The nk CLI automates the client side of certificate-based SSH. A server still needs to trust the CA, present a host certificate, map certificate principals to Linux usernames, and receive access policy updates.
nokkud automates that server-side work by running its own embedded SSH server that replaces sshd for Nokku access.
Without the daemon
Manual setup requires an administrator to:
- Install the SSH CA public key.
- Configure
TrustedUserCAKeys. - Configure
AuthorizedPrincipalsFile. - Write and update one principal file per Linux username.
- Configure host certificates and verification separately.
This is covered in Manual SSH Setup.
With the daemon
The daemon:
- Enrolls the server with a workspace using an enrollment token.
- Generates and owns its SSH host key and receives signed host certificates.
- Synchronizes target metadata and principal assignments.
- Serves an embedded SSH server that authenticates users with short-lived SSH certificates and checks principals against its local cache.
- Runs sessions as the target Linux user and records/audits them.
- Maintains an outbound control stream to receive updates.
The target must expose the daemon’s SSH port (4022 by default) to its users.
Why it is a separate process
The core cannot serve SSH on a server, and the CLI runs on the user’s workstation, not on the target. The daemon is the small trusted component that owns the server-side SSH endpoint, applies core policy locally, and integrates with the operating system’s user database.
What it does not mean
The daemon does not make an SSH connection a core-proxied connection. nk opens the target TCP connection directly to the daemon’s embedded SSH server. The core is not on the data path.
The daemon also handles browser terminal sessions streamed over the control stream, in addition to plain ssh.