Your Machine Linux Server
┌─────────────────┐ ┌──────────────────┐
│ prmana-agent │ SSH │ pam_prmana.so │
│ (OIDC + DPoP) │ ──────────────▶ │ (validate + bind)│
└─────────────────┘ └──────────────────┘ │ │ ▼ ▼ Your IdP JWKS verification (Keycloak/Okta/ + DPoP proof check Azure AD/Auth0) + replay protection
Your Machine Linux Server
┌─────────────────┐ ┌──────────────────┐
│ prmana-agent │ SSH │ pam_prmana.so │
│ (OIDC + DPoP) │ ──────────────▶ │ (validate + bind)│
└─────────────────┘ └──────────────────┘ │ │ ▼ ▼ Your IdP JWKS verification (Keycloak/Okta/ + DPoP proof check Azure AD/Auth0) + replay protection
Your Machine Linux Server
┌─────────────────┐ ┌──────────────────┐
│ prmana-agent │ SSH │ pam_prmana.so │
│ (OIDC + DPoP) │ ──────────────▶ │ (validate + bind)│
└─────────────────┘ └──────────────────┘ │ │ ▼ ▼ Your IdP JWKS verification (Keycloak/Okta/ + DPoP proof check Azure AD/Auth0) + replay protection
{ "sub": "alice", "iss": "https://idp.company.com", "cnf": { "jkt": "NKnABZgU1F7M5JW5uFrETiYx..." }
}
{ "sub": "alice", "iss": "https://idp.company.com", "cnf": { "jkt": "NKnABZgU1F7M5JW5uFrETiYx..." }
}
{ "sub": "alice", "iss": "https://idp.company.com", "cnf": { "jkt": "NKnABZgU1F7M5JW5uFrETiYx..." }
}
prmana-agent login --signer yubikey:9a
# touch the key when it blinks, then SSH normally
ssh server.example.com
prmana-agent login --signer yubikey:9a
# touch the key when it blinks, then SSH normally
ssh server.example.com
prmana-agent login --signer yubikey:9a
# touch the key when it blinks, then SSH normally
ssh server.example.com
git clone https://github.com/prodnull/prmana.git
cd prmana && cargo build --workspace # Install PAM module
sudo cp target/release/libpam_prmana.so /lib/security/pam_prmana.so # Point to your IdP
sudo mkdir -p /etc/prmana
cat << 'EOF' | sudo tee /etc/prmana/policy.yaml
issuers: - url: https://your-idp.com/realms/your-realm client_id: prmana audiences: ["prmana"]
break_glass: enabled: true users: ["emergency-admin"]
EOF # Login and SSH
prmana-agent login --issuer https://your-idp.com/realms/your-realm
ssh user@server
git clone https://github.com/prodnull/prmana.git
cd prmana && cargo build --workspace # Install PAM module
sudo cp target/release/libpam_prmana.so /lib/security/pam_prmana.so # Point to your IdP
sudo mkdir -p /etc/prmana
cat << 'EOF' | sudo tee /etc/prmana/policy.yaml
issuers: - url: https://your-idp.com/realms/your-realm client_id: prmana audiences: ["prmana"]
break_glass: enabled: true users: ["emergency-admin"]
EOF # Login and SSH
prmana-agent login --issuer https://your-idp.com/realms/your-realm
ssh user@server
git clone https://github.com/prodnull/prmana.git
cd prmana && cargo build --workspace # Install PAM module
sudo cp target/release/libpam_prmana.so /lib/security/pam_prmana.so # Point to your IdP
sudo mkdir -p /etc/prmana
cat << 'EOF' | sudo tee /etc/prmana/policy.yaml
issuers: - url: https://your-idp.com/realms/your-realm client_id: prmana audiences: ["prmana"]
break_glass: enabled: true users: ["emergency-admin"]
EOF # Login and SSH
prmana-agent login --issuer https://your-idp.com/realms/your-realm
ssh user@server - Access platforms — proxy or gateway in front of everything
- SSH certificate authorities — new CA infrastructure to operate
- PAM/OIDC modules — SSO but still bearer tokens (interceptable) - The agent gets a short-lived token from your identity provider
- It generates a DPoP proof — a signed JWT proving you hold the private key
- On SSH, the server's PAM module validates the token, checks expiry, verifies DPoP binding
- If it all checks out and the username maps to a local account, you're in - YubiKey — PKCS#11 via PIV slot
- TPM 2.0 — platform TPM on Linux - Security review — it's a PAM module. Poke holes.
- IdP testing — tested against Keycloak, Auth0, Google, Entra ID. If yours does something unexpected with DPoP or device flow, we want to know.
- Platform testing — Ubuntu 22.04/24.04 primary. RHEL, Rocky, Debian reports welcome.
