---
source_url: "https://p0.dev/resource/just-in-time-ssh-access-to-on-prem-machines/"
title: Just-in-Time SSH access to on-prem machines
mirrored_at: 2026-08-08T15:39:01.443Z
host: p0.dev
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/p0.dev/resource/just-in-time-ssh-access-to-on-prem-machines/index"
---

> **Original source:** https://p0.dev/resource/just-in-time-ssh-access-to-on-prem-machines/

If your on-prem access model still relies on static SSH keys and jump boxes, this video is for you.

This episode of the _Five minutes to zero standing access_ series demonstrates how to bring just-in-time SSH to bare-metal environments-using short-lived certificates, Slack approvals, and session-level revocation.

Most identity and access tools stop at the cloud boundary. But the reality for many organizations is hybrid: VMs, containers, and yes – still some bare-metal machines that run critical services.

In this short demo, you’ll see how P0 makes it easy to enable temporary, certificate-based SSH access to on-prem machines, without hardcoded keys, long-lived users, or manual ticketing.

[image]

## **How it works**

The user authenticates via Okta and logs in through the P0 CLI. Using p0 ls, they view a list of available nodes, filtering down to on-prem machines with the –provider metal flag.

From there, they run p0 ssh. Behind the scenes:

1.  A JIT access request is triggered and sent to approvers via Slack.
2.  On approval, P0 issues a short-lived SSH certificate.
3.  The P0 agent on the server verifies it and grants access.
4.  When the user finishes their session, they relinquish access via Slack, revoking the certificate.

## Why it matters

On-prem systems are often governed by legacy controls – static keys, persistent local users, and outdated jump boxes.

P0 replaces that with:

-   Ephemeral, time-bound access
-   Slack-based approval workflows
-   On-demand revocation tied to session completion
-   Support for hybrid environments without architectural changes

## See for yourself

If you’re still managing on-prem SSH access with static keys or shared users, this demo shows how to bring least privilege and automation to bare-metal systems.

[image]

## Frequently asked questions

### How do you grant just-in-time SSH access to on-prem machines?  

Teams grant just-in-time SSH access to on-prem machines by issuing ephemeral, identity-based credentials for each session instead of standing server access.  

### Why is standing SSH access to on-prem servers a security risk?  

Standing SSH access to on-prem servers is a security risk because it leaves persistent entry points active long after any task is complete.  

### How does keyless, JIT SSH access work for hybrid infrastructure?  

Keyless, JIT SSH access works for hybrid infrastructure by authenticating users through their existing identity and granting time-bound access to both cloud and on-prem servers.  

### How does P0 Security secure auditable SSH access across on-prem and cloud?  

P0 Security secures auditable SSH access across on-prem and cloud by applying the same just-in-time policy and session logging in both environments.