What Are SSH Keys?
SSH, or Secure Shell Protocol, allows devices to operate securely even on unsecured networks, and makes modern cloud-dependent services possible. This protocol uses public key cryptography (creating public-private key pairs) to encrypt network connections. Static SSH keys work like usernames and passwords, but for automated processes and implementing single sign-on authentication.
SSH keys come in pairs: a public key, and a private key. The public key can be shared with anyone to encrypt a message that only the corresponding private key can decrypt. At their core, SSH keys enable authorized users to access critical systems (such as servers) to perform their jobs. When they’re properly managed, they offer both convenience and improved security over traditional credentials like usernames and passwords.
However, unmanaged SSH keys open up new avenues of risk. They do not expire naturally; their access to a system must be removed. Organizations use between 50 and 200 SSH keys on a single server, and that number could balloon to over a million keys organization-wide. If even one key is compromised, an attacker gains high levels of access to vital servers. From there, they can circumvent security to deploy malware, inject fake data, subvert encryption software, etc.
What SSH Keys Do, and Why They Matter
One way to authenticate users trying to access critical, secure resources is with usernames and passwords: for example, entering a username and password into a login field for a cloud server. However, passwords are vulnerable to attacks like brute force, which automatically guesses different passwords for a username until it finds the right one. Considering how many people reuse weak passwords, brute force attacks are often very effective—and you don’t want to give attackers an easy path into your secure servers.
A more secure way to authenticate users is with SSH keys, which can grant access as well as control the resources that can be accessed. Key-based authentication validates a user with a cryptographic key pair (the public-private key set). SSH keys are more secure than passwords because cryptographic keys are resistant to brute-force attacks, as the attacker’s system is unlikely to just guess the key.
However, key-based authentication is only as secure as the weakest link. A typical Fortune 500 enterprise likely has several million SSH keys granting access to its servers, and probably doesn’t track all of them. These are keys that provide direct access to vital resources, and can be used by malicious actors to steal data or money, transfer files, update configurations, etc.
Just as you wouldn’t leave your house keys lying out in the open for anyone to use, your SSH keys need to be tracked and protected. Only authorized users should be able to access what those locks are protecting—and that’s where SSH key management comes in.
The Problem with Static SSH Keys
Static SSH keys are authentication credentials just like username and password combinations, and can grant access to your servers in perpetuity, as they don’t expire, they aren’t rotated, and they often go untracked.
You can’t protect what you don’t know about, which is why one core pillar of successful SSH management is discovering every SSH key (especially legacy and orphaned keys) in your environment. Once they’re discovered, SSH key management involves:
- Mapping out the trust relationships of every SSH key pair.
- Auditing SSH implementations to find and fix vulnerabilities.
- Finding effective, secure ways to generate, store, rotate, revoke, and use SSH keys.
- Updating keys that use weak encryption algorithms or provide unnecessary root access.
Considering the number of keys most organizations are dealing with, key management can quickly become overwhelming, leaving your organization vulnerable.
SSH Certificates: A Scalable, Easier to Control Alternative
One way to deal with the risks of unmanaged SSH keys, and the challenges of key management, is to use SSH certificates instead.
Static SSH key-based authorization involves distributing keys across your infrastructure, while certificate-based authentication uses a centralized trust model. Between the user and the server, designated certificate authorities (CA) produce a short-lived SSH certificate vouching for a user’s identity. That way, instead of needing to configure every server with individual user keys, you instead configure them to trust the users’ CA.
SSH certificates include built-in expiration dates, identity information like roles, and can easily be revoked at any time—making them far more secure than static SSH keys. The operational overhead of issuing authorization is also lower, as the centralized service handles provisioning and deprovisioning users and managing user access to infrastructure. Using SSH certificates instead of static SSH keys offers a centralized, auditable, and scalable way to control SSH access.
Why CISOs Should Care About SSH Key Management
SSH key management is often overlooked when it comes to security programs like identity and access management (IAM). However, failure to terminate SSH access when it’s not needed is reckless, and creates long-term, almost invisible backdoors into secure resources.
Without clear policies and ownership for SSH keys, system administrators could install new keys whenever convenient, potentially without approvals from the involved teams—and without properly registering them. In most organizations, the number of public keys varies between 5 and 50 times the number of employees. And if they’re not all tracked to be properly deleted when a user leaves the company or switches to a different role, your SSH keys suddenly become a huge vulnerability, in perpetuity.
All of the locks you can imagine on a building do no good if someone can grab an unattended key and let themselves in.
5 Best Practices for Managing SSH Keys
Managing SSH keys is vital to protect your business from unauthorized access. Assign a specific employee (or team) to implement key management best practices such as:
1. Discovery
SSH key management starts with discovery. You can use an SSH key manager to automatically discover what keys exist within your IT infrastructure and what those keys can access, or perform the process manually. Identify all public keys and as many private keys as possible in your environment.
2. Remove Inactive Keys
Remove keys that are not currently in use to close up potential vulnerabilities. Identify both a legitimate need and the person or team responsible for each remaining key in your environment.
Check for keys tied to test and development systems, and remove access, where possible.
3. Set Expirations and Rotation
Once you’ve identified all SSH keys, you can close up potential vulnerabilities due to rogue, unnoticed keys. Configure an expiration date for your SSH keys’ access, and have a process in place to update the keys before that date so server communication isn’t interrupted. You can also set up SSH key rotation, which involves replacing existing private keys with new public keys that you generate, and updating all corresponding systems to reflect key changes.
4. Automate Where Possible
SSH key management can quickly become overwhelming depending on the number of keys your organization uses. An SSH key manager automates many of these processes and tasks, helping to alleviate key sprawl issues and identify orphaned keys.
5. Tie SSH Key Management to Overall Access Control Strategies
SSH keys are a method of authentication similar to traditional credentials like usernames and passwords. Therefore, align your SSH key management policies, processes, and infrastructure to overall access control policies, and ensure accountability by responsible parties.
Secure Your Business with Modern SSH Key Management
It’s time to modernize SSH key management in your organization. Coordinate between security, access management, compliance, engineering, and even risk management teams, led by someone with authority (such as the CISO) to support the key management process.
Move towards using short-term SSH certificates to alleviate the issue of rogue, active SSH keys. Implement and enforce key policies for access control via SSH. Discover and keep track of every key in your organization, and remove keys that are no longer in use. Lastly, automate as many of these processes as you can to keep your organization secure without straining employees.
Upgrading your processes to a more modern approach by blending policies and manual efforts with automation strengthens both your security posture and compliance. SSH keys are a useful resource to allow encrypted authentication to servers—but they’re only as secure as the processes, policies, and implementations you put in place.
