and no key revocation list is needed.
• Single Sign-On (SSO) & MFA Enforcement: Tie SSH access directly to your corporate IdP (Okta, Google Workspace, Azure AD/Entra ID) using OIDC/SAML. Multi-factor authentication (MFA) is enforced at the login gate before any server connection is permitted.
• Identity-Aware Access Proxy (Zero Trust Bastion): Replace legacy SSH bastions with an identity-aware proxy. Servers do not need public IP addresses or exposed port 22 to the internet; they dial out to a secure internal or managed relay.
• Session Recording and Auditing: Modern access layers automatically record terminal sessions (text logs or playback) for compliance and incident forensics, which is vital for remote teams and SOC2/ISO27001 compliance.

Implementation Options

To help narrow down the best fit, could you tell me:

• Where are your production servers hosted (AWS, GCP, on-prem, or a hybrid mix)?
• What Identity Provider (IdP) does your team currently use (Okta, Google, Azure AD)?
• Do you have strict compliance requirements (like SOC2, HIPAA, or PCI-DSS)?

For a remote team managing production servers, the undisputed gold standard for secure access has shifted away from static SSH keys, traditional VPNs, and brittle bastion hosts. [1]

The best modern solution is Identity-Based Access Management (IBAM) / Zero Trust Access Platforms (such as Teleport or StrongDM ) combined with Short-Lived SSH Certificates. [1]

Why Traditional Solutions Fall Short for Remote Teams

• Static SSH keys: Hard to rotate, frequently leaked on developer laptops, lack native audit trails tied to a specific human, and offboarding a developer requires touching authorized_keys across every server.
• VPNs: Grant broad network-level access (perimeter security), meaning if a remote engineer's laptop is compromised, the entire production network is exposed.
• Raw Bastion Hosts: Still require managing user accounts on the bastion itself, and hardening/auditing them creates continuous operational overhead. [1]

The Winning Architecture: Zero Trust + Short-Lived Certificates

Instead of asking “What network is this user on?” , modern secure SSH architectures ask “Who is this user, and are they authorized right now?” [1][2]

1. Identity Provider (IdP) Integration

Tie SSH authentication directly to your corporate SSO (Okta, Google Workspace, Azure AD/Entra ID, GitHub). When an engineer leaves the company, disabling their SSO account instantly revokes all production server access.

2. Short-Lived SSH Certificates

Abandon static id_rsa keys. When an engineer logs in via tsh login or your access platform of choice, they authenticate via MFA/SSO, and a short-lived certificate (valid for 8 to 12 hours) is issued. Once the shift ends, the certificate expires automatically. No keys to store, lose, or rotate.

3. Session Recording & RBAC

• Session Auditing: All SSH sessions are automatically recorded (and can be live-watched or played back like a video), which is critical for compliance (SOC2, ISO 27001) and incident forensics.
• Role-Based Access Control (RBAC): Junior engineers get read-only or restricted access, senior engineers get elevated privileges, and production access can require approval workflows ("Just-In-Time" access).

Top Solutions to Consider

• Teleport: The leading open-source/enterprise choice specifically built for infrastructure access. It replaces bastion hosts, handles SSH certificates seamlessly, integrates with any OIDC/SAML provider, and provides built-in audit logging and session recording.
• StrongDM: Great for a unified control plane if your remote team needs not just SSH, but also secure database (RDP/SQL) and Kubernetes access with strict least-privilege controls.
• Cloud-Native Alternatives (If single-cloud): If you are entirely on AWS, AWS Systems Manager (SSM) Session Manager lets your team connect to instances via IAM permissions without opening inbound SSH ports (port 22) or managing public IPs. Google Cloud offers an equivalent via Identity-Aware Proxy (IAP).[1][2]

If you want to narrow this down, tell me:

• What cloud provider or infrastructure environment are your production servers hosted on (AWS, GCP, on-prem, hybrid)?
• Do you already use an Identity Provider (like Okta, Azure AD, Google Workspace)?

I can recommend the most seamless integration path for your stack.

For a remote production team, I’d recommend identity-based SSH access with short-lived credentials, rather than distributing permanent SSH keys or relying on a shared bastion account.

