Nokku is an access management system for SSH servers and X.509 workloads. It provides a control plane for identities, targets, access assignments, and certificate authorities.
The Nokku core is the control plane and API. The nk CLI runs on a user’s workstation. The nokkud daemon runs on a server when you want Nokku to serve its SSH access with an embedded, certificate-authenticated SSH server.
The main concepts
- Workspace: a security boundary containing targets, members, teams, service accounts, and certificate authorities.
- Target: a server or other resource registered in a workspace.
- Principal: a Linux username on a target, such as
rootorubuntu. - Certificate authority: a workspace authority used to sign SSH or X.509 certificates.
- Subject: a user, team, or service account that can be assigned to a principal.
The normal setup
- Create a workspace and its default SSH certificate authority.
- Install
nkon your workstation and sign in. - Register a target, usually by enrolling
nokkudon the server. - Assign a user, team, or service account to a principal.
- Run
sshnormally.nkobtains an SSH user certificate and connects to the target.
The daemon is optional. In manual mode, you configure the system sshd and maintain the authorized-principal files yourself. The daemon runs its own embedded SSH server and automates server enrollment, host certificates, and principal synchronization.
SSH and X.509
SSH certificates are for OpenSSH user and host authentication. X.509 certificates are for TLS clients and servers, including mTLS and other applications that consume a PKI certificate.
Both authority types can exist in a workspace. They are separate certificate formats and are used by different clients.
Start here
- Quickstart - Set up one workstation and one server.
- Architecture - See how the components communicate.
- Why certificates? - Understand the access model.
- SSH in plain English - A beginner-friendly primer, no prior knowledge needed.
- Glossary - Definitions of the terms used across these docs.