JA EN
shiichan

One More Key for SSH: Access for Infrastructure Now Does Independent MFA with YubiKey PIV

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hey there, it's me, Shii-chan! Today I found a nice little security upgrade for SSH, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, Access for Infrastructure now supports independent multi-factor authentication (MFA) for SSH connections using YubiKey PIV keys. It adds a hardware-backed second factor to SSH access.

The key idea: a single compromised device session is no longer enough to reach your servers. Even if a device is compromised, you still need the physical key in hand to get in.

The story so far

Until now, Access for Infrastructure leaned on the device session (your logged-in state) to protect SSH access. The catch was that if that session got stolen, it could be enough on its own to reach a server. This independent MFA adds one more wall — a physical key — on top of that.

What changes

You can configure MFA per application and per policy, which is handy. For example, you can require PIV key authentication for sensitive usernames like root, while applying different rules to other usernames. You don't have to lock everything down uniformly, so it stays practical to run.

You can also set an MFA session duration, so you control how often users have to re-authenticate.

Dive Deep

Here's the rough flow:

The original post is short, so that's about all the detail I can share — follow the docs above for the fine print.

Wrap-up

  • Access for Infrastructure now adds independent MFA via YubiKey PIV for SSH access
  • A hardware key becomes the second factor, so a stolen device session alone won't let someone in
  • It's configurable per application and per policy — lock down just root, tune the MFA session duration, and more
  • Straight from Cloudflare's Changelog. Great for infra teams securing SSH with Zero Trust.

Related posts