GatewayAvailable
Server (Linux) — the broker that issues certs
Documentation
Short-lived SSH certificates — requested by your laptop, approved on your iPhone, signed by a YubiKey-backed CA. Nothing static to steal.
A login runs in seven steps. The OSH client asks the gateway for a certificate. The gateway sends an approval request to the approver phone, which signs it. The gateway passes the signed approval to the CA over a WebSocket the CA opened. The CA checks the approval chain, signs a short-lived SSH certificate with its YubiKey and returns it to the gateway. The gateway returns the certificate to the client, which logs in to the target server. The server trusts the CA public key it was given in advance.
How a login worksBrokered by the Gateway
- Step 1OSH - ClientLaptopAsks the Gateway for a certificate
- Step 2OSH - SigneriPhoneAn approver checks who, where and what — Face ID
- Step 3OSH - CAYubiKeySigns a short-lived certificate (PIV 9c)
- Step 4Target serverAny Linux hostTrusts the CA (TrustedUserCAKeys) — the cert expires in minutes
Download
Pick your role in the system
macOS builds are signed & notarized — open them directly. Always download through a browser to keep the signature intact.
OSH CLITerminal
Just the osh command — servers / headless / scripts (no GUI)
- Ubuntu/Debian · amd64 (Intel/AMD).debDownload
- Ubuntu/Debian · arm64 (ARM).debDownload
- RHEL/Rocky · x86_64 (Intel/AMD).rpmDownload
- RHEL/Rocky · aarch64 (ARM).rpmDownload
- Windows · x64.zipDownload
macOS: osh is already inside the OSH - Client .pkg above.
OSH - CACross-platform
Signs certificates with a YubiKey (PIV slot 9c)
OSH - ClientCross-platform
Workstation — where you run ssh to get a cert
OSH - SignerApp Store
iOS — approves & signs requests (Secure Enclave + Face ID)
Live on the App Store — tap the button, or search “OSH Zero Trust SSH” on your iPhone. No invitation needed.
OSH - Web AdminHosted
Browser — manage signers, servers, groups and rules
Sign in by scanning the code with OSH - Signer. The browser holds no trusted key: every change waits for a Secure Enclave signature from your phone, and the Audit tab records who approved what.
Compatibility
Older versions
Each piece ships on its own cadence and the newest of each always works together — that is what Download above gives you. Pinned to an older build? Open a release below for a set known to work together; every link is live.
Release history
28 Oct 2026Gateway 0.35.1Gateway 0.35.1: root now gets a push when an already-approved computer asks to join another group.
28 Oct 2026Gateway 0.35.0OSH - Client 1.8.0Gateway 0.35.0: one computer can sit in several Groups, each by that Group's own code and admin; users are read-only in a Group; admins can take a computer out of one Group. OSH Client 1.8.0: Add code, the Groups this computer joined, who it is linked to, and a list that stays in sync. iOS 1.0.10 shows the new actions.
27 Oct 2026OSH - CA 1.9.1OSH CA 1.9.1 fixes two things in Settings when two YubiKeys are plugged in: the PIN was refused (Unlock CA said "Apply the selected YubiKey first" with nothing to press), and the page jumped on every repaint (Loading flash, scroll back to the top, empty key list, message over the PIN box). It also lets the CA accept a YubiKey by its key, not its serial number, and adds Unrevoke Selected in Root Certs; 1.9.0 was withdrawn and 1.9.1 replaces it.
27 Oct 2026Gateway 0.34.0Gateway 0.34.0 signs with one CA at a time and moves to another only when the first cannot sign (a dead connection, or a CA that is locked or has no key): a locked CA, or one that lost power, no longer fails a request another CA can sign, and two machines can use the same CA ID. Use it with OSH Client 1.7.0, OSH CA 1.8.2 and osh-cli 0.6.0.
25 Oct 2026Gateway 0.33.0Gateway 0.33.0 moves a gateway to the Group model: on its first start every computer that no Group holds is removed once, each enrols again with a Group's code, and people default to user until they are added to a Group. Fresh installs require a machine code. Use it with OSH Client 1.7.0 and osh-cli 0.6.0.