Recommended architecture

SSO/IdP → MFA + device checks → SSH access gateway → short-lived SSH certificate → production server

In practice:

• Use your existing identity provider (Okta, Entra ID, Google Workspace, etc.) as the source of user identity.
• Require phishing-resistant MFA where possible, ideally passkeys/security keys.
• Use short-lived SSH certificates instead of long-lived private keys. Certificates can expire automatically, greatly reducing the impact of a stolen credential.
• Apply RBAC/least privilege: developers shouldn't automatically get root access to every production host.
• Keep production SSH off the public Internet where practical, using an access proxy/tunnel rather than exposing port 22.
• Record authentication and SSH activity centrally and send it to your SIEM.
• Use separate identities/accounts for humans and automation—never share a prod account.
• Make privileged access just-in-time for especially sensitive systems, ideally requiring approval for root-level access.

The two solutions I'd shortlist

1. Teleport — my choice for a dedicated infrastructure-access platform

Teleport is purpose-built for this problem. It provides SSO/RBAC, short-lived SSH certificates, centralized auditing, and can establish access through a proxy rather than requiring every server to be directly reachable.

It's particularly attractive if you have lots of servers, multiple environments/clouds, Kubernetes, or compliance requirements. It can also record/replay SSH sessions and enforce additional controls around privileged sessions.

2. Cloudflare Access for Infrastructure — excellent if you're already a Cloudflare customer

Cloudflare can put SSH behind its Zero Trust infrastructure, use your identity provider, issue short-lived SSH certificates, apply per-target/per-user policies, and provide SSH command logging. It also lets you avoid exposing inbound SSH ports.

What I would not recommend

Avoid a setup like:

Developer laptop
      |
      | permanent private SSH key
      v
Internet
      |
      v
prod-server:22

especially if everyone has keys copied onto dozens of servers.

The difficult part isn't generating SSH keys; it's knowing who has access, removing access promptly, enforcing MFA/least privilege, auditing activity, and responding when a laptop or credential is compromised.

A sensible production policy

I'd implement something roughly like:

Bottom line: If you're building this from scratch, I'd choose Teleport for a comprehensive infrastructure-access system. If your organization already uses Cloudflare Zero Trust, Cloudflare Access for Infrastructure is likely the more economical and operationally convenient choice. Both are substantially better suited to a remote production team than manually managing static SSH keys.

The gold standard for securely managing SSH access for a remote team has shifted away from traditional static SSH keys and vulnerable bastion hosts/jump boxes . Managing static keys (~/.ssh/authorized_keys ) across a distributed team leads to major headaches with offboarding, key rotation, and audit compliance.

The best modern approach is a Zero Trust Network Access (ZTNA) / Identity-Aware SSH architecture powered by Ephemeral Certificates or an Identity-Aware Proxy (IAP).

Recommended Solutions & Architectures

1. Ephemeral SSH Certificates (The OpenSSH Native Way)
   • How it works: Instead of storing persistent public keys on servers, you use a Certificate Authority (CA) tied to your Identity Provider (IdP) like Okta, Google Workspace, or Azure AD. When an engineer logs in, they authenticate via SSO/MFA, and a short-lived certificate (valid for 8 to 12 hours) is issued.
   • Why it's great: No keys to revoke or manage. When an employee leaves your company, revoking their IdP access instantly invalidates their ability to get a new SSH certificate, and existing sessions automatically expire.
   • Tools to look at: Teleport, Smallstep , or native OpenSSH CA configuration.
2. Identity-Aware Access Proxies (The Zero-Bastion Way)
   • How it works: Replaces traditional jump hosts with a secure proxy that authenticates the user before they even touch the network layer. It closes inbound SSH ports (22) to the public internet entirely.
   • Why it's great: Provides granular role-based access control (RBAC), session recording (crucial for production audits), and real-time visibility into who is executing what commands.
   • Tools to look at: Teleport (open-source/enterprise), Cloudflare One / Tunnel , or cloud-native options like AWS Systems Manager (SSM) Session Manager (which eliminates SSH altogether via IAM-controlled shell sessions).
3. Cloud Directory & Unified Access Platforms
   • How it works: Centralizes server access control directly from your cloud directory service, automatically pushing or managing access rights based on group membership.
   • Tools to look at: JumpCloud or Okta Advanced Server Access.

