Airlock RBAC lets you define granular permissions for authenticating to Linux servers connected to Airlock.
Example policy: server administrators have access to everything, QA and engineers have full access to staging, and engineers can get temporary access to production in emergencies.
Role configuration
The role resource provides the following controls for restricting server access:
kind: role
version: v5
metadata:
name: developer
spec:
allow:
logins: [ubuntu, debian, '{{internal.logins}}']
node_labels:
'env': 'test'
'*': '*'
'region': ['eu-central-1', 'eu-west-1']
'reg': '^eu-central-1|eu-west-1$'
host_groups: [ubuntu, nginx, other]
host_sudoers:
- 'ALL=(ALL) NOPASSWD: ALL'
deny:
logins:
- rootDeny rules take priority. In the example above, any attempt to log in as root will be rejected.
Template variables
Role fields support template variables.
{{external.xyz}} variables are replaced with values from the SSO provider. For OIDC, xyz is a claim; for SAML, it is an assertion.
Example — assigning environments and logins from SAML attributes:
spec:
allow:
node_labels:
- env: '{{external.environments}}'
logins:
- '{{external.allowedlogins}}'The {{internal.logins}} variable applies to local users and trusted clusters. A local user with the trait logins: jeff will receive logins jeff and ubuntu:
spec:
allow:
logins: ['{{internal.logins}}', ubuntu]SSH role options
The options block configures Airlock capabilities for users with the role:
spec:
options:
create_host_user_mode: drop
forward_agent: true
port_forwarding: true
ssh_file_copy: false
client_idle_timeout: never
disconnect_expired_cert: no
max_sessions: 10
enhanced_recording:
- command
- disk
- network
permit_x11_forwarding: true
max_connections: 2
record_session:
default: best_effort
ssh: best_effort
require_session_mfa: true
pin_source_ip: true
cert_extensions:
- type: ssh
mode: extension
name: login@example.com
value: "{{ external.login }}"| Option | Description |
|---|---|
create_host_user_mode | Auto-create a user on the host (drop, keep, off) |
forward_agent | SSH agent forwarding |
port_forwarding | TCP port forwarding |
ssh_file_copy | SCP/SFTP (default true) |
require_session_mfa | Additional MFA when starting a session |
pin_source_ip | Bind the certificate to the login source IP |
Example: environment separation
kind: role
version: v5
metadata:
name: staging-access
spec:
allow:
logins: [ubuntu, deploy]
node_labels:
'env': 'staging'
deny:
node_labels:
'env': 'prod'Create and assign:
airctl create -f staging-access.yaml
airctl users update developer --set-roles=access,staging-accessVerifying access
A user can see available servers:
airsh lsConnect to a server:
airsh ssh user@hostname