GatewayLinux server0.33.0
OSH - ClientLaptop1.7.0
OSH - CAYubiKey host1.8.2
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.6.0
Show 53 older releasesHide older releases
24 Oct 2026Gateway 0.32.0Gateway 0.32.0: a computer that joined a Group with its code now sees only the servers its rules reach, and only those in its Group; before it was shown every server of the Group. Use it with OSH Client 1.7.0 and osh-cli 0.6.0.
GatewayLinux server0.32.0
OSH - ClientLaptop1.7.0
OSH - CAYubiKey host1.8.2
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.6.0
24 Oct 2026OSH - Client 1.7.0OSH CLI 0.6.0OSH Client 1.7.0 adds an Invite code field and osh enroll --invite <code>, so a computer joins one Group with a code made by that Group's admin. Needs Gateway 0.31.0 (older gateways ignore the code). osh-cli 0.6.0 carries the same option.
GatewayLinux server0.31.0
OSH - ClientLaptop1.7.0
OSH - CAYubiKey host1.8.2
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.6.0
24 Oct 2026OSH - CA 1.8.2OSH-CA 1.8.2 makes first-time YubiKey setup smoother: changing the key source between File and YubiKey now applies on its own after a confirmation, the setup guide also appears when the YubiKey holds a key OSH - CA cannot use, and a YubiKey you plug in is picked up in a couple of seconds with a short Reading state. Use it with Gateway 0.31.0, OSH Client 1.6.1 and osh-cli 0.5.1.
GatewayLinux server0.31.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.8.2
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
24 Oct 2026Gateway 0.31.0Gateway 0.31.0: a computer joins one Group with its own invite code, optional require_machine_invite, Group admins confirm owners and get the right notifications. Roles come only from Group membership: re-seat admins after upgrading.
GatewayLinux server0.31.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.8.1
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
24 Oct 2026OSH - CA 1.8.1OSH-CA 1.8.1 guides a first-time YubiKey: when a YubiKey is plugged in and has no CA key in any slot the CA allows, Settings shows the steps and a link to the YubiKey setup guide. Nothing changes for a CA that already has a key, or for a file key. Use it with Gateway 0.30.0, OSH Client 1.6.1 and osh-cli 0.5.1.
GatewayLinux server0.30.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.8.1
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
24 Oct 2026OSH - CA 1.8.0OSH-CA 1.8.0 lets you use a key file instead of a YubiKey where a file is required: pick an existing key or create a new one from a system dialog, and the CA reloads by itself. On macOS the Update button now installs the new version itself. Use it with Gateway 0.30.0, OSH Client 1.6.1 and osh-cli 0.5.1.
GatewayLinux server0.30.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.8.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
22 Oct 2026OSH - CA 1.7.0OSH-CA 1.7.0 lets you choose which YubiKey the CA signs with when several are plugged in (with two or more and none chosen, it no longer guesses), and picks up a YubiKey you plug in after the app is open. Use it with Gateway 0.30.0, OSH Client 1.6.1 and osh-cli 0.5.1.
GatewayLinux server0.30.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.7.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
19 Oct 2026Gateway 0.30.0Gateway 0.30.0 lets a super admin or admin approve a new device while the CA is connected, shows on every device whether a CA has checked its certificate, and re-checks Not verified devices by itself and on demand. Pair it with the 1.0.9 iOS app (status badge and Verify again). OSH-CA 1.6.1 was withdrawn; this row lists OSH-CA 1.6.0.
GatewayLinux server0.30.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.6.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
15 Oct 2026OSH - Client 1.6.1OSH - CA 1.6.0OSH CLI 0.5.1OSH-CA 1.6.0 records which approver keys have signed with the v2 approval format and can later be told to stop accepting v1 from them; nothing changes by default. OSH Client 1.6.1 and osh-cli 0.5.1: past the update deadline the app says so in a box, and an unreachable target names the three things to check.
