Appearance

Get started

SSH Access ThatExpires on Its Own

Your servers still trust a key someone made in 2019. Shellius replaces static keys with short-lived certificates, sends production access through an approver, and keeps one record of what happened.

Run Shellius open sourceShellius Cloud early access
/access-requests

Production access goes through a person

A server tagged prod always needs an approver. No policy flag can quietly turn that off.

  • Every request carries a reason and a duration
  • Approvers can grant less time than was asked for
  • Bypass needs a role permission and an org-wide switch
  • A bypass is still recorded, and approvers are told
Read the guide
Interface preview with sample data.

Revoke once. The next login is refused.

Hosts ask Shellius about every connection, so taking access away does not mean editing a file on thirty servers. Try it on this certificate.

How revocation works
id_ed25519-cert.pubValid
Key ID: "jdoe@acme · web-prod · req-8841"
Principals: deploy
Valid: from 09:14:00 to 17:14:00
Critical Options: source-address 10.4.0.0/16
Expires in07:59:58

Replace your static keys

Flip the switch. With static keys, every line is a standing trust relationship stored on a host. With Shellius, hosts trust one certificate authority and people hold access that expires.

PeopleHosts — trust the CAEngineercertificate, 8hContractorcertificate, 1hLeft in MarchrevokedShelliuspolicy · CA · auditweb-prodapproval requireddb-prodapproval requiredapi-stagingauto-approvedrefused
Hosts trust one certificate authority. People hold certificates that expire, and revoking one person is a single action in one place.

Reach private hosts from a browser

Browser sessions are opened by Shellius, not by your laptop. Run it inside the network, expose only HTTPS, and nobody needs a VPN account to get a shell.

Public internetPrivate network — 10.0.0.0/8Your laptopno VPNShelliusonly :443 exposedweb-prod10.0.0.5Your VPNnot part of Shellius① browserHTTPS / WSSShellius opens SSHstill valid?② terminal clientneeds a route
  • Connection Shellius opens for you
  • Connection your own machine opens
  • API call
With Shellius inside the private network, a browser session needs no VPN: your laptop only ever talks to Shellius. The terminal client connects from your laptop, so your laptop needs its own route.

Read how each route travels

It uses what you already run

Hosts keep stock OpenSSH. Shellius signs with ssh-keygen. Take it away and your servers are ordinary hosts that trust a CA.

It is yours to host

One Compose file: PostgreSQL, Redis, guacd, the API and the portal. The CA your fleet trusts never leaves your infrastructure.

It is free software

AGPL-3.0, one edition. Approvals, recording, SSO and audit are not held back for a paid tier.

Stop guessing who can reach production.

Read what changes, or go straight to the install guide. The threat model is honest about what it does not protect.

Install with DockerView the source