Warden

Infrastructure access

Reach everything.
Keep no standing secrets.

Warden replaces VPNs, bastions, shared SSH keys and static database credentials with short-lived certificates tied to who you are. Self-hosted, with the identity provider you already run.

Install How it works 
$ warden login
opening your identity provider…
✓ signed in as ada@example.com

$ warden ssh acme/db-1
✓ allowed by role dba
✓ certificate issued for this session only
✓ recorded and audited

ada@db-1:~$

Every static secret is a standing risk

Keys that never expire

A shared SSH key or a database password is copied the day it is created and rotated never. Whoever holds it today can use it tomorrow.

Networks, not people

A VPN or a bastion answers “which network are you on”. When something goes wrong nobody can say who actually did what.

Offboarding by hope

Someone leaves and their access lives on in authorized_keys files, kubeconfigs and connection strings nobody lists.

How it works

Access that exists only while it is needed

  1. You sign in

    With the identity provider you already have: OIDC, SAML or your directory. Warden never becomes another place to keep passwords.

  2. Policy decides

    Roles match resources by label. Deny wins. A role can demand a second factor from a paired device, or a time-boxed approval from a colleague.

  3. A certificate is minted

    Short-lived, bound to you and to that one resource. There is no key to copy, and nothing to rotate or revoke afterwards.

  4. You are connected

    Through a tunnel the resource itself opened outward. Nothing on the other side listens for inbound connections.

What it reaches

One way in, whatever you are connecting to

SSH

Servers with a Warden agent, or ordinary OpenSSH hosts through a bastion that verifies the host certificate. No agent on the target, no trust on first use.

Kubernetes

Works against any cluster, managed ones included, by impersonation. Interactive exec and attach sessions can be recorded.

Databases

PostgreSQL with every statement audited before it runs, plus MySQL, SQL Server and Oracle. Your database tools connect to a local port unchanged.

Remote desktop

Windows machines through the RDP client you already use, with optional recording that you can scrub through afterwards.

Web apps

Internal tools reached from the browser on a host of their own, behind your sign-in. No client to install, no VPN to join.

Machines and CI

A pipeline gets the same short-lived certificates a person does. With GitHub Actions or GitLab it can hold no Warden credential at all.

Audit

An answer to “who did what”

Tamper-evident audit log

Every decision joins a hash chain. One command re-checks it and exits non-zero if a single row was altered, so it can run from cron.

Session recordings

Terminal sessions replay at the speed they happened. Recordings go to a bucket you own, and are fetched back with the same permissions that made them.

Your SIEM, your retention

Forward the trail to syslog or a webhook. Nothing is ever deleted unless you asked for a retention period.

Umbrella

One door across organisations

Clusters join into a tree of up to three levels: a provider, its customers, and their own sub-organisations. An administrator at the top can reach a node deep below it, and the session is recorded where it happens and audited at the top.

  • Every level decides for itself which roles it grants. Trust is per hop, never inherited.
  • A child joins by consent and can be cut off on the very next request.
  • Built for managed service providers and for groups that must keep their companies separate.
A provider cluster at the top, a customer cluster below it, a sub-organisation below that Providerlevel 0 Customerlevel 1 · its own policy Sub-organisationlevel 2 · its own policy sessions recorded at the node, audited at the top

Self-hosted

It runs where your data already is

  • Runs on Kubernetes (Helm) or on one VM with Docker Compose. The same binary either way.
  • You bring the identity provider. Recordings, the database and the certificate authorities stay in your infrastructure.
  • Licensing works offline. A problem with a licence never cuts off access someone already has.

Install

Try the client

With Homebrew on macOS or Linux. The command line is the same on both; the desktop app is for macOS on Apple Silicon.

Command line
brew install magicorntech/warden/warden-cli
macOS app
brew install --cask magicorntech/warden/warden

The client talks to a Warden cluster that someone runs for you, or that you run yourself.