Replace static SSH keys with certificate-based authentication, session recording, and fine-grained RBAC. Distributed as a signed binary, not public source. Source-available under our enterprise license for independent audit and scanning.
SSO / OIDC / Certificates
Auth + RBAC + Audit
Reverse Tunnel to Proxy
Linux / Unix Hosts
All SSH connections are authenticated with short-lived certificates, authorized via RBAC, and fully audited. No direct network exposure required.
Certificate-based authentication with session recording and live audit. Eliminate static SSH keys forever.
Short-lived SSH certificates issued per-session. User CA and Host CA managed automatically. No more authorized_keys.
Full terminal capture with video-like playback. Every SSH session is recorded for compliance and audit.
Fine-grained, label-based access control. Deny-overrides-allow semantics. Template variables for teams.
The msh CLI gives you instant SSH access to every node in your infrastructure.
Authenticate once, reach everything.
# Authenticate with your cluster
$ msh login --proxy=access.example.com --user=alice
> Logged in as alice@example.com
> Certificate valid until 2026-03-25 08:00 UTC
# List available nodes
$ msh ls
Node Address Labels
------------- -------------- ----------------
web-prod-01 10.0.1.10 env=prod,app=web
db-replica 10.0.2.20 env=prod,role=db
staging-box 10.0.3.30 env=staging
# Connect to a node
$ msh ssh --login=root web-prod-01
root@web-prod-01:~#Mezite runs entirely on your infrastructure. No SaaS dependency, no data leaving your network, no vendor lock-in. Deploy a single signed binary with SQLite (zero dependencies) or PostgreSQL. That's it.
Pull the signed container image or download the release binary. SQLite built-in, or bring PostgreSQL.
podman login registry.mezite.com
podman pull registry.mezite.com/mezite/mezhub:latest Set your cluster name and start mezhub. CAs are initialized automatically.
export MEZITE_CLUSTER_NAME=access.example.com
mezhub --config=mezite.yaml Install agents on your nodes, log in with msh, and SSH through the proxy.
msh login --proxy=access.example.com
msh ssh --login=root web-prod-01 Run Mezite as a managed instance, license the self-hosted binary, or request enterprise source access for independent review.