Learn
How do you share SSH access without sharing credentials?
The usual way a team shares a server is a private key or a password pasted into chat. From that second, the credential is wherever the chat is, forever, and taking it back is impossible. The alternative is to stop handing out credentials and start handing out access: a wrapped key that can be granted, audited, and revoked. Here is how Termuna's connection vault does it.
Why is credential handoff a dead end?
A pasted credential has no memory and no owner. You cannot list who has it, you cannot tell who used it, and you cannot revoke it short of rotating the credential on every machine that accepts it. Every departure becomes a rotation scramble, or more often, quietly becomes nothing at all, and the ex-teammate keeps working keys. Chat logs, laptop backups, and screenshots all remember what you sent.
What is a connection vault?
A vault is a collection of saved SSH connections, hosts, usernames, keys, and passwords, encrypted on your device before anything is stored. You have a personal vault, and a team can have shared ones. Save a connection once and it follows you to your other machines; put it in a shared vault and teammates get it too. The server that syncs all of this stores ciphertext and never sees a host, a username, a password, or a private key.
How does the cryptography work?
Three layers, each with one job:
- Your account keypair. An X25519 keypair generated on your device. The private half is sealed with a key derived from your encryption passphrase using Argon2id, a deliberately slow, memory-hard function, and that passphrase never leaves your machine.
- The vault key. Each vault has a symmetric key, and every connection in the vault is encrypted with it.
- The wrap. Sharing a vault means wrapping its vault key to each member's public key. To read a shared connection, a teammate unwraps the vault key with their own private key, on their own device.
Granting access is creating one small wrapped blob. No credential moves, no plaintext exists outside member devices, and the server only ever handles ciphertext and public keys.
What happens when someone leaves the team?
Their wrap is deleted, so the vault key no longer reaches their device, and everything synced after that moment is out of their reach. Prudent teams still rotate the underlying server credential for anything the person could have copied while they had access, and the vault turns that rotation from an every-machine scramble into a one-place update that reaches every remaining member automatically. Team roles and the audit log record who was granted what, and when.
What if you forget the encryption passphrase?
The passphrase is the anchor of the whole model, and the server cannot reset it, by design: a server that could recover your passphrase could also read your vault. That is what the recovery kit is for. Termuna generates it when you set the passphrase; store it somewhere offline, and a forgotten passphrase never means a lost vault. No kit and no passphrase means the ciphertext stays ciphertext, for you and for everyone else, which is exactly the guarantee the rest of the system depends on.
What can the sync server see?
- Encrypted vault items and wrapped vault keys.
- Members' public keys and vault membership.
- Never: a host, a username, a password, a private key, or your encryption passphrase.
The same bar as session sync applies: assume the server is compromised, and the attacker should still learn nothing that opens a shell anywhere.