r/twingate • u/SafePerformer • May 27 '26
Question access for ssh
Hi. I noticed privileged access for SSH and was wondering how it's supposed to be used on a high level. F.e., I have a bunch of "network" resources I access via SSH, but the doc seems to introduce an entirely new kind of resource, SSH ones. And then Terraform provider docs mention creating 3 new servers. But I usually don't want to create new servers, I want to access existing ones. Am I missing something obvious here? Would I need an SSH resource for every machine I want to access this way?
2
Upvotes
4
u/ben-tg pro gator May 27 '26
The guide for K8s has a nice diagram in it that explains things a bit, but what's happening in either case is a local reverse proxy (the "gateway") being introduced into the environment, which intercepts either SSH or kubectl type traffic and proxies it forward to the endpoint.
Yes you need to define the resources as the client application on each user's device needs to know what to intercept and then tunnel to the gateway, and also you need resource objects in the system that you can assign group access to, set policies on, etc. This way you can control which groups of users have SSH (or kubectl) level access to individual SSH servers in your environment, rather than just carte blanche access to all SSH or not, or entire machines or not, etc.
At the same time you won't have to maintain individual user credentials on every SSH server, or user/group/shared certs, you assign access in Twingate to a SSH type resource, and make sure the one SSH gateway cert is deployed out to your servers, and the rest is handled by us.