Product documentation
Citrix SecurSpaces™
View PDF

Connect to external services over SSH

August 18, 2026
Contributed by: 
T

You often need to reach systems outside your workspace over SSH — to push to a Git repository hosted on Azure DevOps, deploy to a staging server, or open a session on a remote database host.

By default the SecurSpaces proxy service blocks outbound SSH from workspaces. One of two options must be enabled first, and both are enabled by a project owner or security officer:

Option What you do What your administrator does
Personal SSH Identity Generate your own key in your profile and register the public key on the target service Switches on Enable Personal SSH Identity for the workspace or template
Connected SSH Services Nothing. Run ssh <service-name>. Creates the service with its credentials and attaches it to the workspace

If neither is enabled, see Outbound SSH is blocked.

Administrators should see Enable outbound SSH.

Option 1: Personal SSH Identity

The platform generates and holds an SSH key pair for you. The private key is applied automatically when you connect and is never exposed inside the workspace.

Prerequisite: a project owner or security officer has switched on Enable Personal SSH Identity for your workspace or its template.

Generate your key

  1. Select your profile picture in the top-right corner to open your profile.
  2. Go to Integrations > Personal SSH Identity.
  3. Select Generate Key.
  4. Enter a default user name, for example git. You can override it per service when you connect.
  5. Select Create.

Generate Personal SSH Identity key

The platform generates the pair and shows the public key. The key applies to new and existing workspaces.

Register the public key

  1. On the Personal SSH Identity page, select Copy.
  2. Add the public key to the target service, for example by appending it to ~/.ssh/authorized_keys on the host. The exact steps depend on the service.

Personal SSH Identity page showing the generated key with Copy, Regenerate, and delete options

Connect

Open a terminal in any workspace where Personal SSH Identity is enabled and connect as usual:

ssh <username>@<hostname>
<!--NeedCopy-->

SecurSpaces applies your private key. There is no key to manage inside the workspace.

Option 2: Connected SSH Services

Your administrator defines the target host and its credentials once, then attaches it to the workspace. You do not handle a key or a password.

Open a terminal in the workspace and use the service name as the host:

ssh gcp-vm
<!--NeedCopy-->

SecurSpaces authenticates you automatically.

Outbound SSH is blocked

If no SSH method is configured for the host you are reaching, the proxy closes the session and the terminal shows this before it does. Depending on the client, you might also see no signers found for request or ssh: no auth passed yet, which mean the same thing — the workspace has no SSH credential to present.

SSH access to external hosts is disabled by default in this workspace.
To connect, an administrator must enable one of:
  - Personal SSH Identity (per-user key) - in the workspace/template Security Settings
  - a Connected SSH Service - then run: ssh <service-name>
See: https://docs.citrix.com/en-us/securspaces/workspace/ssh-connectivity
<!--NeedCopy-->

Ask a project owner or security officer to enable one of the two options. Personal SSH Identity suits access to your own accounts; a Connected SSH Service suits a host the whole team uses.

Note:

This message appears only when the SSH connection itself is blocked for lack of a configured method. A connection that fails because the destination is not on an allow list is a network policy matter. See Monitor and troubleshoot.

Connect to external services over SSH
August 18, 2026
Contributed by: 
T
August 18, 2026
Contributed by: 
T

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.