🖥️SSH

How to request SSH permissions for AWS, Microsoft Azure and GCP instances.

This topic describes how to request SSH permissions for Amazon Web Services (AWS), Microsoft Azure (Azure) and Google Cloud Platform (GCP) instances. P0 SSH provides full SSH functionality, enabling you to securely manage and configure remote servers.

Windows Support: P0 SSH now supports Windows machines for both Azure Bastion and self-hosted environments. See the platform-specific notes in the following sections for Windows requirements.

This guide contains the following sections:

1. Prerequisites

2. (Azure Only) Install Azure Bastion host Integration

3. Install the P0 CLI Package

4. Install the P0 SSH Integration in your Cloud

5. Configure Accounts

Prerequisites

• Existing P0 account at p0.app

• Standard terminal application that supports SSH (e.g., Terminal, Command Prompt, PowerShell, or Bash)

• Node.js version 20 or later

Installing Node.js automatically installs npm and npx on your computer.

• AWS, Azure, and/or GCP account with admin access, where your target instances are hosted

• P0 IAM integrations installed for AWS, Azure, and/or GCP

• (For AWS) Existing Okta and/or AWS Identity Center account and an associated P0 directory integration

These instructions use Okta to manage user access and permissions.

(Azure Only) Install Azure Bastion host Integration

For Azure SSH via Bastion, refer to the Microsoft Azure integration guide for detailed setup instructions.

Azure VM Requirements

Before accessing Azure VMs via P0, ensure they meet the following requirements:

Requirement	Details
AADSSHLoginForLinux Extension	Must be installed on each Linux VM. VMs without this extension don't appear in P0's inventory. See Microsoft's documentation for installation instructions.
Network Connectivity	VMs must be in a virtual network that's either in the same virtual network as the Bastion host, or in a peered virtual network connected to the Bastion's virtual network.

P0 automatically manages virtual network peering when the VM and Bastion host are in different virtual networks. However, the peering requires both networks to be in subscriptions where P0 has IAM Management installed.

Windows Support for Azure Bastion

P0 CLI supports SSH tunnels to Windows machines via Azure Bastion.

Windows Requirement: Windows users must install ncat (from the Nmap suite) instead of the standard nc (netcat) utility, which isn't available on Windows.

You can download Nmap (which includes ncat) from: https://nmap.org/download.html

Install the P0 CLI Package

You must install the P0 CLI package on your computer before you request permissions using SSH:

1. Open your computer's terminal.

2. Navigate to the directory where you'll install the P0 CLI using the following command:

cd <path/to/my/directory>

Ensure you replace <path/to/my/directory> with your specific directory path.

1. Install the P0 CLI package:

• (Recommended) Run the following command to globally install the P0 CLI package:

npm i -g @p0security/cli

• Alternatively, use npx to run the P0 CLI without installing it:

npx p0 ssh private-node --provider gcloud

Install the P0 SSH Integration in your Cloud

To configure for Microsoft Azure, follow configuring SSH access control (via Bastion)

1. Go to p0.app in your browser. Select Integrations, then under the Resources section, click SSH.

   
2. From the list of Available components, click SSH access control.

   
3. Click + Add account.

   
4. From the Account identifier dropdown, select your AWS account, Azure subscription, or GCP project, then click Next.

Ensure your AWS, Azure or GCP account is connected to P0 and the required integrations are installed. Without this setup no accounts will appear in the Account identifier dropdown.

1. Review the configuration and click Next. For AWS, you add Regions and VPC IDs (optionally, Instance IDs). For GCP, you add GCP project ID, Zone and instance name.

1. (Optional) Enter a Grouping tag to group similar instances. Grouping is supported for both AWS and GCP accounts.

• AWS: Set a grouping tag to group instances that share the same AWS tag value. You can use the grouping tag as the <instance-name> when you Configure an AWS Account.

• GCP: Set a grouping tag to group instances by Google Cloud labels. If no matching GCP resource tag is found, P0 falls back to instance labels whose key matches the grouping tag. For example, if your grouping tag is my-project/environment, P0 groups instances by the environment label.

• Once the P0 CLI is installed, you can use the command p0 request ssh group --name <value> to combine instances that share the same group value.

1. Click Finish to complete the SSH permissions request.

   

Configure Accounts

AWS, Azure, and GCP accounts require different configuration processes. Choose the configuration instructions you need:

• Configure an AWS account for SSH

• Configure an Azure subscription for SSH

• GCP project requirements and Configure a GCP project for SSH

Configure an AWS Account

1. From the p0.app site, navigate to the SSH access control page, and copy the shell commands displayed.

Keep this browser tab open. You will come back to this page in later steps.

1. Open a new browser tab and log into your AWS Management Console.

2. Once logged in, on the navigation bar, click CloudShell.

Alternatively, you can use the search bar to type CloudShell and select it from the results.

1. AWS CloudShell will open in the console's bottom panel.

1. Paste the commands from the SSH access control page into AWS CloudShell, and run them. This creates an AWS Systems Manager (SSM) document, which enables P0 to provision sudo access, create a user directory, and configure authorized keys for user authentication.

1. Return to the browser tab for the p0.app SSH access control page, click Next, and wait for P0 to configure the account.

1. Click Finish to complete the configuration.

1. The account now appears on the SSH access control page.

1. In your terminal, run the following command to log into your P0 organization using Okta:

p0 login <your-p0-organization-name>

Replace <your-p0-organization-name> with your P0 organization name. You can find your organization name in the p0.app URL (e.g. https://p0.app/o/your-p0-organization-name).

