README
¶
Engity's Bifröst
Bifröst is a configurable SSH server and gateway for teams managing access to hosts and isolated work environments. Flows combine authorization with where a session runs. Users connect with a standard SSH client; OIDC Device Authorization also requires a browser and a suitable identity provider.
Features
- Standard SSH clients: Connect using OpenSSH, PuTTY or another regular SSH client without installing a Bifröst-specific client.
- Flexible authorization: Choose local accounts, SSH keys or OIDC Device Authorization through configurable access flows.
- Host and container sessions: Work as a local user, in a Docker container or in a Kubernetes Pod; optionally provision and clean up managed local accounts.
- SSH gateway: Reach private SSH servers through a separately authenticated connection with target host-key verification.
- Audit and recording: Optionally write signed audit events and verifiable terminal recordings.
- Time-bound access: OIDC can close Bifröst connections after a refresh grant is rejected. Set connection and session lifetimes to support off-boarding targets such as 15 or 60 minutes, and test the result against your IdP and requirements.
Get started
Install Bifröst on Linux, Windows or macOS as a host service, or choose a container installation. Then follow a task guide:
The links to files in this repository describe the current source. For an installation, choose a published release and its matching versioned documentation at bifroest.engity.org; the site root describes the current stable release, which may differ from main. Alpha and beta container images use only full version tags such as :1.0.0-beta1; :latest and other moving tags are for stable releases.
OpenSSH migration and security
Replacing an OpenSSH sshd? Use the host installation guide to set up Bifröst, and the configuration reference to select your SSH access policies. For an evaluation, read Choosing Bifröst and Security and trust. Review the upgrade guidance when updating Bifröst; report vulnerabilities through the security policy.
Project
License | Contributing | Code of Conduct | Report an issue | Discussions
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
bifroest
command
|
|
|
build
command
|
|
|
internal
|
|
|
fmtsort
Package fmtsort provides a general stable ordering mechanism for maps, on behalf of the fmt and text/template packages.
|
Package fmtsort provides a general stable ordering mechanism for maps, on behalf of the fmt and text/template packages. |
|
mozilla/certdata
Package certdata parses Mozilla NSS certdata.txt files.
|
Package certdata parses Mozilla NSS certdata.txt files. |
|
text/template
Package template implements data-driven templates for generating textual output.
|
Package template implements data-driven templates for generating textual output. |
|
pkg
|
|
|
windowslocal
Package windowslocal provides read-only access to local Windows SAM users.
|
Package windowslocal provides read-only access to local Windows SAM users. |
|
test
|
|
|
manual/s4u-probe
command
This is a manual, privileged feasibility probe, not part of Bifroest's runtime.
|
This is a manual, privileged feasibility probe, not part of Bifroest's runtime. |