cascarasecurity.com

What It Is

Cascara Security is a tool that combines SSH login security with Google/GSuite identity authentication. It uses OpenSSH’s certificate authorities mechanism: a master certificate/CA key is deployed on the server, and short-lived SSH keys are automatically issued based on the result of the user’s Google OAuth login. Its goal is to replace long-lived static SSH keys and reduce the attack surface created by large numbers of unused keys.

Core Capabilities

In terms of protection scope, Cascara mainly addresses SSH access control, key lifecycle management, and user permission management. Users initiate login through the cssh client, sign in with Google in the browser, and the system then automatically provisions a new SSH key and establishes the session. For deployment, a single SSH certificate needs to be installed on the server side, while the open-source cssh binary is installed locally; permissions are configured through its website. For administration, the documentation emphasizes that authorization changes can be completed simply by adding or removing a person’s email address, avoiding manual edits to authorized_keys or waiting for Ansible or Chef to push updates. It also relies on Google’s 2FA capabilities to strengthen authentication.

Pricing and Target Users

The official website clearly states that the service is currently free, because the team wants hobbyists and small startups to be able to use it as well. Enterprise-oriented features and paid plans will be added in the future, but no pricing, plan details, payment methods, or enterprise-edition boundaries have been disclosed. As a result, its short-term value for money is strong, especially for small teams, early-stage startups, and engineering teams that already use Google/GSuite and need to quickly improve SSH key management.

Pros and Cons

The main advantage is its clear approach: short-lived certificates expire automatically, reducing the risks associated with leftover SSH keys; onboarding and offboarding workflows are simplified; and it reuses Google OAuth and 2FA, which lowers the learning curve. The drawbacks are also fairly obvious: service security depends on both Google and Cascara, so users need to trust its certificate issuance process; public information does not explain compliance certifications, audit logs, alerts, SLA, enterprise support, or disaster recovery mechanisms; and it is not particularly friendly to teams that do not use Google as their identity system.

Access from China and Alternatives

Because its core authentication depends on Google OAuth/GSuite, access from mainland China may often be unstable or require special network conditions, so it should be considered “partially restricted.” Payment methods have not been disclosed. For deployment in China, alternatives worth considering include JumpServer, a self-hosted OpenSSH CA, Teleport, smallstep, or HashiCorp Vault SSH Secrets Engine.