If your on-prem access model still relies on static SSH keys and jump boxes, this video is for you.
This episode of the Five minutes to zero standing access series demonstrates how to bring just-in-time SSH to bare-metal environments-using short-lived certificates, Slack approvals, and session-level revocation.
Most identity and access tools stop at the cloud boundary. But the reality for many organizations is hybrid: VMs, containers, and yes – still some bare-metal machines that run critical services.
In this short demo, you’ll see how P0 makes it easy to enable temporary, certificate-based SSH access to on-prem machines, without hardcoded keys, long-lived users, or manual ticketing.
How it works
The user authenticates via Okta and logs in through the P0 CLI. Using p0 ls, they view a list of available nodes, filtering down to on-prem machines with the –provider metal flag.
From there, they run p0 ssh. Behind the scenes:
- A JIT access request is triggered and sent to approvers via Slack.
- On approval, P0 issues a short-lived SSH certificate.
- The P0 agent on the server verifies it and grants access.
- When the user finishes their session, they relinquish access via Slack, revoking the certificate.
Why it matters
On-prem systems are often governed by legacy controls – static keys, persistent local users, and outdated jump boxes.
P0 replaces that with:
- Ephemeral, time-bound access
- Slack-based approval workflows
- On-demand revocation tied to session completion
- Support for hybrid environments without architectural changes
See for yourself
If you’re still managing on-prem SSH access with static keys or shared users, this demo shows how to bring least privilege and automation to bare-metal systems.
Frequently asked questions
How do you grant just-in-time SSH access to on-prem machines?
Teams grant just-in-time SSH access to on-prem machines by issuing ephemeral, identity-based credentials for each session instead of standing server access.
Why is standing SSH access to on-prem servers a security risk?
Standing SSH access to on-prem servers is a security risk because it leaves persistent entry points active long after any task is complete.
How does keyless, JIT SSH access work for hybrid infrastructure?
Keyless, JIT SSH access works for hybrid infrastructure by authenticating users through their existing identity and granting time-bound access to both cloud and on-prem servers.
How does P0 Security secure auditable SSH access across on-prem and cloud?
P0 Security secures auditable SSH access across on-prem and cloud by applying the same just-in-time policy and session logging in both environments.