Add SSH targets

Availability All editions — Community and up.

Requires the manage targets permission.

Create a target

1. Go to Servers → Add server.
2. Enter a name, host and port (default 22).
3. Optionally assign a project and group, and arbitrary key=value metadata tags.

Set the credential

Open Credentials on the target and provide the SSH login:

• Password — username and password, or
• Key — username and a private key (inline, or a reference to one from the SSH key library).

The secret is encrypted at rest and never displayed again — to change it, enter a new one.

A target holds one credential. To expose the same host under two different logins — typically a privileged account and a read-only one — register it twice under different names; hosts do not have to be unique, only names do. That is the basis of hard read-only on SSH, where the OS account rather than the command filter provides the guarantee.

Port forwarding is brokered: local and dynamic forwarding (ssh -L / -D, via direct-tcpip) work in read-write sessions and are rejected in read-only sessions. Remote forwarding (ssh -R) is not supported.

Host key verification (TOFU)

Tessera stores the target’s host public key on first connection and verifies it on every subsequent one (Trust On First Use). If the key changes unexpectedly, the connection is refused and an audit event is logged. After a legitimate rebuild, clear the pinned key on the target so the next connection re-pins it.

Connect through a bastion

To reach a target via a jump host, set a bastion on the target and provide (or reference) its host, port, username and credential. The controller dials the bastion first, then the target, verifying both host keys with TOFU. See Bastions & jump hosts.

Grant access

A target is invisible until someone has a grant for it. Add grants under Access — see Role-based access — or let users request just-in-time access.