Skip to content

[Access] Add FIDO2 as MFA type for Infrastructure SSH Applications #32176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
waltja wants to merge 1 commit into
base: production
Choose a base branch
from
Draft

[Access] Add FIDO2 as MFA type for Infrastructure SSH Applications #32176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions src/content/changelog/cloudflare-one/2026-07-20-fido2-keys-infrastructure-ssh.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
title: FIDO2 Key support for infrastructure SSH applications
description: Access supports FIDO2 Keys for independent MFA on infrastructure SSH applications.
date: 2026-07-20
products:
- cloudflare-one
- access
---

[Access for Infrastructure](/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) SSH applications support independent multi-factor authentication (MFA) with FIDO2 Keys. You can allow `ssh_fido2_key`, `piv_key`, or both in application-level and policy-level MFA settings.

Users enroll FIDO2 Keys through the App Launcher and connect with the generated SSH identity. FIDO2 Keys for SSH are separate from browser-based WebAuthn **Security keys** and Personal Identity Verification (PIV) keys.

For setup instructions, refer to [Enroll a FIDO2 Key for infrastructure apps](/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-fido2-key-for-infrastructure-apps) and [Configure MFA for infrastructure applications](/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications).
80 changes: 61 additions & 19 deletions ...content/docs/cloudflare-one/access-controls/access-settings/independent-mfa.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,13 @@ Because you can [configure MFA at the application and policy level](/cloudflare-

## Supported MFA methods

| MFA method | Description |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authenticator application | Time-based one-time passwords (TOTP) generated by apps such as Google Authenticator, Microsoft Authenticator, or Authy. Access supports one TOTP authenticator per user at a time. |
| Security key | Hardware security keys that support the [WebAuthn](https://www.w3.org/TR/webauthn-2/) standard. Users can enroll multiple security keys. |
| Biometrics | Built-in device authenticators that use [WebAuthn](https://www.w3.org/TR/webauthn-2/), including Apple Touch ID, Apple Face ID, and Windows Hello. Users can enroll multiple biometrics. |
| MFA method | Description |
| ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authenticator application | Time-based one-time passwords (TOTP) generated by apps such as Google Authenticator, Microsoft Authenticator, or Authy. Access supports one TOTP authenticator per user at a time. |
| Security key | Hardware security keys that support the [WebAuthn](https://www.w3.org/TR/webauthn-2/) standard. Users can enroll multiple security keys. |
| Biometrics | Built-in device authenticators that use [WebAuthn](https://www.w3.org/TR/webauthn-2/), including Apple Touch ID, Apple Face ID, and Windows Hello. Users can enroll multiple biometrics. |
| Personal Identity Verification (PIV) key (infrastructure apps only) | YubiKey PIV keys used for public key authentication during SSH connections. Requires YubiKey firmware 4.3 or later. This method is only available for [infrastructure applications](/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/). Users can enroll multiple PIV keys. |
| FIDO2 Key (infrastructure apps only) | FIDO2 hardware keys used for public key authentication during SSH connections. This method is separate from PIV keys and the browser-based WebAuthn **Security key** method. |

## Turn on independent MFA

Expand Down Expand Up @@ -73,6 +74,7 @@ Before you can [enforce independent MFA on applications and policies](/cloudflar
- `biometrics` — Biometrics (Touch ID, Face ID, Windows Hello).
- `security_key` — Security keys (hardware keys that support WebAuthn).
- `piv_key` — PIV keys (YubiKeys).
- `ssh_fido2_key` — FIDO2 keys for SSH connections to infrastructure applications.

Set `session_duration` to a duration string (for example, `30m`, `1h`, `24h`). To require MFA on every access, use `0m`.

