Ratel Node#
An agent on your hosts. Ratel Node runs as a service on a Linux, macOS or Windows host and carries out your Burrow's work there, starting with SSH trust for your certificate authorities. Add a node on the new Nodes tab, then download ratel-node onto the host, install its service and paste the one-time token when it asks.
Approve new nodes. Node tokens expire like machine invitations, and with Require machine & node approval on, a new node waits for a member to approve it.
Every node at a glance. Each node's row shows its host, operating system and when it was last seen, and a dot after its name shows whether it's connected. Point at the dot for the details of a problem.
Manage nodes. Approve, rename, disable, enable or remove a node from its row menu, or open its audit trail. A removed node takes what your Burrow put on its host back off.
Certificate authorities#
SSH certificate authorities in your Burrow. The new Certificate authorities tab runs CAs that sign SSH user certificates. Their signing keys are made and kept in your Burrow, sealed under your master key.
Choose the hosts that trust each one. Attach a CA to nodes and their hosts trust it, alongside any CA they trust already. Detach it and it comes off again. SSH trust is set up on Linux hosts with OpenSSH.
Key rotation. Rotate a CA's signing key by hand or every so many days. Your hosts trust the new key before it signs anything, so certificates keep working through a rotation. Replace key now swaps a key you believe is compromised at once.
Restore a deleted CA. A deleted CA can be restored for 7 to 30 days.
Details. A CA's details show its keys, its rotation, the hosts that trust it and where each one stands, and the secrets that issue from it.
Dynamic secrets#
SSH logins for your machines. A new provider, SSH user, issues short-lived SSH certificates from one of your CAs, for the logins, source addresses, forced command and session options you set, each lasting 1 minute to 24 hours. A Host tells machines where to connect.
One command, then plain ssh. ratel cert get myapp/prod/DEPLOY_SSH fetches a certificate for the machine, and ssh deploy@host logs in. It takes CLI 1.7.0.
Revoked automatically. A machine's certificates are revoked when it's removed, loses access to the environment or, by default, is disabled, and when the secret is deleted or its certificate settings change. Ratel Node ends SSH sessions still open with a revoked certificate.
See and revoke certificates. Certificates in the secret's row menu lists each certificate out, with its machine, logins and expiry, and revokes any of them at once.
Sign-in#
Require a second factor. Settings → Sign-in requires members to sign in with a second factor. Choose Any 2FA, or the factors that count: an authenticator app, any passkey, device-bound passkeys only or security keys only.
Takes effect at once. Before you save, it shows how many sessions it will sign out and which members have no accepted factor yet. A member who's refused is asked for an accepted factor on RatelKey's sign-in page and carries on into the Burrow.
2FA on the Members page. Each member shows a 2FA or No 2FA tag.
Roles#
New permissions. Nodes, Certificate authorities and Sign-in each have their own permission in the role editor. The built-in Administrator role has Nodes and Certificate authorities, and Developer can read and write certificate authorities.
Machines#
Pick the URL. Add machine, New machine token and Add node have one URL dropdown with your Burrow's addresses, and the command or token reaches your Burrow at the one you pick.
Custom domains. Enter an address of your own, such as a tunnel's, and it's saved for next time. An OIDC machine's Audience dropdown offers it too.
Dashboard#
Tooltips in the dashboard's style. Tooltips across the dashboard match its menus.
Webhook logos. Each webhook on the Webhooks page shows its integration's logo, with Signed, Discord or Slack under its name.
Settings icons. Each Settings section has its own icon.
Fixes#
Copying an invitation again. A pending machine invitation copied from its row keeps its Encrypted + verified check. Invitations made before this update can't be copied again, and work until they expire.
Turning off your authenticator app. When it can't be turned off, the dashboard shows why.
Learn more in the docs: Nodes, Ratel Node, Certificate authorities, Dynamic secrets and Sign-in.