--- title: Developer Friendly Solid Infrastructure Security | daily.dev description: Argues that overly complex infrastructure security measures backfire by pushing engineers to create insecure workarounds like secret bastion hosts, while... canonical: https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Developer Friendly Solid Infrastructure Security | daily.dev og:description: Argues that overly complex infrastructure security measures backfire by pushing engineers to create insecure workarounds like secret bastion hosts, while... og:url: https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0 og:image: https://api.daily.dev/og/posts/nBnVgfdx0.png og:image:alt: Developer Friendly Solid Infrastructure Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Developer Friendly Solid Infrastructure Security **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary Argues that overly complex infrastructure security measures backfire by pushing engineers to create insecure workarounds like secret bastion hosts, while overly loose security (shared admin.pem keys, former employees retaining access) is equally dangerous. Recommends identity-based access over secret-based access, certificate-based SSH authentication with TTL expiry, using access proxies instead of jump hosts to preserve end-to-end encryption, and automating away the need for manual infrastructure access. References the open source Teleport project as an implementation of these principles. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why should I use an access proxy instead of an SSH jump host? An access proxy preserves end-to-end encryption because you cannot SSH directly into it, unlike a jump host where sessions are decrypted and re-encrypted at each hop. This removes the temptation to overload it with extra duties like build servers, reduces attack surface, and can support multiple protocols such as SSH, Kubernetes API, and HTTP/TLS. _Teams weighing jump hosts against access proxies can compare real-world security trade-offs on daily.dev._ ### Why use SSH certificates instead of SSH keys for infrastructure access? Certificates carry a designated time-to-live so access credentials expire automatically, unlike keys which persist until manually rotated or revoked. Certificates also allow metadata injection, enriching audit logs with details like name, email, and title, and enabling role-based access control similar to X.509 certificates used in HTTP/TLS. _Engineers designing SSH access policies can track certificate-based practices like this on daily.dev._ --- Tags: [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Developer Friendly Solid Infrastructure Security","url":"https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0"},"datePublished":"2026-08-23T12:19:36.319Z","dateModified":"2026-08-23T12:37:11.913Z","description":"Argues that overly complex infrastructure security measures backfire by pushing engineers to create insecure workarounds like secret bastion hosts, while...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ssh","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Developer Friendly Solid Infrastructure Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/developer-friendly-solid-infrastructure-security-nbnvgfdx0#faq","mainEntity":[{"@type":"Question","name":"Why should I use an access proxy instead of an SSH jump host?","acceptedAnswer":{"@type":"Answer","text":"An access proxy preserves end-to-end encryption because you cannot SSH directly into it, unlike a jump host where sessions are decrypted and re-encrypted at each hop. This removes the temptation to overload it with extra duties like build servers, reduces attack surface, and can support multiple protocols such as SSH, Kubernetes API, and HTTP/TLS. Teams weighing jump hosts against access proxies can compare real-world security trade-offs on daily.dev."}},{"@type":"Question","name":"Why use SSH certificates instead of SSH keys for infrastructure access?","acceptedAnswer":{"@type":"Answer","text":"Certificates carry a designated time-to-live so access credentials expire automatically, unlike keys which persist until manually rotated or revoked. Certificates also allow metadata injection, enriching audit logs with details like name, email, and title, and enabling role-based access control similar to X.509 certificates used in HTTP/TLS. Engineers designing SSH access policies can track certificate-based practices like this on daily.dev."}}]} ```