Terminal/Shell

Configure the common bsh settings first. These examples use bsh to provision target access and register it with Bridge. How users connect describes the client connection.

SSH

This example installs a generated key for an existing Unix account. The administrative SSH account must be able to update that account’s authorized keys. Set these permission variables:

BSH_TRANSPORT=ssh
BSH_TARGET_HOST=linux.example.com
BSH_TARGET_PORT=22
BSH_TRANSPORT_USER=britivebroker
BSH_TRANSPORT_KEY_FILE=/run/secrets/ssh-admin-key
BSH_TRANSPORT_SUDO=true
BSH_TARGET_SSH_HOST_KEY=<verified-target-public-host-key>
BSH_USERNAME=ec2-user
BSH_ALLOWED_COMMANDS=ls,cat,grep
BSH_BRIDGE_RECORD_SESSION=true

The host key verifies both bsh’s administrative connection and Bridge’s target connection. Obtain it through a trusted channel.

#!/bin/sh
exec bsh checkout ssh --method existing-user-key --mode bridge

#!/bin/sh
exec bsh checkin ssh --method existing-user-key --mode bridge

Checkin ends the Bridge checkout and removes bsh-managed keys for that user email. It retains the target account. Overlapping checkouts for the same email and account share that cleanup scope. Use ephemeral-key instead if bsh must create the account when it is absent.

Users connect with their separate Bridge password or a platform-supplied public key configured through BSH_BRIDGE_USER_PUBLIC_KEY. The generated target private key stays in Bridge. Both native and browser access are available. See the SSH reference.

Telnet

For Unix-backed Telnet services, bsh can create an account with a generated password. It manages the account over SSH. Set these permission variables:

BSH_TRANSPORT=ssh
BSH_TARGET_HOST=legacy.example.com
BSH_TARGET_PORT=23
BSH_TRANSPORT_PORT=22
BSH_TRANSPORT_USER=britivebroker
BSH_TRANSPORT_KEY_FILE=/run/secrets/ssh-admin-key
BSH_TRANSPORT_SUDO=true
BSH_KNOWN_HOSTS=/etc/britive-broker/known_hosts

#!/bin/sh
exec bsh checkout telnet --method ephemeral-password --mode bridge

#!/bin/sh
exec bsh checkin telnet --method ephemeral-password --mode bridge

Checkin locks the target account by default. bsh returns the generated target password because the user enters it at the Telnet login prompt. The Bridge password authenticates the connection to Bridge separately.

This method requires Unix account tools. For vendor devices, use a custom provisioning script and the checkout API. Both native and browser access are available. See Telnet.

WinRM

This example creates a Windows local account and adds it to Remote Management Users. The administrative connection requires HTTPS and an account allowed to manage local users:

BSH_TARGET_HOST=win-app.example.com
BSH_TARGET_PORT=5986
BSH_TRANSPORT_USER=britivebroker
BSH_TRANSPORT_PASSWORD_FILE=/run/secrets/windows-admin-password
BSH_WINRM_CA_CERT_PATH=/run/certs/windows-ca.pem
BSH_TARGET_TLS=true
BSH_TARGET_CA_CERT=file:///run/certs/windows-ca.pem
BSH_BLOCKED_COMMANDS=Remove-Item
BSH_REDACT_RESPONSE_BODIES=true

#!/bin/sh
exec bsh checkout winrm --method ephemeral-user --mode bridge

#!/bin/sh
exec bsh checkin winrm --method ephemeral-user --mode bridge

bsh selects the WinRM transport automatically. Checkin disables the created account by default. WinRM access is native-only. See the WinRM reference and Windows method settings.