# Question using SSH in OpenZiti

**URL:** <https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893>\
**Category:** General Questions\
**Created:** [June 12, 2026, 5:59pm UTC](https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893 "2026-06-12T17:59:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MacFee](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@MacFee](https://openziti.discourse.group/u/MacFee)\
**Post date:** [June 12, 2026, 5:59pm UTC](https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893/1 "2026-06-12T17:59:02Z")

</div>

When adding ssh into OpenZiti, I am confused on ways to ssh into our servers. Here are some that I have read:

1. Utilize [zssh](https://github.com/openziti-test-kitchen/zssh) when accessing servers. I read this blog post here: [https://blog.openziti.io/zitifying-ssh](https://blog.openziti.io/zitifying-ssh)
2. [Utilize a tunnel](https://netfoundry.io/docs/openziti/how-to-guides/topologies/services/#34-set-up-tunneled-ssh-connection). Once setup, how would the ssh keys be utilized?

Is it possible to add our ssh keys in Ziti's Controller which correlates to the host/intercept when setting up the ssh connection?

---

<div class="post-metadata">

**Author:** ![emoscardini](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/emoscardini/32/753_2.png) [@emoscardini](https://openziti.discourse.group/u/emoscardini)\
**Post date:** [June 12, 2026, 8:11pm UTC](https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893/2 "2026-06-12T20:11:23Z")

</div>

Hi @MacFee

When utilizing zssh or tunneling, OpenZiti is only handling the network connectivity portion of SSH. The SSH protocol itself (user authentication, authorized\_keys, certificates, etc.) remains unchanged.

In both cases, SSH keys are not managed by OpenZiti. Users still authenticate to the target system using whatever SSH authentication method the server is configured for (public/private keys, SSH certificates, passwords, LDAP, etc.).

So from the SSH server's perspective, it is simply receiving a normal SSH connection that happens to be transported over OpenZiti instead of a traditional TCP/IP network.

If you'd like OpenZiti to participate in the SSH authentication and identity management process as well, take a look at this discussion:

> [@Zssh - SSH Identity Management Through OpenZiti](https://openziti.discourse.group/t/zssh-ssh-identity-management-through-openziti/5842/2):
>
> Hi @dmuensterer You've got really good timing! This is exactly the problem we've been working on. We just open-sourced ziti-ssh ([https://github.com/netfoundry/ziti-ssh](https://github.com/netfoundry/ziti-ssh)), which implements Approach A & a bit more. How it works Four binaries: ziti-ssh-ca — a CA service that runs as a ziti service (not a new controller endpoint). Authorized identities connect to it, send their SSH public key, and get back a short-lived signed certificate. It uses the controller's own intermediate CA private …