Access governance
SSH access governance with short-lived OpenBao certificates, self-hosted
Operator access to your servers runs through Praxis: identified, time-bound, and recorded, using short-lived certificates instead of shared keys.
Last verified: July 29, 2026
Most teams reach their servers through scattered SSH keys and a separate bastion, with the audit trail assembled after the fact. Praxis brokers that access inside the same plane that governs the fleet: operators connect through short-lived certificates signed by OpenBao, access is requested and expires, and sessions are attributable and recorded. No standing keys, and no separate bastion to run alongside it.
What Praxis does here
- Short-lived SSH user certificates signed through OpenBao, a Vault-compatible secrets service; the Praxis database stores metadata and references, not key material.
- Just-in-time access requests with approval, expiry, and revocation; no standing access.
- No in-product root grant or break-glass; managed accounts are no-sudo by default, and Praxis never adopts or deletes accounts it didn't create. Privileged commands run through the governed command path with whitelists and approval.
- Fleet-scoped roles, OIDC / SSO with unlimited users, and TOTP step-up for privileged roles.
- Browser-based terminal, one-off command execution with policy and whitelists, and governed file transfer.
- Session recordings stored locally in your deployment; play them back inside the app.
- Paid editions add session locks, session approvals, command approvals with multi-approval execution, and formal access reviews.
- Every action in the audit trail is attributable to a person.
Why it's different
- Self-hosted with no call-home.
- Access is part of the fleet plane, not a separate PAM product to buy and integrate.
- Certificate-based identity instead of shared keys.
Honest boundary: On pure access we're at parity with dedicated PAM tools, not ahead; the win is integration. We don't run CRL or OCSP: revocation is enforced at authorization time (new connections are denied and host state reconciled), and already-issued short-lived certs are contained by their TTL. Interactive sessions run on a single backend worker in 1.0.
