Orion Belt

Orion Belt is an open-source SSH access gateway you run yourself. An agent on each server connects out to the gateway, so your servers keep every inbound port closed. Everyone reaches them through the gateway, which checks who may log in, can ask a teammate for approval, and records the session.

Try it in 10 minutes  |  Documentation  |  Discord  |  Star on GitHub

A good fit if you run Linux servers, want recorded and approved SSH access, and would rather not adopt a large zero-trust platform or open SSH to the internet on every host.

Not yet if you need OIDC single sign-on, RDP, Kubernetes or database proxying today. Those are on the roadmap, and early operators decide what comes first.

You need Docker: Docker Desktop on macOS and Windows, or Docker Engine with the Compose plugin on Linux. The script generates its own secrets, starts a gateway, connects a demo machine and prints a sign-in link.

git clone https://github.com/orion-belt-dev/orion-belt.git
cd orion-belt
./scripts/docker-quickstart.sh

1. Open Machines, choose lab-1 and run a few commands in the web terminal.
2. Open Sessions and play back what you just did.
3. From your own terminal: ./bin/osh -c client.yaml root@lab-1

Stop it with ./scripts/docker-quickstart.sh --down.

The quickest way is the installer. It picks the right package for your distribution, can install PostgreSQL for you, writes /etc/orion-belt/server.yaml, starts the service and creates the first admin.

curl -fsSL https://raw.githubusercontent.com/orion-belt-dev/orion-belt/master/scripts/install-server.sh | sudo bash

To install the packages yourself, pick your system below. Every release has packages for amd64 and arm64. There is no APT or DNF repository yet, so you download the package and install the file.

VER=$(curl -fsSL https://orion-belt-dev.github.io/packages/VERSION)
ARCH=$(dpkg --print-architecture)
curl -fLO "https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER/orion-belt_${VER}_linux_${ARCH}.deb"
sudo apt install "./orion-belt_${VER}_linux_${ARCH}.deb"

VER=$(curl -fsSL https://orion-belt-dev.github.io/packages/VERSION)
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -fLO "https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER/orion-belt_${VER}_linux_${ARCH}.rpm"
sudo dnf install "./orion-belt_${VER}_linux_${ARCH}.rpm"

VER=$(curl -fsSL https://orion-belt-dev.github.io/packages/VERSION)
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -fLO "https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER/orion-belt_${VER}_linux_${ARCH}.apk"
sudo apk add --allow-untrusted "./orion-belt_${VER}_linux_${ARCH}.apk"

git clone https://github.com/orion-belt-dev/orion-belt.git
cd orion-belt/packaging/arch
makepkg -si   # set pkgver to the release you want first

B="https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER"
curl -fLO "$B/checksums.txt" -fLO "$B/checksums.txt.sig"
curl -fsSL https://raw.githubusercontent.com/orion-belt-dev/orion-belt/master/packaging/keys/orion-belt.asc | gpg --import
gpg --verify checksums.txt.sig checksums.txt
sha256sum --ignore-missing -c checksums.txt

Then configure and start the gateway (systemd):

sudoedit /etc/orion-belt/server.yaml        # database URL, JWT secret, server.public_url
sudo systemctl enable --now orion-belt-server
sudo -u orionbelt orion-belt-server -c /etc/orion-belt/server.yaml setup   # creates the first admin

Add your servers. In the console, open Add agent and choose Generate install script. Run the script on the server: it installs orion-belt-agent, writes its config and starts it. The agent connects out to the gateway on port 2222, so the server needs no inbound rule. To do it by hand, see Add agents.

You don't need them: any OpenSSH client works, including the one built into Windows 10 and 11. osh, ocp and oadmin add sign-in, file copy, access requests and admin commands.

curl -fLO "https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER/orion-belt-tools_${VER}_linux_${ARCH}.deb"
sudo apt install "./orion-belt-tools_${VER}_linux_${ARCH}.deb"   # or the .rpm / .apk file

VER=$(curl -fsSL https://orion-belt-dev.github.io/packages/VERSION)
ARCH=$(uname -m | sed 's/x86_64/amd64/')
curl -fL "https://github.com/orion-belt-dev/orion-belt/releases/download/v$VER/orion-belt_tools_${VER}_darwin_${ARCH}.tar.gz" | tar xz osh ocp oadmin
sudo mv osh ocp oadmin /usr/local/bin/

The gateway listens for SSH on port 2222. These examples use orion.example.com as the gateway and web-01 as a server.

# Open a shell on web-01 with plain OpenSSH, as gateway user alice
ssh -p 2222 alice+web-01@orion.example.com

# Run one command on web-01 as the remote user bob
ssh -p 2222 'alice+bob%web-01@orion.example.com' uptime

# Sign in once with osh; it reads the gateway from ~/.orion-belt/client.yaml
osh login
osh web-01

# Copy a file to and from web-01
ocp ./app.conf web-01:/etc/app/app.conf
ocp web-01:/var/log/app.log ./

# No access to db-01? Ask for one hour, with a reason
osh --request-access db-01 --reason "Rotate the TLS certificate" --duration 3600

# Operators: review and approve requests (also possible from the console or chat)
oadmin requests list
oadmin requests approve <request-id>

# Give alice standing access to web-01
oadmin permissions grant --user alice --machine web-01

More in the client CLI reference and OpenSSH guide.

• Agents that connect out over reverse SSH, packaged for deb, rpm and apk.
• Session recording with playback, live watch and optional encryption at rest.
• Just-in-time access: request, approve, and the grant expires on its own. Approve from the console, the API, or Slack, Discord, Teams and Rocket.Chat.
• MFA with TOTP and WebAuthn, and FIDO sk-* SSH keys.
• Per-machine permissions down to the remote user, with optional OpenFGA.
• Optional SSH certificate authority for short-lived certificates instead of long-lived keys.
• Operations: Prometheus metrics, OpenTelemetry traces, audit reports as PDF or CSV, an OpenAPI spec, and SDKs for Go, Python, JavaScript and .NET.

We're looking for early operators: people running Orion Belt in a lab or a small team who will tell us what broke and what's missing. Your setup notes shape the roadmap.

• Running it? Tell us how it went in Discussions or on Discord.
• Want to write code? Start with a good first issue or a small task, then read the contributing guide.
• Know the area? Open work is grouped by label: protocols, policy, compliance and plugins and SDKs.
• Found a security issue? Please report it privately through GitHub security advisories, not in a public issue.

Apache 2.0 with the Commons Clause. You can self-host and use Orion Belt inside your company, including commercially, and change it as you like. You can't sell Orion Belt itself, or a hosted service built mainly on it. Read the license.

_{Security infrastructure should be self-hosted, auditable, and boring to operate.  orion-belt.dev}