Appearance

Get started

How it works

Hosts trust one certificate authority instead of a pile of keys. Shellius decides who gets a credential, how long it lasts, and can connect for you from the browser — or hand your own ssh a certificate and stay out of the way.

Why revocation is the hard part

Certificates expiring handles the slow case. The fast case — someone is dismissed at 10am and their certificate is valid until 6pm — is what most setups get wrong.

OpenSSH's built-in answer is a key revocation list, which has to reach every host. That is the problem certificates were supposed to remove. Shellius instead wires AuthorizedPrincipalsCommand to a script that asks the API on every connection.

The trade-off is real: there is now a network call in the connection path, and it fails closed. If hosts cannot reach the API, nobody gets in. Keep a break-glass route that does not depend on Shellius — the threat model says so plainly.

/etc/ssh/sshd_config.d/99-shellius.conf
TrustedUserCAKeys /etc/ssh/shellius_ca.pub
AuthorizedPrincipalsCommand /usr/local/sbin/shellius-check-principals validate %u %s
AuthorizedPrincipalsCommandUser nobody

Three directives. That is the entire host-side configuration.

Run it

Postgres, Redis, the RDP gateway, the API and the portal come up together. Migrations and the first admin account are seeded on boot.

Read the install guide
git clone https://github.com/YavLabs/shellius.git
cd shellius
cp .env.prod.example .env.prod
docker compose -f docker-compose.prod.yml --env-file .env.prod up -d