GatewayLinux server0.29.0
OSH - ClientLaptop1.6.1
OSH - CAYubiKey host1.6.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.1
15 Oct 2026Gateway 0.29.0OSH - CA 1.5.0Gateway 0.29.0 and OSH-CA 1.5.0 ship together: approval signatures can bind the exact certificate the CA issues, and the CA signs each request at most once. A rule can no longer name one approver at two steps. Installer fixes.
GatewayLinux server0.29.0
OSH - ClientLaptop1.6.0
OSH - CAYubiKey host1.5.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.0
9 Oct 2026OSH - Client 1.6.0OSH - CA 1.4.0OSH CLI 0.5.0Connecting no longer creates a device key: a machine on a file key keeps its identity when a security chip is added, and osh enroll --force moves the key into the chip. On Windows without a TPM, osh asks for the Windows password in the terminal when you come in over SSH. OSH-CA now refuses an approval that carries no identity cert, so make sure every approver has one before updating the CA.
GatewayLinux server0.28.0
OSH - ClientLaptop1.6.0
OSH - CAYubiKey host1.4.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.5.0
8 Oct 2026Gateway 0.28.0Gateway checks every identity cert with a connected CA before using it, and a revoked approver can no longer come back after a restart. Works with the current CA; certs are checked once the CA advertises identity_cert_validate.
GatewayLinux server0.28.0
OSH - ClientLaptop1.5.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.4.0
7 Oct 2026Gateway 0.27.0Root can require the latest version of both clients in one step: pick 7, 14 or 30 days and sign once. The gateway fills in the newest desktop and CLI release.
GatewayLinux server0.27.0
OSH - ClientLaptop1.5.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.4.0
7 Oct 2026Gateway 0.26.1The minimum version screens now call the desktop client OSH Client Desktop, so it is not mistaken for the CA app.
GatewayLinux server0.26.1
OSH - ClientLaptop1.5.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.4.0
7 Oct 2026OSH - Client 1.5.0OSH CLI 0.4.0The desktop app and the CLI now tell you when your gateway is about to require a newer version, and the Update button installs it: by itself on macOS and Windows, and by downloading and checking the package on Linux. Adds the osh update command.
GatewayLinux server0.26.0
OSH - ClientLaptop1.5.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.4.0
6 Oct 2026Gateway 0.26.0Root can require a minimum version of the OSH desktop app or the osh CLI, with a deadline: older builds are warned first, then refused. Adds the pam-zta-gateway-qr command to print the root-enrollment QR.
GatewayLinux server0.26.0
OSH - ClientLaptop1.4.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.3.0
3 Oct 2026Gateway 0.25.0Admins can see which osh build each machine runs and which machines are behind the newest one on this gateway (shown in the web console and the iOS app once those update). Upgrading adds one column to the device table; downgrading still works.
GatewayLinux server0.25.0
OSH - ClientLaptop1.4.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.3.0
2 Oct 2026OSH - Client 1.4.0OSH CLI 0.3.0OSH Client 1.4.0 and osh-cli 0.3.0 report where the device key is held; Windows trusts a chip-held key and asks for the Windows password otherwise
GatewayLinux server0.24.0
OSH - ClientLaptop1.4.0
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.3.0
2 Oct 2026Gateway 0.24.0The gateway records what holds each enrolled machine's device key (security chip or a file on disk) and shows it to approvers and admins. A machine's first report is kept; re-enrolling cannot change it.
GatewayLinux server0.24.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
28 Sep 2026Gateway 0.23.0Root can now stop phone notifications through Open Layer, or re-apply under another name, from the app — no server access or restart needed. A gateway Open Layer paused or removed now says so instead of waiting forever, and a relay name another gateway already holds is reported right away.
GatewayLinux server0.23.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
25 Sep 2026Gateway 0.22.0Security update: a phone can no longer be impersonated by re-registering its ID with another key, certificate requests are checked against their signature, and the gateway can verify a signature on every app request (off by default until the signing App Signer is released). Recommended for every install.
GatewayLinux server0.22.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
25 Sep 2026Gateway 0.21.3Security update: only admins can change access rules, pairing codes no longer appear in any list, and admins limited to a server group stay inside it. Recommended for every install.
