Skip to main content

honey ssh login

honey ssh login​

Sign in with SSO and obtain a short-lived SSH certificate for the honey gateway

Synopsis​

Runs a browser OIDC sign-in, then exchanges the resulting identity for a short-lived SSH user certificate signed by honey's SSH CA. The certificate's principals are attested by honey (mapped from your SSO groups by policy), never asserted by the client.

The command certifies the key at --identity (an ed25519 key is generated there if it does not exist) and writes the certificate next to it as <identity>-cert.pub. Point ssh at the key; OpenSSH loads the matching -cert.pub automatically:

honey ssh login --admin-url https://honey.example ssh -i ~/.ssh/honey_ed25519 user@host

honey ssh login [flags]

Options​

      --admin-url string   honey web base URL used to sign in (default $HONEY_WEB_URL, else http://localhost:8765) (default "http://localhost:8765")
  -h, --help               help for login
      --identity string    SSH private key to certify; an ed25519 key is generated here if absent (default "/home/runner/.ssh/honey_ed25519")
      --out string         certificate output path (default: &lt;identity&gt;-cert.pub)

Options inherited from parent commands​

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default &lt;directory of config.yaml&gt;/records
      --refresh              Ignore cached entries and refresh (host discovery)

SEE ALSO​

  • honey ssh - Access hosts through the honey SSH gateway