A guide to protecting and managing SSH Keys to mitigate security risks

If someone has spent enough time in an IT environment, he/she is more than likely to come across the term SSH keys. SSH (Secure Shell) keys are an access credential that is used in the SSH protocol for modern Infrastructure-as-a-Service platforms like AWS, Google Cloud, and Azure.

What are SSH keys?

SSH keys are of various sizes, while the most popular choice is an RSA 2048-bit encryption. It is comparable to a whooping 617-digit-long password. Generating an SSH key pair differs for various Operating systems. On Windows, a user can generate it by downloading and using an SSH client like PuTTY, while on Mac and Linux systems, it is possible using a terminal window. 

SSH keys are always available in pairs, which consist of a public key and a private key. There are three different types of keys, depending on Who or What possesses these keys:

• User key
• Host key
• Session key

How does SSH Key Authentication work?

After the successful generation of a key pair, the user will be prompted to enter the SSH username and the IP address of the remote system. Now, this specified username, and the protocol will tell the remote server which public key is needed to authenticate the user. After that, the remote server will use the already available public key to encrypt a challenge message that is sent back to the client, which is decrypted using the private key on the user’s system.

After this process, when the message has been decrypted, it is then combined with a previously gathered session ID and later sent back to the server. Only if this message matches with the server, does the client get authenticated and access to the remote server is given. The most important thing is to make sure that these SSH keys are properly managed.

Managing SSH Keys

There are several millions of SSH keys in use to grant access to various digital assets, mainly by Fortune 500 companies. So, an effective SSH key management system would go a long way in reducing security risks.  There are various options to gain control over SSH keys in development as well as production environments. This means the user has to manage the SSO provider, a directory service, and various system management solutions.

Risks associated with SSH Keys

There are many risks or vulnerabilities involving SSH keys, but some vulnerabilities are critical and should not be ignored:

1. SSH Key tracking troubles
2. Sharing SSH keys is Trouble
3. Static SSH Keys
4. Embedded SSH Keys
5. Weak SSH configuration

Security vulnerabilities of SSH

There are a few vulnerabilities related to security measures like:

• Brute force and malware attacks
• SSH session hijacking and unauthorized access

Mitigate SSH security attacks

Although there are many vulnerabilities related to SSH key management, there are also ways to prevent those:

1. Discover and map keys
2. Control SSH keys and access
3. Disable root login

Conclusion

If the IT administrators maintain proper audit trails to ensure that all keys in use adhere to policies, this may lead to transparency and proper modifications can be done for key generation and rotation.

To learn more about the topic, visit Encryption Consulting