Passer des clés statiques aux certificats SSH dynamiques avec EJBCA 8.0

Keyfactor a le plaisir d'annoncer la disponibilité générale de EJBCA 8 .0. EJBCA est une plateforme PKI flexible et évolutive qui se déploie partout, s'adapte à la demande et sécurise même les environnements informatiques les plus complexes avec une identité pour chaque charge de travail, chaque appareil et chaque personne.

Avec EJBCA 8.0, les organisations peuvent désormais créer un nouveau type d'autorité de certification pour émettre des certificats SSH. Dans cet article de blog, nous allons explorer les avantages de l'utilisation de certificats SSH par rapport aux clés, et comment permettre un accès SSH transparent et basé sur la session avec EJBCA. Vous pouvez également regarder la vidéo de démonstration ci-dessous pour la voir en action !

Pourquoi choisir des certificats SSH plutôt que des clés ?

Secure Socket Shell (SSH) has emerged as a trusted authentication and encryption method, where remote access to systems and secure data transmission is crucial. For decades, SSH Keys have been the go-to solution for decades, offering a robust approach to accessing and managing remote systems. However, despite their benefits, SSH Keys come with their fair share of challenges. 

We will dive into the limitations of SSH Keys and explore a superior alternative – SSH Certificates. By adopting SSH Certificates, organizations can enhance security, simplify key management, and mitigate potential risks. 

Défis liés aux clés SSH

While SSH Keys have been widely used, they present a set of obstacles that can hinder efficient operations and compromise security. Let’s take a closer look at some of the key challenges associated with SSH Keys: 

1. Cumbersome Key Management: Maintaining SSH Keys within an organization can be daunting. Provisioning keys for new employees and de-provisioning them when someone leaves requires manual intervention, creating a time-consuming process for system administrators. Additionally, auditing the system for shared team SSH Keys and identifying their owners becomes increasingly complex as the number of keys grows. 
2. Risk of Key Loss and Theft: SSH Keys, if not properly safeguarded, are susceptible to loss or theft. If a key is misplaced or stolen, it can grant unauthorized access to sensitive systems and expose the organization to security breaches. Recovering from such incidents involves thorough audits, re-pairing of public and private keys, and re-establishing secure access, which can significantly impact productivity. 
3. Regulatory Compliance Challenges: Compliance with regulatory standards is critical for many organizations. Ensuring proper permissions, access controls, and audit trails for SSH Keys is imperative when regulatory issues arise. However, managing these requirements in a scalable and efficient manner poses a considerable challenge. 
4. Limited Scalability: As organizations grow and the number of SSH Keys proliferates, key sprawl becomes a real problem. Cleaning up scattered and discarded keys can consume substantial time and effort for SSH operators. The lack of scalability in managing SSH Keys hampers operational efficiency and increases the risk of misconfigurations and security vulnerabilities. 

Fortunately, a solution exists to address these challenges and elevate the security and management of SSH authentication: Enter SSH Certificates. 

Les avantages des certificats SSH

Now, let’s explore the benefits of using SSH certificates over SSH keys and the key features and advantages that Keyfactor EJBCA empowers. When comparing SSH certificates to SSH keys, the advantages are clear. SSH certificates provide a more comprehensive and secure approach to access control with EJBCA’s dedicated CA for SSH certificates.  

Autorité de certification dédiée pour les informations d'identification SSH

EJBCA provides a dedicated Certificate Authority (CA) specifically designed to issue SSH certificates for hosts and users. EJBCA recognizes the importance of managing SSH credentials separately, ensuring efficient distribution to any person or system utilizing SSH. With EJBCA, the need for manual trust establishment by users when accessing servers is eliminated, simplifying the authentication process and enhancing user experience. 

Gestion simplifiée de la confiance

Efficiency and security go hand in hand when managing trust within a CA. EJBCA excels in this area by offering robust features that streamline trust management across the entire PKI ecosystem. This includes seamless integration with identity access managers or other systems through a REST API, allowing organizations to achieve a smooth and secure workflow for privileged access management. With EJBCA, trust becomes a manageable and efficient aspect of your security infrastructure. 

Accès par session et émission de certificats SSH

EJBCA supports session-based SSH certificate issuance, a revolutionary approach to access control. When an individual requires access to a server, EJBCA can rapidly issue a short-lived SSH certificate, typically valid for a predefined period, such as 30 minutes. These certificates automatically expire after the specified time, ensuring access remains valid only for the necessary duration. This feature enhances security by minimizing the risk of unauthorized access beyond the session’s scope. Easily integrate your privilege accessed management system with the EJBCA REST API. 

Préparer l'avenir : Migrer vers les clés ED25519

Planning for the future and staying ahead of evolving threats is crucial to managing certificates effectively. EJBCA enables organizations to migrate from traditional RSA keys to the more secure ED25519 Keys. These keys are post-quantum cryptography-compatible, offering enhanced security and preparing your systems for future cryptographic challenges. With EJBCA, you can ensure your security infrastructure is resilient and future-proof. 

Atténuer les risques liés aux certificats expirés

Expired certificates pose a significant security risk, particularly when privileged access keys are left unattended after an employee’s departure. However, EJBCA addresses this concern through session-based authentication with expiring keys. By automatically invalidating credentials after a specified timeframe, EJBCA mitigates the risk of unauthorized access and potential exploitation by malicious actors.  

Let’s Wrap It Up

SSH Certificates offer an effective, secure, and efficient solution to the challenges posed by SSH Keys. By utilizing SSH Certificates, organizations can simplify key management, enhance security, and mitigate potential risks. With dedicated SSH Certificate Authorities in EJBCA, organizations can enjoy the benefits of simplified trust management, session-based certificate issuance, and the ability to migrate to more secure keys. The automated expiration of credentials reduces the risk of unauthorized access, ensuring a resilient and future-proof security infrastructure. 

By embracing SSH Certificates, organizations can elevate their SSH authentication and encryption practices, bolstering their overall security posture in the ever-evolving digital landscape. 

Prêt à améliorer votre jeu SSH ?

To try EJBCA today, start a free trial on AWS or Azure.  

Pour en savoir plus sur les fonctionnalités, consultez les notes de mise à jour deEJBCA 8 .0.