> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH accounts

> Give people shell access to Linux and Unix servers.

An SSH account lets people open a shell on a Linux or Unix server without seeing the server's password or key. They connect in a browser terminal or through the Infisical CLI, and Infisical records each [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview).

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the server on its SSH port

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and an SSH **Account Template**, such as the default `ssh` [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md), then select **Next**.

**Step 3**

Enter a **Name** for the account and the server's connection details:

| Field | Description |
| - | - |
| **Host** | The server's hostname or IP address |
| **Port** | The server's SSH port (defaults to `22`) |
| **Gateway** | The Gateway that connects to the server (only shown if the template doesn't set one) |

**Step 4**

Select an **Auth Method**, enter the **Username** to log in as, and fill in the fields for that [authentication method](#authentication-methods).

**Step 5**

Select **Create**.

## Authentication methods

| Method | What you enter | What the server needs |
| - | - | - |
| **Certificate** | Only the username | To trust the account's certificate authority (CA), as described in [Set up SSH certificate authentication](https://infisical.com/docs/documentation/platform/pam/guides/ssh-certificate-auth.md) |
| **Public Key** | A **Private Key** in OpenSSH format | The matching public key in the user's `~/.ssh/authorized_keys` file |
| **Password** | The user's **Password** | `PasswordAuthentication yes` in `sshd_config` |

Use **Certificate** where you can. Infisical issues a short-lived certificate for each session, so the account stores no password or key that could leak.

## Connect

People can open a terminal in the browser or connect through the CLI. To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

The CLI opens a shell on the server:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

To run one command instead of opening a shell, put the command after `--`:

```bash theme={"dark"}
infisical pam access <folder>/<account> -- systemctl status nginx
```

To use your own SSH client, or to copy files with `scp`, `sftp`, or `rsync`, add `--proxy`. The CLI then starts a local proxy and prints the port to connect to.

## Next steps

> [card] [SSH certificate auth](https://infisical.com/docs/documentation/platform/pam/guides/ssh-certificate-auth.md)
>
> Let people connect to SSH servers with short-lived certificates instead of stored credentials.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.