Expand All @@ -89,25 +91,29 @@ If you plan to use PIV keys for [MFA for infrastructure applications](/cloudflar
2. Under **Allow multi-factor authentication (MFA)**, turn on the "Personal Identity Verification (PIV) key" authenticator.
3. Configure the following settings:

| Setting | Description | Options |
| ----------------- | ---------------------------------------------- | --------------------------------------------------------------- |
| **Key type** | The SSH key algorithm | ECDSA, Ed25519, RSA |
| **Key size** | The key length in bits | ECDSA: 256, 384, 521. RSA: 2048, 3072, 4096 |
| **PIN policy** | When the user must enter their PIV PIN | `never`, `once` (once per session), `always` (every use) |
| **Touch policy** | When the user must touch the hardware key | `never`, `always` (every use), `cached` (cached for 15 seconds) |
| **Require FIPS** | Require the PIV key to be on a FIPS-validated device | `true`, `false` |
| Setting | Description | Options |
| ---------------- | ---------------------------------------------------- | --------------------------------------------------------------- |
| **Key type** | The SSH key algorithm | ECDSA, Ed25519, RSA |
| **Key size** | The key length in bits | ECDSA: 256, 384, 521. RSA: 2048, 3072, 4096 |
| **PIN policy** | When the user must enter their PIV PIN | `never`, `once` (once per session), `always` (every use) |
| **Touch policy** | When the user must touch the hardware key | `never`, `always` (every use), `cached` (cached for 15 seconds) |
| **Require FIPS** | Require the PIV key to be on a FIPS-validated device | `true`, `false` |

4. Select **Save**.

:::note
<Render file="access/piv-key-global-settings-warning" product="cloudflare-one" />

<Render
file="access/piv-key-global-settings-warning"
product="cloudflare-one"
/>
:::

## Restrict authenticators by AAGUID

An [AAGUID](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#authenticator-attestation-guid) (Authenticator Attestation GUID) is a 128-bit identifier that indicates the make and model of a [WebAuthn](https://www.w3.org/TR/webauthn-2/) authenticator. By restricting enrollment to a specific set of AAGUIDs, you can require that users only enroll approved hardware, such as FIPS-validated security keys or company-issued devices.
An [AAGUID](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#authenticator-attestation-guid) (Authenticator Attestation GUID) is a 128-bit identifier that indicates an authenticator model. Use `required_aaguids` to restrict AAGUID-bearing MFA devices to approved authenticator models.

AAGUID restrictions apply at enrollment time only. Access verifies the AAGUID when a user registers an authenticator, not when they authenticate. As a result, AAGUID restrictions are configured at the organization level.
Access enforces the restriction during device enrollment and when a FIDO2 SSH key connects. PIV keys are not subject to AAGUID restrictions. When `required_aaguids` is unset, Access does not enforce AAGUID restrictions.

:::caution
Some authenticators do not send an AAGUID during WebAuthn registration, such as YubiKey 4 and earlier models using U2F (CTAP1). Users cannot enroll these authenticators when AAGUID restrictions are turned on. Before turning on AAGUID restrictions, confirm that your required authenticators are in the [FIDO Alliance Metadata Service](https://fidoalliance.org/metadata/).
Expand Down Expand Up @@ -171,7 +177,7 @@ You can look up AAGUIDs for common authenticators in the [FIDO Alliance Metadata
3. Select an existing [AAGUID list](#1-create-an-aaguid-list).
4. Select **Save**.

After you save, only authenticators whose AAGUIDs appear in the list can be enrolled. Users with previously enrolled authenticators outside the list can continue to use them until they are [deleted by an administrator](#delete-a-user-authenticator).
After you save, only matching Security keys and FIDO2 SSH keys can enroll. Matching FIDO2 SSH keys are also required when connecting. To remove the restriction, unset the AAGUID list.

</TabItem>
<TabItem label="API">
Expand Down Expand Up @@ -200,7 +206,7 @@ After you save, only authenticators whose AAGUIDs appear in the list can be enro
code={{ mark: ["required_aaguids"] }}
/>

To remove the restriction, set `required_aaguids` to `null`.
To remove the restriction, omit or unset `required_aaguids`.

