Bash Orchestrator

SSHClosed The SSH (secure shell) protocol provides for secure connections between computers. It provides several options for authentication, including public key, and protects the communications with strong encryption. supports a wide variety of authentication mechanisms. Often, enterprises fall back to simple username and password at least some of the time due to the complexities of key management for key-based authentication. Without key management, SSH keys tend to multiply, and you can quickly lose track of who has access to what where. The Keyfactor Bash OrchestratorClosed The Bash Orchestrator, one of Keyfactor's suite of orchestrators, is used to discover and manage SSH keys across an enterprise. is designed to allow organizations to inventory and manage secure shell (SSH) keys across the enterprise.

Important:   SSH Key Management licensing is required to use any of the functionality outlined in the Keyfactor Bash OrchestratorClosed Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. documentation. Contact for assistance with obtaining the proper licenses.

The orchestrator runs on Linux servers and can be operated in two possible modes:

  • The orchestrator is used in inventory only mode to perform discovery of SSH public keys and associated Linux user accounts across multiple configured targets. When used in inventory and publish policy mode, the orchestrator:

    Figure 548: SSH Key Discovery Flow

  • When operated in inventory and publish policy mode, the orchestrator can be used to add SSH public keys and Linux user accounts on targets and remove rogue keys that appear without authorization. Figure 549: SSH User Key Management Flow shows the flow from a user requesting a new key pairClosed In asymmetric cryptography, public keys are used together in a key pair with a private key. The private key is retained by the key's creator while the public key is widely distributed to any user or target needing to interact with the holder of the private key. to the public key being placed on a target server to allow the user to connect to the server via SSH. The flow is similar for requesting a key pair for a service, though the request is made by an administrator through a different interface in the Keyfactor Command Management Portal. When used in inventory and publish policy mode, policies are published to the orchestrator from the Keyfactor Command server following this flow:
    • The Keyfactor Command server determines what content needs to go into the authorized_keys files for each logon on each target server. Content includes keys and associated comments aggregated from all servers where that key was found. For example, if a given public key exists on three different servers for the same user but in the original authorized_keys files the key is associated with a different comment on each server, when Keyfactor Command publishes the key down to the servers, it will be published with an aggregated comment string (all three comments together in each authorized_keys file).
    • Aggregate logon and key information pushed down to each orchestrator target.

    • Orchestrator determines where to place key information, builds the file, and overwrites the existing file with the new one. The process is done in this way to enforce policy and prevent rogue keys from being placed in authorized_keys files.

    • Orchestrator informs Keyfactor Command of the success or failure of each machine logon combination.

    Figure 549: SSH User Key Management Flow