1. In the Okta window that displays, enter your activation code and click Next.

1. Return to your terminal and use the following command to request SSH access to your AWS instance or P0 grouping tag:

p0 ssh <instance-name>

• Replace <instance-name> with the name of the AWS instance or a P0 grouping tag from Request AWS or GCP SSH Permissions. If you have multiple AWS instances with the same name, you may need to use the --parent <account_id> flag within the command.

• Direct ssh access is not supported. While direct ssh may work, use p0 ssh to ensure security controls and compliance.

1. Wait for P0 to complete access provisioning. Your terminal displays the status of your request, and indicates whether it was approved or denied.

1. After SSH access is approved, you can run P0 AWS commands. For example, you can make an access request, or use the following command to list available SSH session destinations:

p0 ls ssh session destination

Congratulations! You're now set up with SSH for P0 on AWS

GCP Project Requirements

P0 connects to GCP instances through an Identity-Aware Proxy (IAP) tunnel and authenticates you with OS Login. Before you configure GCP SSH, ensure your project meets the following requirements. If these are not in place, onboarding completes successfully, but the SSH connection fails.

Requirement	Details
Identity-Aware Proxy (IAP) API	Enable the IAP API (iap.googleapis.com) in the GCP project. P0 reaches instances through an IAP TCP tunnel on port 22 using gcloud compute start-iap-tunnel. See Enabling IAP for TCP forwarding.
OS Login	Enable OS Login at the project or instance level by setting the enable-oslogin metadata key to TRUE. P0 grants the roles/compute.osLogin role (or roles/compute.osAdminLogin for sudo access) to authenticate you to the instance. See Set up OS Login.
IAP firewall ingress rule	Allow ingress TCP traffic on port 22 from the IAP source range 35.235.240.0/20. See Create a firewall rule.

If OS Login is disabled at both the project and instance level, P0 still provisions the access request, but the p0 ssh connection fails. The connection appears broken even though the access grant succeeded. Verify OS Login is enabled before you onboard a project.

Configure a GCP Project

1. To display the GCP instances (previously set up for SSH access in Request AWS or GCP SSH Permissions), run the following command in your terminal:

p0 ls ssh session destination --provider gcloud

1. Copy the name of the GCP instance you want to access from the resulting list. In the following example, private-node is the GCP instance name.

1. In your terminal, run the following command to request SSH access to your GCP instance:

p0 ssh <instance-name> --provider gcloud 

Replace <instance-name> with the name of the GCP instance, identified in the previous step. If you have multiple GCP instances with the same name, you may need to use the --parent <account_id> flag within the command.

1. Your terminal displays a message with the wait time for access approval. A subsequent message confirms whether the access request is approved or denied.

1. After SSH access is approved, you can run P0 GCP commands. For example, you can make an access request or use the following command to list available SSH session destinations:

p0 ls ssh session destination

Congratulations! You're now set up with SSH for P0 on Google Cloud.

(Optional) Update Your SSH Configuration for p0 ssh

To integrate p0 ssh with your native SSH setup, you must update your SSH configuration file. Follow these steps:

1. Open your SSH configuration file using a text editor of your choice. The SSH Configuration file is typically located at ~/.ssh/config.

2. Append the following lines to your SSH configuration file.

Match exec "p0 ssh-resolve %h"
 Include ~/.p0/ssh/configs/*.config

The line Match exec "p0 ssh-resolve %h -q" ensures that p0 ssh resolves the hostname dynamically, before making a connection. A hostname will resolve if the following conditions are met:

1. The user is logged into the P0 CLI tool using p0 login your-org-id.

2. The user has been granted access to the host or the user is eligible for access.

   Note: Eligibility is defined as having a workflow that grants always allowed access to a node or pre-approved access through a group request.

The line Include ~/.p0/ssh/configs/*.config loads additional configuration files from ~/.p0/ssh/configs/, which enables p0 ssh to manage custom settings.

1. To verify that p0 ssh is working correctly with your new set up, run ssh your-hostname. If everything is configured properly, ssh will connect to the host machine.

Other tools may use SSH under the hood. A notable example is git. If you see spurious output from the P0 CLI when running git pull, update your SSH config directive to exclude the github.com host:

Match host !github.com exec "p0 ssh-resolve %h"
 Include ~/.p0/ssh/configs/*.config

You can also add multiple exclusions with wildcards. Exclude all .com and .org host names from P0:

Match host !*.com host !*.org exec "p0 ssh-resolve %h"
 Include ~/.p0/ssh/configs/*.config

Multi-organization SSH access

If you belong to multiple P0 organizations, you can configure host-pattern-based routing so that SSH connections in any shell resolve against the correct P0 organization automatically.

This works by setting the P0_ORG environment variable in your Match exec directive. When P0_ORG is set, p0 ssh-resolve passes an --org flag to the generated ProxyCommand, ensuring the SSH proxy authenticates against the right organization.

1. Log in to each organization

P0_ORG=org-one p0 login
P0_ORG=org-two p0 login

2. Add host-pattern rules to ~/.ssh/config

Create a Match block for each organization, matching on a host pattern that identifies instances in that organization:

Match host *org-one* exec "P0_ORG=org-one p0 ssh-resolve %h"
 Include ~/.p0/ssh/configs/*.config

Match host *org-two* exec "P0_ORG=org-two p0 ssh-resolve %h"
 Include ~/.p0/ssh/configs/*.config

Replace *org-one* and *org-two* with patterns that match your instance names (for example, *prod1*, *staging*).

3. Connect

ssh my-instance-org-one

SSH matches the hostname against the patterns, runs p0 ssh-resolve with the correct P0_ORG, and connects through the appropriate organization.

Each Match exec directive runs in its own process, so the P0_ORG value set in one block does not affect other blocks. This makes it safe to define multiple organization patterns in the same SSH configuration file.