GatewayLinux server0.21.3
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
24 Sep 2026Gateway 0.21.2The ledger check no longer reports tampering on a gateway that has deleted an access rule. Existing ledgers pass again without any migration.
GatewayLinux server0.21.2
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
24 Sep 2026Gateway 0.21.1Telegram is now a notification channel next to Slack and webhooks (bot token and chat ID, with an "Open in OSH app" button). Security fix: a failed delivery no longer records the channel's secret URL in its status.
GatewayLinux server0.21.1
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
24 Sep 2026Gateway 0.21.0Only root can now manage Slack and webhook notification channels, and Slack messages show a short "Open in OSH app" link instead of the full address.
GatewayLinux server0.21.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
23 Sep 2026Gateway 0.20.1Phone alerts in the App Signer now follow Open Layer's approval both ways and refresh at once; Open Layer can remove a disabled relay name so it can register again.
GatewayLinux server0.20.1
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
23 Sep 2026Gateway 0.20.0Root can now turn on phone notifications from the App Signer (Open Layer's push relay), and approval decisions always require a signature.
GatewayLinux server0.20.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
23 Sep 2026Gateway 0.19.2The App Signer can now show whether this gateway makes approvers' phones ring (and how to turn it on), next to its Slack and webhook channels.
GatewayLinux server0.19.2
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
23 Sep 2026Gateway 0.19.1Slack and webhook messages now carry a link that opens the OSH App Signer on the gateway that rang, and admins can add, test and change notification channels from the phone (with the next App Signer update). Phone-signed actions also work on gateways installed without the web console.
GatewayLinux server0.19.1
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
22 Sep 2026Gateway 0.19.0The gateway can ring a Slack channel or your own webhook when an access request is waiting or decided — added and tested from the web-admin Notifications tab, with only a bell and a link leaving the gateway. Relay applications now ring Open Layer within seconds.
GatewayLinux server0.19.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
21 Sep 2026OSH - Client 1.3.5OSH CLI 0.2.7Every gateway error, enrolment included, now names its reason: a mistyped http:// gateway reports status 400: Use HTTPS instead of a bare status or nil.
GatewayLinux server0.18.0
OSH - ClientLaptop1.3.5
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.7
21 Sep 2026Gateway 0.18.0The gateway now records who approved or denied each SSH access in its audit log, approval history shows the full request, and gateways installed with --autocert before 18 Sep no longer fail when upgraded onto the push relay.
GatewayLinux server0.18.0
OSH - ClientLaptop1.3.3
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
21 Sep 2026Gateway 0.17.0A gateway applying to the push relay now rings Open Layer's roots instead of waiting to be noticed, and --autocert checks that the domain and ports can actually work before anything is installed.
GatewayLinux server0.17.0
OSH - ClientLaptop1.3.3
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
18 Sep 2026OSH - Client 1.3.3The desktop client no longer reads a frozen gateway as an empty answer, and the Python client has no built-in gateway address.
GatewayLinux server0.16.0
OSH - ClientLaptop1.3.3
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
18 Sep 2026Gateway 0.16.0Phone notifications now say what they are about. A notice sent through Open Layer's relay carries its detail sealed, so tapping it opens the list that is waiting instead of wherever the app was left — and the relay still cannot read what it forwards.
GatewayLinux server0.16.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
18 Sep 2026Gateway 0.15.0The installer now says whether approvals will reach a phone. A gateway installed without notifications says so in plain words, with the one command that turns them on, instead of finishing quietly with them off.
GatewayLinux server0.15.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
18 Sep 2026Gateway 0.14.0Installing with --autocert alone now prints the root-enrolment QR: the installer fills in the public address from the certificate domain instead of leaving it blank. Upgrading from 0.13.0 leaves gateway.toml untouched.
GatewayLinux server0.14.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
17 Sep 2026Gateway 0.13.0The gateway now tells you when a newer version is out: root and super_admin see it in the OSH app (Admin → Gateway) and in the web console, with the one-line upgrade command. Upgrading from 0.12.0 leaves gateway.toml untouched.
