Airlock RBAC lets you define granular permissions for authenticating to Linux servers connected to Airlock.

Example policy: server administrators have access to everything, QA and engineers have full access to staging, and engineers can get temporary access to production in emergencies.

Role configuration

The role resource provides the following controls for restricting server access:

kind: role
version: v5
metadata:
  name: developer
spec:
  allow:
    logins: [ubuntu, debian, '{{internal.logins}}']
    node_labels:
      'env': 'test'
      '*': '*'
      'region': ['eu-central-1', 'eu-west-1']
      'reg': '^eu-central-1|eu-west-1$'
    host_groups: [ubuntu, nginx, other]
    host_sudoers:
    - 'ALL=(ALL) NOPASSWD: ALL'
  deny:
    logins:
    - root

Deny rules take priority. In the example above, any attempt to log in as root will be rejected.

Template variables

Role fields support template variables.

{{external.xyz}} variables are replaced with values from the SSO provider. For OIDC, xyz is a claim; for SAML, it is an assertion.

Example — assigning environments and logins from SAML attributes:

spec:
  allow:
    node_labels:
    - env: '{{external.environments}}'
    logins:
    - '{{external.allowedlogins}}'

The {{internal.logins}} variable applies to local users and trusted clusters. A local user with the trait logins: jeff will receive logins jeff and ubuntu:

spec:
  allow:
    logins: ['{{internal.logins}}', ubuntu]

SSH role options

The options block configures Airlock capabilities for users with the role:

spec:
  options:
    create_host_user_mode: drop
    forward_agent: true
    port_forwarding: true
    ssh_file_copy: false
    client_idle_timeout: never
    disconnect_expired_cert: no
    max_sessions: 10
    enhanced_recording:
    - command
    - disk
    - network
    permit_x11_forwarding: true
    max_connections: 2
    record_session:
      default: best_effort
      ssh: best_effort
    require_session_mfa: true
    pin_source_ip: true
    cert_extensions:
     - type: ssh
       mode: extension
       name: login@example.com
       value: "{{ external.login }}"
OptionDescription
create_host_user_modeAuto-create a user on the host (drop, keep, off)
forward_agentSSH agent forwarding
port_forwardingTCP port forwarding
ssh_file_copySCP/SFTP (default true)
require_session_mfaAdditional MFA when starting a session
pin_source_ipBind the certificate to the login source IP

Example: environment separation

kind: role
version: v5
metadata:
  name: staging-access
spec:
  allow:
    logins: [ubuntu, deploy]
    node_labels:
      'env': 'staging'
  deny:
    node_labels:
      'env': 'prod'

Create and assign:

airctl create -f staging-access.yaml
airctl users update developer --set-roles=access,staging-access

Verifying access

A user can see available servers:

airsh ls

Connect to a server:

airsh ssh user@hostname