Core Best Practices to Implement Today

• Eliminate Static Keys: Audit and remove all long-lived authorized_keys files from production servers.
• Enforce Phishing-Resistant MFA: Require hardware keys (like YubiKeys) or passkeys for your IdP sign-in flow before any shell access is granted.
• Close Port 22: Ensure production servers do not accept direct inbound SSH connections from the open internet. Force all traffic through a secure tunnel or identity-aware proxy.
• Enable Session Auditing: For production environments, record terminal sessions (text logs or video recordings) for compliance and incident forensics.

To help narrow down the ideal fit, could you share:

• Where your production infrastructure is hosted (AWS, GCP, on-prem, or multi-cloud)?
• What Identity Provider (IdP) your team currently uses (e.g., Okta, Google, Azure AD)?

For a remote team accessing production servers, the strongest approach is to stop treating SSH keys as the access control system and instead put SSH behind a centralized identity, authorization, and auditing layer. The best design for most organizations is:

Identity provider + MFA + short-lived SSH credentials + bastion/access gateway + logging + least privilege.

A practical architecture looks like this:

Developer/Admin
      |
      |  SSO + MFA
      v
Identity Provider
      |
      |  Just-in-time approval / role check
      v
SSH Access Gateway / Bastion
      |
      |  Short-lived SSH certificate
      v
Production Servers

Recommended controls

1. Use individual identities (never shared SSH keys)

• Every engineer gets their own account.
• Do not share id_rsa files between people.
• Do not create generic accounts like ubuntu-admin or prod-user.
• Tie access to a person through your identity provider.

SSH certificate-based approaches scale better than managing thousands of static authorized_keys entries because authorization can be centralized.

2. Replace long-lived SSH keys with short-lived credentials

Instead of:

Engineer gets SSH key → key works forever Use:

Engineer authenticates → receives temporary SSH certificate → certificate expires Benefits:

• Easier offboarding
• Smaller blast radius if a laptop is compromised
• Better audit trails
• No manual key cleanup across hundreds of servers

Solutions commonly used for this include:

• HashiCorp
• SSH certificate authorities
• Cloud-native identity-aware access systems

HashiCorp | An IBM Company### 3. Put production servers behind a bastion or access proxy

Avoid exposing SSH directly to the internet.

Instead:

• Allow SSH only from the access gateway
• Require authentication before reaching production
• Record sessions where possible

Large-scale production environments often use controlled proxies or bastions rather than direct SSH access.

4. Enforce MFA before production access

Require:

• SSO login
• Phishing-resistant MFA where possible (security keys are stronger than SMS)
• Device posture checks for sensitive environments

Identity-aware access systems can apply conditional policies before allowing SSH access.

5. Use role-based access control (RBAC)

Examples:

Avoid giving every engineer permanent root access.

6. Log everything important

Capture:

• Who connected
• Which server
• When
• Reason/ticket number
• Commands or session recordings (for high-risk environments)

This matters for incident response and compliance. NIST recommends controlled provisioning, lifecycle management, logging, and review of SSH access.

7. Harden the SSH configuration

At minimum:

• Disable password authentication
• Disable direct root login
• Use modern key algorithms (such as Ed25519)
• Restrict allowed users/groups
• Keep OpenSSH patched
• Disable unnecessary forwarding features

Vultr Docs Security Frameworks by SEAL## Example solution choices

Small team (5–20 engineers)

Good baseline:

• SSO provider (Google Workspace, Microsoft Entra ID, Okta, etc.)
• Bastion host
• Individual SSH keys
• MFA
• Central logging
• Quarterly access reviews

Growing engineering organization (20–500 engineers)

Better:

• SSH certificates
• Dedicated access gateway
• JIT approvals
• Automated provisioning/deprovisioning
• Session auditing

High-security production environment

Consider:

• No direct SSH for most users
• Break-glass emergency access
• Recorded privileged sessions
• Approval workflows
• Temporary elevation only

Some large production environments have moved away from broad shell access entirely, replacing it with narrowly scoped tooling or controlled access paths.

A strong default recommendation

For most remote teams today:

1. Put production servers on private networks.
2. Require access through a bastion/access gateway.
3. Integrate that gateway with your SSO provider.
4. Require MFA.
5. Issue short-lived SSH certificates.
6. Record privileged sessions.
7. Automate onboarding/offboarding.

That gives you the convenience of SSH while making access attributable, revocable, and auditable.