Earlier I wrote , and I’m willing to call the SSH PAM slice stable.
If you bounced on the Alpha install story, start here instead — the 10-minute path got a lot of attention.
The story (why this exists)
A few years of jump boxes taught me the same lesson on every team:
We didn’t need another VPN.
We needed SSH access we could audit — without opening port 22 on every server.
Access control was never the hard part.
Auditability was.
UX was harder.
If requesting temporary access is slower than pasting a key into chat, people paste the key.
So Orion Belt is deliberately narrow:
Teleport-like SSH access control — without opening inbound ports or adopting a large platform.
Not “enterprise-grade revolutionary.” Just a self-hosted gateway that makes the boring path the easy path.
What v1.0 actually ships
Orion Belt is a self-hosted SSH access gateway with PAM workflows:
| Capability | What you get |
|---|---|
| Reverse agents | Targets dial out — no inbound SSH required on hosts for this path |
| Session recording | Cast-style playback in the web console |
| Live watch | Observe an active session when you need eyes-on |
| JIT access | Request → approve → expire (UI / API / ChatOps) |
| MFA | TOTP + WebAuthn for the console; FIDO SSH keys supported |
| Authorization | Built-in ReBAC (+ optional OpenFGA) |
| Optional SSH CA | Short-lived certs when you’re ready — not forced on day one |
| Clients | osh / ocp / oadmin, vanilla OpenSSH, or web terminal |
| Packaging | Docker quickstart + deb/rpm/apk |
Repo:
Discord:
What changed since the Alpha DEV.to post
A few things worth calling out if you read the first article:
v1.0 line — SSH PAM path we’re willing to call stable
Org + docs site —orion-belt-dev,
How it compares (without the marketing fog)
Need
Jump host
Orion Belt
Full platform (e.g. Teleport)
Reach internal SSH
✓
✓
✓
No inbound on targets
✗ / rare
✓ (agents dial out)
✓ / varies
Session recording
DIY
Built-in
Built-in
JIT approvals
✗
Built-in
Built-in
K8s / DB / Windows day one
✗
Not v1
✓
Ops weight
Low features
SSH-focused
Large
Longer write-up:
Lessons that shaped v1
- Access control is easy compared to audit trails people trust
- JIT UX beats a twelfth policy DSL
- Reverse tunnels move risk to the gateway — they don’t delete risk
- Optional complexity (SSH CA, OpenFGA) must stay optional for the first wow
- Protect the 10-minute path like a public API
More:
- Access control is easy compared to audit trails people trust
- Discussions:
- GitHub:
- Blog:
Links
If you tried the Alpha and bounced — try the Docker quickstart once. If it still fails, open an issue with logs. That’s the feedback loop that matters.
SOCIAL SHARE CARD GENERATOR