platform / sessions

Privileged session management

Every SSH and RDP admin session, through one gateway.

Direct connections are refused. Each session through the gateway is verified with MFA, recorded, and can be ended while it runs.

Book a demoWatch a session replay ↓
A direct SSH connection to prod-db-01 is refused. The same admin connects through the AuthNull gateway, approves a push on their phone, and gets a shell. The session is recorded.

What it changes

What it changes

Does
Routes every SSH and RDP admin session through one gateway, verifies it with MFA and records it.
Replaces
The shared jump box and the spreadsheet of who logged in.
Needs
One gateway host. Nothing on servers.

What you get

One path in. Every session on record.

The gateway sits between your admins and your servers. Here’s what each session goes through.

  1. 01

    Gateway-only path

    Direct connections are refused. The same command through the gateway connects.

    # 01j.doe · laptop

    • $ ssh root@prod-db-01
    • Connection refused
    • $ ssh -J gateway.corp j.doe@prod-db-01
    • connected
  2. 02

    MFA on connect

    Each new session asks for a push on the admin’s phone before the shell opens.

    # 02j.doe · laptop

    • $ ssh -J gateway.corp j.doe@prod-db-01
    • push sent to j.doe’s phone…
    • approved
    • j.doe@prod-db-01:~$
  3. 03

    Recording and replay

    Every session is recorded and its commands are indexed, so you can jump to the one that matters.

    # 03replay · session 4f2a

    • 00:04 systemctl status postgresql
    • 00:14 sudo -i
    • 00:21 tail -n 3 /var/log/postgresql/main.log
    • 6 commands indexed · 00:34
  4. 04

    Live termination

    An admin clicks End and the remote session drops at once.

    # 04console · live sessions

    • j.doe → prod-db-01 · 12 min · live
    • ended by m.ross
    • Connection to prod-db-01 closed by remote host.
  5. 05

    RDP through the gateway

    Windows admin sessions take the same path and are recorded the same way.

    # 05rdp · win-app-03Rec

    • j.doe → win-app-03 · RDP
    • push approved
    • connected · recording

Session replay

Replay any session, command by command.

A recorded SSH session on prod-db-01, including a sudo step-up. Play it, scrub it, or jump to a command.

User
j.doe
Server
prod-db-01
Path
gateway.corp
MFA
push · approved
Step-up
sudo · approved
Length
00:36
~/j.doe@prod-db-01 — session 4f2a00:00 / 00:36
  1. [authnull] j.doe → prod-db-01 via gateway.corp
Speed

Sample recording with illustrative users and hosts.

Compliance

A recording for every audit question.

Each session is tied to a person, an MFA result and a replay.

PCI DSS 4.0Req. 8.4MFA for all access into the cardholder data environment.MFA result for every session
PCI DSS 4.0Req. 10Log and monitor all access to system components.Recordings and command index
CMMCAC and AU familiesAccess control, and audit and accountability.Who connected where, and a replay
SOC 2CC6Logical access to systems is restricted and monitored.Gateway-only path and ended sessions

AuthNull supports evidence collection for these controls. It does not certify compliance.

FAQ

FAQ

All questions →
Can admins still SSH directly to a server?

No, once enforcement is on. Direct connections are refused and the gateway is the only path.

Does it work for RDP?

Yes. RDP sessions go through the same gateway, are verified with MFA, and are recorded.

Do I need to install anything on my servers?

No. You run one gateway host. Nothing is installed on the servers behind it.

Put every admin session on record.

We’ll route one of your servers through the gateway and replay the session with you.

Book a walkthrough