How to Improve SSH Key Management
Modern enterprises have thousands of SSH targets that administrators must manage access to. Manually tracking, rotating and validating the SSH keys that grant access to those targets is stressful in the best of circumstances and nearly impossible in the worst. Consider the layoffs, re-organizations and mergers that many companies experience, and this stressor quickly snowballs into serious risk.
However, proper processes can make SSH key management simpler and more secure. Here’s how.
Best practices for managing SSH keys
SSH keys are a pair of cryptographic keys that secure the communication between the client and server. They’re more secure than passwords because they’re harder to crack with brute force or password-dictionary attacks. However, SSH keys come with their own set of risks if there isn’t a good system in place to properly manage them. This is because SSH keys are long-lived. There’s nothing stopping users from copying them and sharing them with other users or copying them to unauthorized devices. SSH keys are also subject to cryptojacking and proxyjacking. To mitigate these risks, organizations using SSH should consider the following best practices.
Adopt an SSH key management platform
SSH key management platforms help organizations address challenges related to the proliferation, security and lifecycle management of SSH keys. They are especially crucial for large organizations with complex IT infrastructures, where the manual management of SSH keys can become challenging and prone to security risks. By using a dedicated platform, organizations can enhance security, streamline operations and ensure compliance.
Create an access policy
An SSH access policy is a set of rules that dictate how SSH access is managed within an organization's environment. It should include guidelines for the following:
- User authentication
- Key management, including distribution, revocation and rotation
- Access based on user identities, just-in-time access and single-time use keys
- Logging and auditing of SSH activities
- Session management
- Compliance standards
An SSH access policy is crucial for safeguarding systems and networks, controlling user access and maintaining the overall security posture of an organization. This is an essential part of a comprehensive cybersecurity strategy for any company using SSH — whether or not they’re using keys to grant access to those SSH targets.
Have a strategy for key distribution and revocation
An SSH key distribution and revocation strategy is essential for controlling SSH access, managing the employee lifecycle and mitigating insider threats. A company’s strategy should facilitate the timely distribution and revocation of SSH keys when employees join, leave or change positions at the company. Keys should also be revoked immediately if they are lost, stolen or a user poses a potential security risk.
Regularly rotate SSH keys
Regularly rotating SSH keys helps mitigate the risk of compromise by minimizing the window of opportunity for attackers to exploit keys. It prevents long-term access in case of a key compromise and aligns with cybersecurity best practices and compliance requirements.
Improve SSH key management with BastionZero
BastionZero provides zero trust access to SSH targets while eliminating manual SSH key management. BastionZero has several offerings that can help you manage SSH keys.
First, our free community tool, OpenPubkey SSH, allows you to SSH to machines on your network without SSH keys. Instead of SSH keys, OpenPubkey SSH allows users to authenticate to SSH servers using their Google Single Sign-On (SSO).
Second, if you’re looking for full-feature SSH key management, including integration with more SSO providers (AzureAd, Okta, OneLogin, Keycloak ), centralized policy management, session recordings and just-in-time access, check out the full BastionZero platform.
Unlike other SSH key management platforms, the BastionZero platform is built on a core protocol that only grants users access to a target if they get cleared by two authorities: BastionZero and an SSO or identity provider. Even if one of the two is breached, fraudulent users can’t gain access.
The BastionZero platform runs side-by-side with a company’s existing SSH system and assumes responsibility of SSH key management. Setup is straightforward, including auto-integration with most SSO providers and auto-discovery of existing SSH targets. Administrators simply deploy the BastionZero agent, install the Desktop App or Command Line Interface (ZLI) and create an access policy to control user permissions. BastionZero lets administrators track activity by username, grant and revoke keys at any time and provide just-in-time access.
From the users’ perspective, not much changes. While they will need to install the ZLI or the BastionZero Desktop App, they can otherwise use SSH the same way they always have. Behind the scenes, BastionZero’s access policy enables precise control over what targets each user can access — even if there are thousands — eliminating the risk of unauthorized lateral movement.
BastionZero is the most advanced access tool for organizations that use SSH. It eliminates the hassle of manual SSH key management, supports least privilege access and enables companies to meet SOC 2 and ISO 27001 requirements.
Ready to improve SSH key management? Start here.