GatewayLinux server0.13.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
17 Sep 2026Gateway 0.12.0Open Layer approves waiting self-hosted gateways from the OSH app. Nothing changes for a gateway that does not set [relay_admin], and 0.11.0 → 0.12.0 leaves your gateway.toml untouched.
GatewayLinux server0.12.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
16 Sep 2026Gateway 0.11.0A self-hosted gateway signs itself up for phone notifications during install (install.sh --push-relay) instead of waiting for a token by email; Open Layer approves the request and the bell starts ringing. Upgrading from 0.10.0 goes through install.sh.
GatewayLinux server0.11.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
16 Sep 2026Gateway 0.10.0Self-hosted gateways can reach a phone for the first time: notifications route through Open Layer's push relay when the install has no Apple key of its own, and the gateway can keep a sealed record of what each one was about that only it can read.
GatewayLinux server0.10.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
11 Sep 2026OSH - Client 1.3.2OSH - CA 1.3.0CA keeps signing after its window closes on macOS, with a menu bar item showing whether it is unlocked; rotating the CA token no longer locks it. The client remembers the gateway URL across restarts.
GatewayLinux server0.9.0
OSH - ClientLaptop1.3.2
OSH - CAYubiKey host1.3.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
31 Jul 2026OSH - CA 1.2.2forgetting the YubiKey no longer keeps the console closed
GatewayLinux server0.9.0
OSH - ClientLaptop1.3.1
OSH - CAYubiKey host1.2.2
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
30 Jul 2026Gateway 0.9.0OSH - Client 1.3.1OSH CLI 0.2.5an opening let in by mistake can be taken back
GatewayLinux server0.9.0
OSH - ClientLaptop1.3.1
OSH - CAYubiKey host1.2.1
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.5
29 Jul 2026Gateway 0.7.0an approver can open the firewall from their phone
GatewayLinux server0.7.0
OSH - ClientLaptop1.3.0
OSH - CAYubiKey host1.2.1
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
29 Jul 2026Gateway 0.6.0OSH - CA 1.2.1machines now record who they belong to
GatewayLinux server0.6.0
OSH - ClientLaptop1.3.0
OSH - CAYubiKey host1.2.1
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
29 Jul 2026Gateway 0.5.1the gateway refuses an admin write that names no signer
GatewayLinux server0.5.1
OSH - ClientLaptop1.3.0
OSH - CAYubiKey host1.2.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
28 Jul 2026Gateway 0.5.0OSH - Client 1.3.0OSH - CA 1.2.0one gateway package that starts, request traces you can follow, both desktop apps on a runtime macOS accepts
GatewayLinux server0.5.0
OSH - ClientLaptop1.3.0
OSH - CAYubiKey host1.2.0
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
27 Jul 2026Gateway 0.4.0per-step approval clocks, signer approval history
GatewayLinux server0.4.0
OSH - ClientLaptop1.2.19
OSH - CAYubiKey host1.1.21
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
24 Jul 2026Gateway 0.3.15OSH - Client 1.2.19OSH - CA 1.1.21OSH CLI 0.2.4CORS for the console header, installer default
GatewayLinux server0.3.15
OSH - ClientLaptop1.2.19
OSH - CAYubiKey host1.1.21
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.4
23 Jul 2026Gateway 0.3.14OSH - Client 1.2.16OSH - CA 1.1.17OSH CLI 0.2.3gateway learns who's calling
GatewayLinux server0.3.14
OSH - ClientLaptop1.2.16
OSH - CAYubiKey host1.1.17
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.3
23 Jul 2026Gateway 0.3.13OSH - Client 1.2.15OSH - CA 1.1.16OSH CLI 0.2.2every component self-reports its version
GatewayLinux server0.3.13
OSH - ClientLaptop1.2.15
OSH - CAYubiKey host1.1.16
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.2
22 Jul 2026First setSQLite single-node baseline
GatewayLinux server0.3.12
OSH - ClientLaptop1.2.14
OSH - CAYubiKey host1.1.15
OSH - SigneriPhoneApp Store
OSH CLIHeadless0.2.1
OSH - Signer is iPhone-only and always the latest App Store build — it can’t be pinned to a past version. Gateway is Linux-only (server); OSH - Client & OSH - CA ship macOS (Apple Silicon), Windows, and Ubuntu amd64.
