Native SSH: Authorization Code Flow, Reverse Tunnels & Jump-Host Mode

Pomerium's Native SSH Access takes a major step forward in v0.32.0. SSH logins now use the standard OAuth Authorization Code flow instead of the Device Code flow, the login experience is smoother end to end, and a new set of capabilities — reverse tunneling, jump-host mode, an interactive routes portal, and per-key session revocation — make identity-aware SSH practical to run at scale.

Highlights:

• Authorization Code OAuth flow – SSH authentication now uses the Authorization Code grant rather than Device Code. The result is a faster, more familiar browser login, with telemetry signals throughout the flow so you can observe and debug it. (Note: upstream IdPs must have the Authorization Code grant enabled; v0.31.x and earlier used Device Code.)

• Reverse tunneling – Reach SSH servers that can't accept inbound connections. Upstream hosts dial out to Pomerium and register themselves, and Pomerium routes authorized sessions back over that tunnel — ideal for edge devices, NAT'd networks, and isolated environments. Enabled with the ssh_upstream_tunnel runtime flag.

• Jump-host (ProxyJump) mode – Let clients connect straight through Pomerium to the upstream while Pomerium still enforces policy on the connection. Upstream servers don't need to trust Pomerium's User CA in this mode. Enabled with the ssh_allow_direct_tcpip runtime flag.

• Interactive routes portal – SSH to Pomerium without naming a route and get an interactive picker of the destinations you're allowed to reach, then connect with one selection. Enabled with the ssh_routes_portal runtime flag.

• Per-key session management & revocation – Each SSH key is bound to an OAuth user, and bindings can be listed and revoked from the Pomerium UI at any time. Cached credentials honor your session lifetime, and policy is still evaluated on every connection.

• SSH upstream policy support – Apply Pomerium policy to upstream SSH tunnels, with fixes for several edge cases uncovered along the way.

See the Native SSH Access and Reverse Tunneling docs to get started.