Tracing commands on an encrypted channel
SSH remains the standard tool for remote machine administration, and it is a major step up from protocols like telnet thanks to encrypted traffic and per-user access controls. But SSH also carries risk: root-level access can be catastrophic in the wrong hands, and the encryption that protects sessions also makes activity difficult to audit. Logging user actions over SSH has traditionally forced a choice between custom development and restrictive agent deployments on every host.
Closing the visibility gap
Most organizations approach SSH security with strong authentication—often certificate-based—and tight restrictions on root access, further guarded by VPNs and IP allow lists. Those measures leave two problems unsolved: visibility and lateral movement.
Traffic between a client and an SSH server is end-to-end encrypted, so admins cannot observe the commands a user is executing. Logs exist only on the machine itself, and a malicious user can delete those files as easily as any other. Shipping logs to an external service means installing extra software on every reachable host. Deployments built around ProxyJump make this worse: once a user lands on any machine inside a network, they can hop to others without leaving an auditable trail at the network layer.
SSH inspection in Zero Trust
Cloudflare has added SSH command logging to its Zero Trust platform, moving oversight from host-level agents to the network edge. The feature builds on the existing Secure Web Gateway, which already performs TLS inspection on user traffic. With the extension, the gateway bootstraps a proxy server on new SSH connections, and administrators can set network policies to permit SSH access and log the commands being run.
Once an SSH connection is routed through Cloudflare’s edge, all commands are captured across every host—including across multiple jump hosts or bastions—without requiring logging software on the target machines. TTY traffic can also be recorded to support full session replay later. The capability has been validated internally by Cloudflare’s own security team, which uses it to reconstruct exactly what happened during an incident or suspected breach.
Logs are encrypted immediately upon capture with a public key supplied by the customer, so only authorized security personnel can decrypt and inspect command histories. The feature launches with an opt-in FIPS 140-2 mode for FedRAMP-compliant environments.
Authentication relies on Cloudflare Short-Lived Certificates. Users load a client certificate once, and no further key-pair management is needed on end-user devices. The Cloudflare root CA is the only requirement, and ProxyJump workflows work without additional configuration.
Status and roadmap
SSH command logging is currently in closed beta. Cloudflare plans to integrate with SIEM tools and add alerting for specific commands and risky behavior in future releases, ahead of general availability.
