Feeds

SSH an ill-managed mess says SSH author Tatu Ylonen

IETF draft a first step to new version

Internet Security Threat Report 2014

Tatu Ylonen, author of the SSH protocol, isn't afraid of criticising his own work: he's calling for a new version of the Secure Shell to make it more manageable and get rid of the problem of undocumented rogue keys.

In this IETF Draft, Ylonen proposes a regime for key management, including key discovery, to overcome the problem. The draft, co-authored by NIST's Murugiah Souppaya and Secure IT's Greg Kent, proposes guidelines for “discovering, remediating, and continuously managing SSH user keys and other authentication credentials”.

The draft notes that there are often a great many more SSH keys in existence in an organisation than there are users – “hundreds of thousands, even over a million SSH keys authorising access have been found … [in] many large organizations. This is many times more than they have interactive users.”

Of course, having credentials wandering around loose in a company “present a real risk to information security”, the draft notes – and places a premium on finding out just what's out there.

This draft, open for comment until October, focuses on processes and key management, but according to Ylonen, a new SSH will be needed (the current version, SSH-2, dates from 2006).

Some of the recommendations in the draft appear to reveal a surprising state of affairs, at least among companies whose SSH implementations have been reviewed by Ylonen's company, SSH Security. The draft recommends:

  • Moving keys to protected locations;
  • Removing unused keys;
  • Associating authorised keys with a business process or application;
  • Removing keys for which no valid purpose can be found;
  • Rotating keys;
  • Restricting what can be done with each authorised key;
  • Establishing a process for approving new keys.

The list looks somewhat like what companies should already have been doing in managing their SSH access – but it's probable that someone configuring new kit finds it simpler to create such things ad-hoc. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.