cloudflare / cloudflare/cloudflared

💡 Support `--service-token-id` and `--service-token-secret` in `cloudflare access ssh-gen`

Open
#1,056 1 comment 6 reactions 0 assignees View on GitHub
Priority: Normal Type: Feature Request
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the feature you'd like**
I would like to be able to use Service Tokens in my Ansible controller to be able to access machines via SSH using cloudflared. Cloudflare Access Service Tokens have good ergonomics when it comes to issuing and revoking tokens, so I think that this is a good fit for this application. Ideally I would like for cloudflared to also automatically authenticate the Ansible controller to the host it is connecting to. This is not possible with the current `cloudflared access ssh-gen` command.

**Describe alternatives you've considered**
Another option would be to simply forgo using short-lived SSH certificates and just add an SSH key secret volume mount into the Ansible controller container. I personally see this as a worse solution compared to what this new feature would provide as it significantly encumbers the revocation process.

**Additional context**
It looks like short-lived certificate generation is handled in the `sshgen` package, where it contacts a special endpoint for certificate signing. Presumably it would just be required to get a token using the service token, and use that to authenticate `ssh-gen`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.