</TabItem>
</Tabs>
Expand All @@ -215,8 +221,8 @@ If your identity provider already prompts users for MFA, you can configure Acces

### Supported AMR values

| AMR value | Matches Access authenticator type | Description |
| --------- | --------------------------------- | -------------------------------------- |
| AMR value | Matches Access authenticator type | Description |
| --------- | --------------------------------- | ------------------------------------- |
| `hwk` | Security key | Proof-of-possession of a hardware key |
| `swk` | Security key | Proof-of-possession of a software key |
| `otp` | Authenticator application | One-time password |
Expand Down Expand Up @@ -376,8 +382,44 @@ To enroll an authenticator:
PIV key enrollment requires additional client-side setup and is only used for [MFA with infrastructure applications](/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications). For full instructions, refer to [Enroll a PIV key for infrastructure apps](#enroll-a-piv-key-for-infrastructure-apps).
</Details>

<Details header="FIDO2 Key (infrastructure applications only)">
FIDO2 Key enrollment creates an SSH key for infrastructure applications. This method differs from browser-based WebAuthn **Security key** enrollment and PIV key enrollment. For instructions, refer to [Enroll a FIDO2 Key for infrastructure apps](#enroll-a-fido2-key-for-infrastructure-apps).
</Details>

You can now use these authenticators to log in to your organization's applications.

### Enroll a FIDO2 key for infrastructure apps

The App Launcher generates the enrollment command for your account. Do not construct the enrollment command manually.

1. Go to your organization's App Launcher at `<your-team-name>.cloudflareaccess.com`.
2. Log in with your identity provider or a one-time PIN (OTP).
3. Go to **Account** > **MFA devices** > **Add an MFA device** > **FIDO2 Key**.
4. Copy the enrollment command shown in the App Launcher.
5. Run the command in a local terminal on the device you use for SSH.
6. Follow the prompts, then copy the JSON output.
7. Return to the App Launcher and paste the JSON into the enrollment field.
8. Complete the enrollment.

#### Configure your SSH client for a FIDO2 key

The command creates the identity at `~/.ssh/id_ed25519_sk_cf`.

Add the following configuration to your `~/.ssh/config` file:

```txt
Host *
IdentityFile ~/.ssh/id_ed25519_sk_cf
```

Alternatively, supply the identity when you connect:

```sh
ssh -i ~/.ssh/id_ed25519_sk_cf <username>@<target IP>
```

For more information on how OpenSSH uses FIDO2 hardware keys, refer to Yubico's [Securing SSH with FIDO2](https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html).

### Enroll a PIV key for infrastructure apps

PIV key enrollment is separate from the general authenticator enrollment above and requires additional client-side setup.
Expand Down
14 changes: 9 additions & 5 deletions ...cs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@ title: Add an infrastructure application
sidebar:
order: 2
tags:
- SSH
- Authentication
- SSH
- Authentication
---

import { Badge, Details, Tabs, TabItem, Render } from "~/components";

<Details header="Feature availability">

| [Client modes](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| <ul><li> Traffic and DNS mode</li><li> Traffic only mode </li></ul> | All plans |
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| <ul><li> Traffic and DNS mode</li><li> Traffic only mode </li></ul> | All plans |

| System | Availability |
| -------- | ------------ |
Expand Down Expand Up @@ -63,7 +63,9 @@ Access for Infrastructure currently supports [SSH](/cloudflare-one/networks/conn

## 4. (Optional) Require independent MFA

You can require users to authenticate with a [YubiKey PIV key](/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-piv-key-for-infrastructure-apps) before connecting with SSH to targets. You can configure MFA at the application level or at the policy level, allowing you to enforce stricter requirements for sensitive usernames.
You can require independent MFA before users connect with SSH. The application configuration selects the supported infrastructure authenticators: PIV key (`piv_key`), FIDO2 Key (`ssh_fido2_key`), or both.

Application-level settings define the default authenticators and session duration. A policy can define custom settings for specific users or usernames.

For setup instructions, refer to [Enforce MFA for infrastructure applications](/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications).

Expand All @@ -73,6 +75,8 @@ Certain protocols require configuring the server to trust connections through Ac

- [SSH](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#7-configure-ssh-server)

For SSH, this includes trusting the Cloudflare SSH CA and, if your server restricts certificate principals, [authorizing the SSH usernames](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#authorize-the-certificate-principal) you configured on the target.

## 6. Connect as a user

Users connect to the target's IP address using their preferred client software. The user must be logged into the Cloudflare One Client on their device, but no other system configuration is required. You can optionally configure a [private DNS resolver](/cloudflare-one/traffic-policies/resolver-policies/) to allow connections to the target's private hostname.
Expand Down
Loading