5.0 Implementing Zero Trust to Secure the SSH Target

Secure and monitor the certificate-based authentication, without the need of agent or client application on the target server.

Let us assume, an organization Intech Data, Inc. wants to secure and provide limited access to their Production server. Also, does not allow any manual action (human intervention) on the server.

Few designated users can perform actions defined in the ephemeral certificate.

This example refers to the following user profiles:

  • John: A DevOps engineer of Intech Data Inc.

  • Markus: Administrator of Intech Data Inc.

John wants to access the target production server for updating packages and collecting performance metrics. Thomas configures the following features to grant one time access to John:

  • Certificate-based authentication with zero trust.

  • Just in time access.

SSH certificate-based authentication provides with the following benefits:

  • Valid for the defined duration or time.

  • New certificates can be issued with ease. No overhead of managing authorized keys in SSH server.

  • Customize the certificate for a specific purpose and with least privileges to avoid misuse.

The following diagram illustrates the requirement of this use case:

This section explains the prerequisites, flow of actions, and step-by-step configuration details to achieve this requirement.

Prerequisite

Markus (administrator) is required to add read secret policy for granting certificate-based authentication to John.

For more information, see Create Path.

To achieve this requirement, perform the following tasks:

  1. Markus creates a Certificate Authority either by importing from or create using Privileged Access Manager.

  2. Receives the public key and configures the same in the target server.

  3. Restart SSHD in the target server.

  4. Configure the dynamic secret template that is required for ephemeral certificate.

  5. John logs in to Privileged Access Manager User console and issues a certificate for the resource.

  6. John logs into the target server through Privileged Access Manager with the new certificate.

    Post the authentication, packages are obtained and performance metrics report is retrieved from the production server.

After Markus implements SSH Certificate based Authentication, the following are possible scenarios:

Scenario

Result

After issuing a certificate, John tries to log in to the target server for the first time using the certificate.

Authenticates with details in the certificate and actions configured in the certificate are executed.

John tries to log in to the target server again using the certificate.

Authentication fails as the certificate is restricted to use once.

John issues the certificate again on the PAM User console and then attempts to log in to the target server.

Authentication is successful and actions configured in the certificate are executed.