Command reference

Palo Alto Networks SSH Manager · vSSH CLI

Command reference

vSSH CLI groups its features into commands and subcommands. This page lists the global options that apply to every command, the environment variables you can use instead of flags, and links to a reference page for each command.

Run vssh help or vssh <command> --help at any time to see the built-in help.

Commands

Command	Purpose
login	Authenticate and enroll certificates for interactive SSH logins.
logout	Remove SSH credentials from disk and the OpenSSH agent.
certificate	Enroll or renew certificates for applications and hosts.
profile	Create, list, show, edit, and delete configuration profiles.
service	Retrieve CA public keys and manage access tokens.
openssh	Inspect and configure the local OpenSSH server and agent.
status	Show retrieved credentials and check the service connection.
update	Update vSSH CLI to the latest version.
version	Print the version and build time.
help	Show help for any command.

Global options

These flags apply to every command. You can also set most of them in a configuration profile or an environment variable.

Option	Default	Description
-p, --profile	default profile	Name of the configuration profile to use. List profiles with vssh profile list.
-u, --url	(none)	URL of the SSH Manager API service. Example: --url https://tpp.example.com
-l, --user	current OS user	Username used to authenticate.
-t, --token	(none)	Authorization token to use instead of a username and password. Useful in scripts.
-a, --auth	auto	Authentication method: auto, userpass, browser, or jwt. See Authentication methods.
--jwt-file	(none)	Path to a file that holds a JWT from an external identity provider, exchanged for an access token. Requires --auth jwt.
--client-id	vssh-cli	OAuth client ID used for authentication.
--scope	ssh:manage	Scope requested for the access token.
--no-prompt	false	Disable interactive prompts. If information is missing or wrong, the command fails instead of asking. Use in scripts.
--log-format	plain	Output format for log messages: plain or json. Use json in scripts.
--timeout	0	Connection timeout to SSH Manager, in seconds. 0 means no timeout.
--ca-cert	system CAs	Path to a PEM file of certificates to trust when connecting to SSH Manager.
--ca-dir	system CAs	Path to a directory of PEM certificates to trust when connecting to SSH Manager.

Precedence

When the same setting is supplied more than one way, vSSH uses this order, highest first:

1. A command line flag.
2. An environment variable (VSSH_*).
3. A value stored in the active configuration profile.
4. The built-in default.

Environment variables

You can supply any flag through an environment variable. Use the prefix VSSH_, then the flag name in upper case with dashes replaced by underscores. For example, --url becomes VSSH_URL and --log-format becomes VSSH_LOG_FORMAT.

Commonly used variables:

Variable	Equivalent	Purpose
VSSH_PROFILE	--profile	Default profile for the session.
VSSH_URL	--url	Service URL.
VSSH_TOKEN	--token	Access token.
VSSH_TEMPLATE	--template	Issuance template name.
VSSH_JWT	--auth jwt	JWT to exchange for an access token. The preferred way to pass a CI/CD token.

Diagnostic variables:

Variable	Purpose
VSSH_TRACE	Enable trace level logging.
VSSH_ANALYTICS_DISABLED	Disable anonymous usage reporting.

Note: A value passed through a flag always overrides the matching environment variable.

Related pages

• Authentication methods
• Working with configuration profiles
• Understanding return codes