Introduction
Limen decides who can reach your servers, databases and clusters, and keeps a record of what they did there.
Engineers, and the CI jobs that act for them, sign in through the identity provider you already run. Limen checks your policy and hands out access that expires in minutes. Every session is recorded or audited, into a trail you can verify yourself. It works with SSH hosts, PostgreSQL and MySQL, Redis, MongoDB, OpenSearch and Elasticsearch, RabbitMQ and Kafka, Kubernetes, and internal web apps.
Limen is open source (Apache-2.0), written in Rust, and you run it on your own infrastructure.
The problem
Section titled “The problem”Most teams reach production with credentials that outlive their reason to exist: an SSH key copied to a laptop years ago, a database password shared in a vault, a CI secret nobody remembers creating. When someone leaves, or something goes wrong, two simple questions get hard to answer. Who can get in right now? And what did they do?
Limen answers both by never handing out a long-lived credential in the first place.
How it works
Section titled “How it works”- You sign in.
limen loginopens your identity provider in a browser. Limen gives back a certificate that lasts an hour (less if your policy says so), tied to a key that never leaves your machine. - Policy decides. Your identity provider’s groups become roles. A policy file in Git says which roles reach which resources, chosen by label. Anything no rule allows is denied, and
limen explaintells you why. - You connect with your usual tools.
ssh,psql,kubectl,redis-cliand the rest. A Limen worker runs next to the target and signs in to it with credentials you never see. The worker dials out to Limen, so the target needs no open inbound port. - Everything is written down. SSH sessions are recorded and can be replayed. Databases, caches, search and brokers are audited command by command. The trail is signed and chained by hash, so
limen-audit-verifyfinds any event that was removed, reordered or changed.
When you need more than your roles allow, limen request asks an approver for time-limited access, with a reason. CI jobs sign in with their platform’s own token, so no secret has to sit in your pipelines.
What you get
Section titled “What you get”- No standing credentials. Certificates last an hour by default, and you can make them shorter per role. Nothing long-lived sits on a laptop or in a CI secret.
- Policy you can test. It is YAML in Git, deny by default. You can test it in CI, see who gains access before a change lands, and ask why a request was denied.
- Access you ask for. Requests with a reason, approvals and break-glass. A grant expires on its own and ends the sessions it allowed.
- An audit trail you can check. Events go to S3 as a signed hash chain, and to Datadog. One command verifies it. If a session can’t be audited, it doesn’t start.
- Plain to run. Static binaries, PostgreSQL as the only required store, and no paid tier: everything on this site is in the Apache-2.0 build.