4.2. Roles & Functions

Zero Trust is a modern security model based on the principle of “never trust, always verify,” where every access request is continuously authenticated, authorized, and validated — regardless of whether it originates from inside or outside the network perimeter.

Within the Zero Trust architecture of suSSHi, the gateway operates as a dedicated Policy Enforcement Point (PEP). It is responsible for intercepting, validating, and enforcing security controls on every incoming request before access to protected services is granted. This includes authentication, authorization, traffic validation, and policy enforcement at the edge of the system.

suSSHi Chef acts as both the Policy Decision Point (PDP) and the Policy Administration Point (PAP). As the PDP, it continuously evaluates access decisions based on centrally defined security policies, user identity, device posture, contextual information, and risk assessment criteria. This ensures that access decisions remain dynamic, context-aware, and aligned with Zero Trust principles.

In its role as PAP, suSSHi Chef provides centralized policy management capabilities, enabling administrators to define, manage, distribute, and audit security policies consistently across the entire infrastructure from a single control plane.

The clear separation between policy enforcement, policy decision-making, and policy administration enables a scalable, transparent, and centrally governed Zero Trust architecture with distributed enforcement capabilities.

4.2.1. Policy Administration Point

During startup, the suSSHi Gateway establishes a Secure Internal Communication (SIC) channel with suSSHi Chef. This secure management channel is used for centralized configuration management, operational control, and administrative communication between the Policy Enforcement Points (PEPs) and the central control plane.

The SIC mechanism supports several core functions:

  • suSSHi Gateways retrieve their current runtime configuration from suSSHi Chef during initialization and whenever configuration updates are required.

  • suSSHi Chef distributes and triggers the activation of newly generated or updated configurations across connected gateways.

  • suSSHi Chef initiates SSH host key scans through designated suSSHi Gateways to validate and maintain trusted remote host identities.

  • suSSHi Chef collects operational and status information from gateways and can remotely trigger administrative actions such as configuration reloads or controlled shutdown procedures.

By centralizing administrative control and configuration distribution through SIC, suSSHi ensures consistent policy enforcement, secure operational management, and scalable coordination across distributed gateway instances.

4.2.2. Policy Decision Point

For every new SSH session established through a suSSHi Gateway, the gateway communicates with suSSHi Chef during the authentication and authorization phase to retrieve all policy-relevant information required to evaluate the access request.

As the centralized Policy Decision Point (PDP), suSSHi Chef evaluates the session context, where every connection request is explicitly verified before access is granted.

The evaluation includes, but is not limited to, the following checks:

  • Whether the connecting user exists and is authorized within the system.

  • Which authentication methods are permitted for the user and which public keys are registered.

  • Whether the SSH session is allowed from the source IP address of the client.

  • Whether an access policy exists that permits the authenticated gateway user to access the requested target system using the specified target account.

All required authentication, authorization, and policy information is retrieved through a single request between the gateway and suSSHi Chef. This consolidated policy evaluation minimizes latency and enables fast, scalable, and efficient session establishment while maintaining centralized policy enforcement.

4.2.3. Session Management

Active user sessions established through suSSHi Gateways are centrally managed by suSSHi Chef, ensuring continuous, policy-driven supervision and enabling dynamic adjustment or termination of access even after a connection has been established.

Through the suSSHi Chef user interface, authorized administrators can actively terminate ongoing sessions at any time. This capability enables immediate enforcement of security decisions, for example in response to suspicious activity, policy violations, or changes in access requirements.

When a session termination is triggered, suSSHi Chef communicates the command to the corresponding suSSHi Gateway, which enforces the disconnect in real time. This ensures that active connections are reliably and consistently revoked across the infrastructure, maintaining tight operational control over all SSH sessions.

4.2.4. Session Reports

suSSHi Chef collects session information in the form of structured, concise reports that are optimized for efficient search and analysis. These reports provide comprehensive visibility into authentication events, session activities, and access decisions across the entire infrastructure, supporting transparent auditing, continuous operational monitoring, and in-depth security analysis.