Security of Interactive and Automated Access Management Using Secure Shell (SSH)

Ylonen, Tatu; Turner, Paul; Scarfone, Karen; Souppaya, Murugiah

doi:https://doi.org/10.6028/NIST.IR.7966

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST IR 7966

Security of Interactive and Automated Access Management Using Secure Shell (SSH)

Documentation Topics

Date Published: October 2015

Author(s)

Tatu Ylonen (SSH Communications Security), Paul Turner (Venafi), Karen Scarfone (Scarfone Cybersecurity), Murugiah Souppaya (NIST)

Abstract

Users and hosts must be able to access other hosts in an interactive or automated fashion, often with very high privileges, for a variety of reasons, including file transfers, disaster recovery, privileged access management, software and patch management, and dynamic cloud provisioning. This is often accomplished using the Secure Shell (SSH) protocol. The SSH protocol supports several mechanisms for interactive and automated authentication. Management of this access requires proper provisioning, termination, and monitoring processes. However, the security of SSH key-based access has been largely ignored to date. This publication assists organizations in understanding the basics of SSH interactive and automated access management in an enterprise, focusing on the management of SSH user keys.

Keywords

access control; authentication; automated access management; device authentication; interactive access management; Secure Shell (SSH); user authentication

Control Families

Access Control; Audit and Accountability; Assessment, Authorization and Monitoring; Contingency Planning; Identification and Authentication; Maintenance; Planning; Personnel Security; Risk Assessment; System and Communications Protection; System and Information Integrity

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.7966
Download URL

Supplemental Material:
None available

Document History:
10/15/15: IR 7966 (Final)

Topics

Security and Privacy

access control, authentication, cryptography, public key infrastructure, risk management, security automation

Laws and Regulations

Federal Information Security Modernization Act, Health Insurance Portability and Accountability Act