--- title: OpenSSH vs SSH for Servers? | daily.dev description: OpenSSH servers can be configured to trust certificates issued by a Teleport Certificate Authority, but deploying the Teleport Node Service on every server... canonical: https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenSSH vs SSH for Servers? | daily.dev og:description: OpenSSH servers can be configured to trust certificates issued by a Teleport Certificate Authority, but deploying the Teleport Node Service on every server... og:url: https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal og:image: https://api.daily.dev/og/posts/7FRXp0fAl.png og:image:alt: OpenSSH vs SSH for Servers? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenSSH vs SSH for Servers? **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary OpenSSH servers can be configured to trust certificates issued by a Teleport Certificate Authority, but deploying the Teleport Node Service on every server offers additional benefits: automatic server authentication (eliminating trust-on-first-use risks), cluster introspection via periodic pings and dynamic labels, role-based access control encoded in certificate metadata (commercial editions only), and end-to-end encrypted session recording at destination nodes rather than decrypted at a proxy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why would I deploy Teleport's Node Service on every server instead of just configuring OpenSSH to trust the Teleport CA? Deploying Teleport's Node Service on every server adds built-in server authentication, more secure audit and session recording, role-based access control, and cluster introspection. OpenSSH configured to trust a Teleport CA is simpler and a common first step, but it lacks these protections since OpenSSH cannot interpret Teleport's extended certificate attributes used for RBAC. _Comparing SSH access architectures gets easier with peers' write-ups surfaced on daily.dev._ ### How does Teleport avoid the SSH trust-on-first-use host key warning problem? Teleport avoids trust-on-first-use because every node must join the cluster using a cluster join token before any connections are routed to it, and both node and user present certificates signed by the same Teleport CA during login. This removes the need to manually verify unknown host key fingerprints, unlike standard SSH connections to unrecognized hosts. _Engineers hardening SSH access workflows track patterns like this on daily.dev._ ### Where does Teleport perform SSH session recording when only using it as a proxy versus deploying it on every node? When using OpenSSH servers behind a Teleport proxy, session recording requires the proxy to decrypt and re-encrypt every connection, weakening end-to-end encryption. Deploying Teleport on every node moves recording to the destination servers, keeping connections end-to-end encrypted so they remain unreadable even if an attacker gains physical access to the proxy server. _Weighing proxy-based versus node-based session recording tradeoffs is easier with real examples on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments - [SSH certificates and git signing](https://daily.dev/posts/ssh-certificates-and-git-signing-xbor3hzac) · Lobsters · 6 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenSSH vs SSH for Servers?","url":"https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal"},"datePublished":"2026-08-23T12:22:08.688Z","dateModified":"2026-08-23T12:48:16.167Z","description":"OpenSSH servers can be configured to trust certificates issued by a Teleport Certificate Authority, but deploying the Teleport Node Service on every server...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"OpenSSH vs SSH for Servers?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openssh-vs-ssh-for-servers--7frxp0fal#faq","mainEntity":[{"@type":"Question","name":"Why would I deploy Teleport's Node Service on every server instead of just configuring OpenSSH to trust the Teleport CA?","acceptedAnswer":{"@type":"Answer","text":"Deploying Teleport's Node Service on every server adds built-in server authentication, more secure audit and session recording, role-based access control, and cluster introspection. OpenSSH configured to trust a Teleport CA is simpler and a common first step, but it lacks these protections since OpenSSH cannot interpret Teleport's extended certificate attributes used for RBAC. Comparing SSH access architectures gets easier with peers' write-ups surfaced on daily.dev."}},{"@type":"Question","name":"How does Teleport avoid the SSH trust-on-first-use host key warning problem?","acceptedAnswer":{"@type":"Answer","text":"Teleport avoids trust-on-first-use because every node must join the cluster using a cluster join token before any connections are routed to it, and both node and user present certificates signed by the same Teleport CA during login. This removes the need to manually verify unknown host key fingerprints, unlike standard SSH connections to unrecognized hosts. Engineers hardening SSH access workflows track patterns like this on daily.dev."}},{"@type":"Question","name":"Where does Teleport perform SSH session recording when only using it as a proxy versus deploying it on every node?","acceptedAnswer":{"@type":"Answer","text":"When using OpenSSH servers behind a Teleport proxy, session recording requires the proxy to decrypt and re-encrypt every connection, weakening end-to-end encryption. Deploying Teleport on every node moves recording to the destination servers, keeping connections end-to-end encrypted so they remain unreadable even if an attacker gains physical access to the proxy server. Weighing proxy-based versus node-based session recording tradeoffs is easier with real examples on daily.dev."}}]} ```