--- title: SSH using Github team membership via OAuth2 + 2FA description: A walkthrough of replacing shared, static SSH keys with dynamically issued SSH certificates using Teleport, an open source SSH server. Access is tied to Github... canonical: https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH using Github team membership via OAuth2 + 2FA | daily.dev og:description: A walkthrough of replacing shared, static SSH keys with dynamically issued SSH certificates using Teleport, an open source SSH server. Access is tied to Github... og:url: https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd og:image: https://api.daily.dev/og/posts/AMi66cBzd.png og:image:alt: SSH using Github team membership via OAuth2 + 2FA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH using Github team membership via OAuth2 + 2FA **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary A walkthrough of replacing shared, static SSH keys with dynamically issued SSH certificates using Teleport, an open source SSH server. Access is tied to Github team membership via OAuth2, so removing someone from a Github team automatically revokes their SSH access, and certificates expire after a configurable TTL (default 8 hours). Steps cover installing Teleport, creating a Github OAuth app and team, configuring a Github connector, and using tsh login for certificate-based SSH, with notes on OpenSSH compatibility and fallback local auth if Github is unavailable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I use Github team membership to control SSH access instead of managing static SSH keys? Teleport, an open source SSH server, supports Github as an authentication connector starting in version 2.4. Administrators define a Github OAuth app and a github-connector.yaml mapping a Github organization team to server logins; when a user runs tsh login, they authenticate via Github OAuth2 (with 2FA if enabled), and Teleport issues a short-lived SSH certificate only if they belong to the specified team, automatically revoking access when they leave the team. _daily.dev surfaces practical write-ups like this for teams weighing identity-based access over static SSH keys._ ### How long do SSH certificates issued by Teleport via Github authentication last by default? By default, Teleport stores the issued SSH certificate in the user's ~/.tsh directory with a validity of 8 hours, though this TTL is configurable. Once expired, the user must re-authenticate through Github OAuth2 to obtain a new certificate, which limits the exposure window compared to long-lived static SSH keys. _daily.dev helps engineers tracking certificate-based auth patterns like Teleport's short-lived SSH credentials stay informed._ ### What happens if Github is down and I need SSH access managed through Teleport's Github authentication? Teleport allows falling back to local authentication when Github is unavailable by passing the --auth=local flag along with a --user parameter to tsh login, for example using a dedicated admin account like 'github-is-down'. Local authentication is also recommended for issuing certificates to automation and bot accounts that shouldn't depend on Github OAuth. _daily.dev helps infrastructure teams planning fallback auth strategies for tools like Teleport stay prepared._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH using Github team membership via OAuth2 + 2FA","url":"https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd"},"datePublished":"2026-08-23T12:22:07.956Z","dateModified":"2026-08-23T12:50:01.410Z","description":"A walkthrough of replacing shared, static SSH keys with dynamically issued SSH certificates using Teleport, an open source SSH server. Access is tied to Github...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,ssh","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH using Github team membership via OAuth2 + 2FA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-using-github-team-membership-via-oauth2-2fa-ami66cbzd#faq","mainEntity":[{"@type":"Question","name":"How can I use Github team membership to control SSH access instead of managing static SSH keys?","acceptedAnswer":{"@type":"Answer","text":"Teleport, an open source SSH server, supports Github as an authentication connector starting in version 2.4. Administrators define a Github OAuth app and a github-connector.yaml mapping a Github organization team to server logins; when a user runs tsh login, they authenticate via Github OAuth2 (with 2FA if enabled), and Teleport issues a short-lived SSH certificate only if they belong to the specified team, automatically revoking access when they leave the team. daily.dev surfaces practical write-ups like this for teams weighing identity-based access over static SSH keys."}},{"@type":"Question","name":"How long do SSH certificates issued by Teleport via Github authentication last by default?","acceptedAnswer":{"@type":"Answer","text":"By default, Teleport stores the issued SSH certificate in the user's ~/.tsh directory with a validity of 8 hours, though this TTL is configurable. Once expired, the user must re-authenticate through Github OAuth2 to obtain a new certificate, which limits the exposure window compared to long-lived static SSH keys. daily.dev helps engineers tracking certificate-based auth patterns like Teleport's short-lived SSH credentials stay informed."}},{"@type":"Question","name":"What happens if Github is down and I need SSH access managed through Teleport's Github authentication?","acceptedAnswer":{"@type":"Answer","text":"Teleport allows falling back to local authentication when Github is unavailable by passing the --auth=local flag along with a --user parameter to tsh login, for example using a dedicated admin account like 'github-is-down'. Local authentication is also recommended for issuing certificates to automation and bot accounts that shouldn't depend on Github OAuth. daily.dev helps infrastructure teams planning fallback auth strategies for tools like Teleport stay prepared."}}]} ```