Cloudflare announced the open-sourcing of OPKSSH (OpenPubkey SSH) on March 25, 2025. This technology integrates single sign-on (SSO) with SSH authentication, eliminating the need for manual SSH key management.
Previously owned by BastionZero (acquired by Cloudflare), the code has been donated to the OpenPubkey project under the Apache 2.0 license.
The announcement represents a significant advancement in secure remote access technology.
What is OPKSSH?
OPKSSH is an implementation of the OpenPubkey protocol specifically designed for SSH authentication.
It leverages OpenID Connect (OIDC), the primary protocol for SSO, enabling users to authenticate through Identity Providers (IdPs) like Google, Azure, or Okta.
OpenPubkey extends standard OIDC ID Tokens by including a user’s public key, creating what’s called a PK Token.
This effectively turns the ID Token into a certificate that says, for example, “Google confirms alice@example.com is using public key 0x123”.
OPKSSH then enables these PK Tokens to function as SSH keys in the standard SSH protocol, adding SSO authentication without modifying SSH itself.
The beauty of this approach is that it works with any OpenID Connect-compliant provider without requiring changes to existing SSO protocols.
Traditional SSH relies on long-lived public-private key pairs that create significant security and management challenges.
According to SSH inventor Tatu Ylonen, “In many organizations, there are many times more obsolete authorized_keys than they have employees”.
These keys never expire, creating persistent risk. Studies show that weak or default SSH credentials cause 30% of SSH security incidents.
Organizations struggle with tracking keys across systems, managing access when employees leave, and preventing unauthorized access through compromised keys.
SSH key sprawl leads to management overhead, operational complexity, and compliance challenges with regulations like PCI-DSS and GDPR.
Benefits of OPKSSH
OPKSSH addresses these challenges with three key improvements. First, enhanced security through ephemeral SSH keys that are created on-demand and automatically expire after 24 hours, significantly reducing the risk window if a key is compromised.
Second, improved usability as users simply run opkssh login to authenticate via their browser, eliminating the need to generate, manage, or transfer SSH keys between computers.
This means users can SSH from any computer with OPKSSH installed, even without copying private keys. Third, better visibility for administrators who can authorize access by identity (email) rather than cryptographic keys.
If Alice wants to give Bob access, she simply adds bob@example.com to the authorized user file, making it easier to track who has access to which systems.
OPKSSH works by seamlessly integrating with existing SSH infrastructure. When a user runs opkssh login, the command generates an ephemeral key pair and opens a browser for SSO authentication.
Upon successful authentication, OPKSSH receives a PK Token that commits to both the user’s identity and public key.
The user’s SSH client sends this information to the SSH server during connection attempts.
The server verifies the PK Token using the OpenPubkey verifier, which is configured with just two lines in the SSH server configuration.
This verifier confirms the token is valid, unexpired, and signed by the IdP, then checks if the associated email address is authorized for access.
The open sourcing of OPKSSH represents a significant step in modernizing SSH authentication.
By bridging the gap between modern identity management and traditional SSH infrastructure, it eliminates the security risks of long-lived SSH keys while improving convenience for both users and administrators.
The code is available on GitHub at openpubkey/opkssh under the Apache 2.0 license, and the project welcomes community contributions.
As organizations increasingly adopt Zero Trust security models, technologies like OPKSSH that eliminate implicit trust in favor of explicit identity verification will become increasingly vital in secure infrastructure access.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
