Quickstart

This guide takes a tenant owner from an empty Tenvyr tenant to the first governed SSH connection. Plan about 30 minutes for a pilot environment.

Before you begin

You need:

• a Tenvyr tenant and its one-use owner bootstrap credential;
• a trusted Linux workstation for the initial owner ceremony;
• administrator access to one Linux host with a working OpenSSH server;
• a current Tenvyr CLI and host-agent package; and
• a tested out-of-band or break-glass path to the host.

Tenvyr is in private pilot. Verify the package checksum supplied with your pilot release before installing any binary.

1. Create the first owner

Run the owner bootstrap utility from the trusted Linux workstation. Sensitive values are entered at no-echo prompts—never place them in command arguments, environment variables, tickets, or chat.

install -d -m 0700 "$HOME/.tenvyr-owner-bootstrap"

./tenvyr-pilot-owner \
  --url https://app.tenvyr.com \
  --tenant-id YOUR_TENANT_UUID \
  --email owner@example.com \
  --display-name "Tenant Owner" \
  --recovery-codes-file "$HOME/.tenvyr-owner-bootstrap/recovery-codes.txt"

Add the displayed TOTP enrollment URI to your authenticator, enter the current six-digit code, and move the recovery-code file to approved offline storage. After signing in, register a user-verifying security key or passkey in Security.

2. Create the resource hierarchy

In the console:

1. Open Resources.
2. Create a project, such as Production.
3. Create a host group, such as Web servers.
4. Choose Strict offline mode for certificate-only access.
5. Leave managed local accounts off for the first canary unless you have explicitly planned account ownership.

A host group is a signing and policy boundary. Hosts in different trust zones should not share a host group merely because they run the same application.

3. Enroll the first host

Open Resources, select the host group, and choose Enroll a host. Tenvyr issues a single-use token that:

• is displayed once;
• expires after ten minutes; and
• is valid for one host only.

On the Linux host:

sudo install -d -o root -g root -m 0700 /etc/tenvyr
sudo install -o root -g root -m 0600 \
  "$HOME/Downloads/tenvyr-enrollment-TOKEN_ID.token" \
  /etc/tenvyr/enrollment-token
rm -f "$HOME/Downloads/tenvyr-enrollment-TOKEN_ID.token"

sudo tenvyr-agent \
  -enrollment-token-file /etc/tenvyr/enrollment-token \
  -once

Confirm that /var/lib/tenvyr/identity.json exists and that the host appears in the console. Then configure the package service and start it:

sudo install -o root -g root -m 0600 \
  /usr/share/doc/tenvyr-agent/agent.env.example \
  /etc/tenvyr/agent.env
sudo systemctl enable --now tenvyr-agent
sudo systemctl status --no-pager tenvyr-agent

4. Create an access policy

Open Access and choose New policy. For the first canary:

• select the new host group;
• add one test user as the subject;
• select a known local account;
• require one independent approver;
• set a one-hour maximum grant;
• keep the certificate lifetime at ten minutes or less;
• choose Hardware-backed certificate; and
• choose Login only.

Policy creation requires MFA completed within the last five minutes.

5. Connect

On the user workstation:

tenvyr login --tenant YOUR_TENANT_UUID
tenvyr key enroll --hardware --name "Primary security key"
tenvyr access request \
  --policy POLICY_UUID \
  --host-group HOST_GROUP_UUID \
  --account deploy \
  --reason "Validate first managed host" \
  --duration 1h
tenvyr access status

After approval, launch SSH:

tenvyr ssh host.example.com \
  --host-group HOST_GROUP_UUID \
  --user deploy \
  --identity /path/to/hardware-backed-key \
  --credential CREDENTIAL_UUID \
  --grant GRANT_UUID \
  --ttl 10m

The final connection is made by the workstation’s system OpenSSH client directly to the host. Tenvyr is not in the interactive traffic path.

Verify the result

• The host is online and reports a current desired-state revision.
• The access request shows its approver and decision.
• The issued certificate is valid for no more than ten minutes.
• The Audit view contains the request, decision, and issuance events.
• Your break-glass path still works.

Next, read How Tenvyr works before expanding the pilot.