JA EN
shiichan

SSH Connections Can Now Use FIDO2 Keys! Cloudflare Access Strengthens Infrastructure App MFA

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hey everyone, it's Shiichan! Today I found an update that can lock down SSH access even tighter, so let's dig in!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced an update to Cloudflare One's Access (Zero Trust) product. Infrastructure applications — the ones used for SSH connections — now support FIDO2 keys as a new independent MFA method. You can allow ssh_fido2_key (FIDO2 key), piv_key (PIV key), or both in application-level and policy-level MFA settings.

Users enroll their FIDO2 key through the App Launcher and connect using the SSH identity generated during enrollment. This is a completely separate mechanism from browser-based WebAuthn security key registration.

Why it matters

Cloudflare Access infrastructure apps already supported PIV keys (using a YubiKey's PIV function) as an SSH-specific MFA method, kept separate from browser-based WebAuthn security keys.

Adding FIDO2 keys to the mix means users without PIV-capable devices, or teams that are simply more comfortable with FIDO2, now have another option for strong hardware-backed SSH authentication. More choice is a small but genuinely welcome improvement.

What changes

Admins get more flexibility over which authenticators are allowed for infrastructure app MFA:

  • Allow only FIDO2 keys
  • Allow only PIV keys
  • Allow both, letting users pick whichever they prefer

This can be configured at the application level or the policy level, so you can require, say, "FIDO2 key only" for one app while allowing PIV keys too for a policy scoped to a specific SSH username. It gives admins finer control to match authentication requirements to their security needs.

Dive Deep

To configure this through the API, set allowed_authenticators inside the mfa_config object on an application or policy.

{
  "mfa_config": {
    "mfa_disabled": false,
    "session_duration": "12h",
    "allowed_authenticators": ["piv_key", "ssh_fido2_key"]
  }
}

A few things worth knowing:

  • piv_key and ssh_fido2_key only apply to infrastructure applications — they're not available for other app types or browser-based WebAuthn
  • Setting session_duration to 0m forces MFA on every new SSH connection (otherwise, users can open new connections without re-authenticating until the session expires)
  • MFA settings resolve with this precedence: policy > application > organization
  • FIDO2 key enrollment uses a command generated by the App Launcher. On macOS you need OpenSSH installed via Homebrew, and on Linux an OpenSSH build with libfido2 support — the default macOS ssh-keygen doesn't support FIDO2 keys

Full setup steps are in Cloudflare's docs under "Enroll a FIDO2 key for infrastructure apps" and "Configure MFA for infrastructure applications."

Wrap-up

  • Cloudflare Access infrastructure apps now support FIDO2 keys (ssh_fido2_key) as an independent MFA method for SSH
  • It works alongside the existing PIV key (piv_key) option, configurable per app and per policy
  • FIDO2 enrollment is separate from browser WebAuthn and runs through an App Launcher-generated command

This one's for admins managing SSH infrastructure through Cloudflare Access who want to add hardware-key-based MFA.

Related posts