Engity's Bifröst

Bifröst is a configurable SSH server and gateway for teams managing access to hosts and isolated work environments. Flows combine authorization with where a session runs. Users connect with a standard SSH client; OIDC Device Authorization also requires a browser and a suitable identity provider.

Features

• Standard SSH clients: Connect using OpenSSH, PuTTY or another regular SSH client without installing a Bifröst-specific client.
• Flexible authorization: Choose local accounts, SSH keys or OIDC Device Authorization through configurable access flows.
• Host and container sessions: Work as a local user, in a Docker container or in a Kubernetes Pod; optionally provision and clean up managed local accounts.
• SSH gateway: Reach private SSH servers through a separately authenticated connection with target host-key verification.
• Audit and recording: Optionally write signed audit events and verifiable terminal recordings.
• Time-bound access: OIDC can close Bifröst connections after a refresh grant is rejected. Set connection and session lifetimes to support off-boarding targets such as 15 or 60 minutes, and test the result against your IdP and requirements.

Get started

Install Bifröst on Linux, Windows or macOS as a host service, or choose a container installation. Then follow a task guide:

• OIDC login with a standard SSH client
• SSH gateway to an OpenSSH server
• Verifiable session recording

The links to files in this repository describe the current source. For an installation, choose a published release and its matching versioned documentation at bifroest.engity.org; the site root describes the current stable release, which may differ from main. Alpha and beta container images use only full version tags such as :1.0.0-beta1; :latest and other moving tags are for stable releases.

OpenSSH migration and security

Replacing an OpenSSH sshd? Use the host installation guide to set up Bifröst, and the configuration reference to select your SSH access policies. For an evaluation, read Choosing Bifröst and Security and trust. Review the upgrade guidance when updating Bifröst; report vulnerabilities through the security policy.

Project

License | Contributing | Code of Conduct | Report an issue | Discussions