ID Management Discussion #4 - SSH Certificate Management
Use of SSH Certificates in Cyberinfrastructure
SSH keys are one of the most used authentication methods in use today for provisioning OS level access to computing infrastructure for processes, file access and administrators. Unlike most other AuthN methods for privileged access, SSH keys typically bypass challenge/response mechanisms we have in place for other access, may be self provisioned, and by default, never expire.
SSH keys work in pairs, a private key is configured and stored secure only a client machine, and a public key is stored on the server. The public certificate is the lock, and the corresponding private certificate is the key. Once an administrator has root or super user access on a machine, they may provision new SSH keys for themselves if not disabled by the administrator who set up the machine.
Because these keys are used to provide highly privileged access to resources and systems, it is critical that they are managed properly and with as much care as other privileged credentials.
Issues and Risks
Keys, once issued, are frequently not tracked or revoked, and can build up over time, as administrators come and go. Unmanaged SSH keys can be gaping blind spots in our authentication policy. Attackers have used SSH keys as system level backdoors in many prominent attacks that have been made public and no doubt many more that have not been disclosed.
Given the highly privileged and sensitive nature of the access these keys provide, it is surprising that a large majority of organizations are not managing, tracking, or rotating SSH keys on vital infrastructure regularly. This skew towards manually managing (or not managing) keys also leads to a tendency to reuse keys across servers, resulting in a loss of compartmentation if a key is compromised.
SSH Key Management Best Practices
As privileged credentials, SSH keys should be addressed in our IAM policies and procedures. There are number of compliance regimes that address the use of SSH keys, including NIST IR 7966. Thinking about SSH credentials using the Information Security Practice Principles, we can come up with some guidelines for the controls, policies and procedures we should have in place to manage them in our organization.
- Policies and Procedures for managing SSH credentials. (Rigor)
- Policies and Procedures for both provisioning SSH credentials and revoking or expiring them. (Comprehensivity)
- Determine if self provisioned certificates will be allowed on servers. (Proportionality)
- Segregation of duties - do not reuse keys across systems or allow keys to be moved between test, development or production environment. (Compartmentation)
- Disaster Recovery Plan - ensure that your backup sites and servers are secured and do not reuse keys from production or test environments. (Fault Tolerance)
- Define Boundaries and Trust Relationships between servers and environments and how keys should be used to establish Authentication across boundaries. (Minimization)
- Use a key management system to track and audit keys and enforce rotation, revocation and expiry policies. (Rigor, Opportunity)
Discussion
How does your organization handle SSH keys used for privileged access?
Do you address SSH keys specifically in your IAM policies?
Have you used any tools for key management that you’d recommend?
We would love to hear from you regarding your thoughts and experience on key management! Please join us in discussion below and give us your thoughts!