Install
Get running in a few steps
Four pieces on four machines. The Gateway is a Linux server (the broker); the OSH - Client, OSH - CA & OSH - Signer are cross-platform. Four steps, each command with its own Copy button.
Install the Gateway
One Linux server runs the broker. The installer sets up a SQLite config, generates a CA token and starts the service.
With a domainRecommended
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh -s -- --autocert gw.example.com --autocert-email you@example.comReal TLS, and the only setup where phone approvals can ring. Point the domain's DNS A record at this box first. Ports 80 + 443 must be reachable (80 carries the Let's Encrypt check); the installer stops if the domain does not resolve here or the ports are taken. Phone approvals: add --push-relay "your-company" (HTTPS only — Open Layer approves you before anything is delivered).
No domain — LAN or trial (plain HTTP)
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh -s -- --public-url http://YOUR_SERVER:8443YOUR_SERVER is the address clients reach this box at — its LAN or public IP, not localhost. No TLS, and approvals cannot ring on a phone.
On a cloud VM the installer opens the host firewall but cannot open your provider's security group — allow 80+443 (or 8443) there too, or every client times out while the service still looks healthy.
Scan the root-enroll QR
sudo journalctl -u pam-zta-gateway -o cat --no-pager -n 300-o cat strips the log prefix and -n 300 shows past lines (-f alone tails only 10, cutting the QR). Widen the window if it wraps.
Updating an existing gateway
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo shUpgrades in place — config, CA token, database and keys are kept; the service restarts on the new version.
Turn on phone approvals while upgrading (gateway already on HTTPS):
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh -s -- --push-relay "your-company"Still on plain http://…:8443? The relay refuses http. Move to HTTPS first, keeping your CA token so the CA stays connected:
T=$(sudo sed -n 's/^token *= *"\(.*\)"/\1/p' /etc/pam-zta/gateway.toml | head -1)curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh -s -- --force-config --ca-token "$T" --autocert gw.example.com --autocert-email you@example.com --push-relay "your-company"Rewrites the config (the old one is kept as gateway.toml.bak.*) and changes the gateway address — point every OSH client and phone at https://gw.example.com afterwards.
Manual install from the .deb / .rpm
1. Install — --no-install-recommends keeps PostgreSQL out (SQLite needs no DB server).
sudo apt install --no-install-recommends ./pam-zta-gateway_0.36.0_amd64.debUbuntu / Debian
sudo dnf install --setopt=install_weak_deps=False ./pam-zta-gateway-0.36.0-1.x86_64.rpmRHEL / Rocky / Fedora
2. Point it at SQLite and set a CA token (writes the whole config).
sudo sh -c 'cat > /etc/pam-zta/gateway.toml' <<EOF
[server]
listen_addr = ":8443"
public_url = "http://YOUR_SERVER:8443" # IP or domain clients reach (NOT localhost) — goes into the enroll QR
[ca]
token = "$(openssl rand -hex 32)"
[database]
driver = "sqlite"
path = "/var/lib/pam-zta/gateway.db"
[cert]
ttl = 300
[gateway_key]
key_path = "/var/lib/pam-zta/gateway_key.pem"
EOFsudo chown root:pam-zta /etc/pam-zta/gateway.toml && sudo chmod 640 /etc/pam-zta/gateway.toml3. Start it, then scan the root-enroll QR and hand the CA token to the CA operator.
sudo systemctl enable --now pam-zta-gatewaysudo journalctl -u pam-zta-gateway -o cat --no-pager -n 300grep token /etc/pam-zta/gateway.tomlConnect to it: OSH - Client uses http://SERVER:8443 as its gateway; OSH - CA uses ws://SERVER:8443/v1/ca/ws plus the [ca] token. HA / multi-node? Use PostgreSQL instead of SQLite ([database] host/user/…).
Install the apps
OSH - CA on the machine that holds the YubiKey, OSH - Client on each laptop, OSH - Signer on each approver's iPhone.
macOS
OSH - CA (.dmg): drag to Applications, open, plug the YubiKey, then enter its PIN in Settings → YubiKey. The PIN stays in memory only, so OSH - CA asks for it again after every restart or re-plug. A new YubiKey has no CA key yet: see YubiKey setup.
OSH - Client (OSH-1.8.0-arm64.pkg): double-click to install — notarized, adds the OSH app and the osh command.
osh connect dev@your-serverOr open the OSH app and click Connect. New terminal? Run rehash first.
Windows
Run CA-1.9.1.exe or OSH-1.8.0.exe (code-signed). If SmartScreen still appears — the new certificate is building reputation — choose More info ▸ Run anyway.
Ubuntu / Debian (amd64)
sudo apt install ./CA-1.9.1-amd64.deb # OSH - CA (Operator Console)sudo apt install ./OSH-1.8.0-amd64.deb # OSH - ClientiPhone (OSH - Signer)
1. Get OSH - Zero Trust SSH from the App Store (button above, or search “OSH Zero Trust SSH”).
2. Open OSH, scan the enrollment QR from the Gateway, approve with Face ID.
OSH - CA requires a YubiKey (hardware-only, fail-closed). Pull the YubiKey and signing stops — exactly by zero-trust design.
Trust the CA on each target server
One command from your laptop — curl runs locally and pipes the script over ssh, so the target needs no internet.
curl -fsSL https://osh.openlay.com/downloads/install-pam-zta-ca.sh | ssh ubuntu@YOUR_TARGET 'sudo bash -s BASE64_FROM_GUI'ubuntu@YOUR_TARGET — the ssh login you already use on that server (needs sudo; root@… works too). BASE64_FROM_GUI — OSH - CA ▸ Settings ▸ Export Public Key ▸ Copy, pasted as-is (no ssh-ed25519 prefix).
It installs /etc/ssh/pam-zta-ca.pub and an sshd drop-in, validates (sshd -t), then reloads — no restart, no dropped sessions, authorized_keys untouched, safe to re-run. Expect trustedusercakeys /etc/ssh/pam-zta-ca.pub, the CA fingerprint (match it in the GUI) and INSTALL_OK.
To log in, the cert user must exist on the target (e.g.
ubuntu) and match an access rule — and port 22 must be reachable.Examples: a real key, two YubiKeys, undo
Server 203.0.113.10, you normally ssh in as root, key copied from the GUI:
curl -fsSL https://osh.openlay.com/downloads/install-pam-zta-ca.sh | ssh root@203.0.113.10 'sudo bash -s AAAAC3NzaC1lZDI1NTE5AAAAIG43Man3DUHiddGccOJM897B/BaSm3tgSh09z3blL/hz'Two CA YubiKeys for redundancy (either one signs)? Pass both keys — the target trusts both:
curl -fsSL https://osh.openlay.com/downloads/install-pam-zta-ca.sh | ssh root@203.0.113.10 'sudo bash -s BASE64_CA1 BASE64_CA2'Undo:
sudo rm -f /etc/ssh/sshd_config.d/50-pam-zta.conf /etc/ssh/pam-zta-ca.pub && sudo systemctl reload sshEnroll once, then connect
First time on a gateway, register this laptop; an admin approves it once in the App Signer.
export OSH_GATEWAY=https://your-gateway:8443Add to ~/.bashrc to skip --gateway every time.
osh enrollRegisters this device.
osh statusOptional: expect status:ok, ca_connected:true.
Log in — one command
osh root@10.0.0.5Short for osh connect root@10.0.0.5. The login user must match an access rule (e.g. root — not just any name).
- 1osh asks the Gateway for a certificate for root@10.0.0.5
- 2Your iPhone buzzes — review who, where, what — Approve with Face ID
- 3The CA (YubiKey) signs a short-lived cert — you land in the SSH session
The session is recorded to ~/.osh/sessions/; the cert expires in minutes, so nothing static is left behind.
| 401 | Device not enrolled on this gateway — re-run osh enroll |
|---|---|
| 403 | Device not approved yet, or the login user doesn't match a rule |