SSH Permissions

Permissions to use the SSH The SSH (secure shell) protocol provides for secure connections between computers. It provides several options for authentication, including public key, and protects the communications with strong encryption. areas of Keyfactor Command are controlled with three security roles specific to this purpose:

• Enterprise Admin
• Server Admin
• User

Most functions in the Management Portal are available to users with the Server Admin role for SSH. The Enterprise Admin role is used to grant administrators the permission to create server groups and change the owner of a server group (see SSH Server Groups). Other than these two things, users with the Server Admin role and those with the Enterprise Admin role have the same level of access. Users with the User role (and neither of the SSH admin roles) can access only the My SSH Key page to allow them to generate an SSH key pair In asymmetric cryptography, public keys are used together in a key pair with a private key. The private key is retained by the key's creator while the public key is widely distributed to any user or target needing to interact with the holder of the private key. for their own use.

Table 19: SSH Permissions Table shows the access users with each of these roles has to the SSH functions within the Management Portal.

Table 19: SSH Permissions Table

Action	SSH Enterprise Admin	SSH Server Admin	SSH User
User Key: Generate and Rotate (My SSH Key)	Yes	Yes	Yes
User Key: Download (My SSH Key)	Yes	Yes	Yes
Service Account Key: View and Search for Service Account Keys	Yes	Limited1 Users with the Server Admin role may only view and search for service account keys that are in server groups they own.	No
Service Account Key: Add	Yes	Limited2 Users with the Server Admin role may only create service account keys in server groups they own.	No
Service Account Key: Edit	Yes	Limited3 Users with the Server Admin role may only view and edit service account keys that are in server groups they own.	No
Service Account Key: Delete	Yes	Limited4 Users with the Server Admin role may only view and delete service account keys that are in server groups they own.	No
Service Account Key: Download	Yes	Limited5 Users with the Server Admin role may only view and download service account keys that are in server groups they own.	No
Unmanaged Keys: View and Search for Unmanaged Keys	Yes	Yes6 Users with the Server Admin role may only view and delete unmanaged keys that are in server groups they own.	No
Unmanaged Keys: Delete	Yes	Yes7 Users with the Server Admin role may only view and delete unmanaged keys that are in server groups they own.	No
Server Group: View and Search for Server Groups	Yes	Limited8 Users with the Server Admin role may only view and search for server groups they own.	No
Server Group: Add	Yes	No	No
Server Group: Edit	Yes	Limited9 Only users with the Enterprise Admin role may change the owner of a server group. Users with the Server Admin role may change other settings when editing a server group.	No
Server Group: Delete	Yes	No	No
Server Group: View Members of a Server Group	Yes	Limited10 Users with the Server Admin role may only view the servers in server groups they own.	No
Server Group: Edit Access (map an SSH key to a logon for a server group)	Yes	Limited11 Users with the Server Admin role may only map SSH keys from user accounts to Linux logons on servers that are in server groups they own.	No
Server: View and Search for Servers	Yes	Limited12 Users with the Server Admin role may only view and search for servers that are in server groups they own.	No
Server: Add	Yes13 In order to create new servers, these users must also hold the Agent Management - Read role.	Limited14 Users with the Server Admin role may only create new servers as members of server groups that they own. In order to create new servers, these users must also hold the Agent Management - Read role.	No
Server: Edit	Yes	Limited15 Users with the Server Admin role may only view and edit servers that are in server groups they own.	No
Server: Edit Access (map an SSH key to a logon on a server)	Yes	Limited16 Users with the Server Admin role may only map SSH keys from user accounts to Linux logons on servers that are in server groups they own.	No
Server: Delete	Yes	Limited17 Users with the Server Admin role may only view and delete servers that are in server groups they own.	No
Logon: View and Search for Logons	Yes	Limited18 Users with the Server Admin role may only view and search for logons that are in server groups they own.	No
Logon: Add	Yes	Limited19 Users with the Server Admin role may only create new logons on servers that are members of server groups that they own.	No
Logon: Edit	Yes	Limited20 Users with the Server Admin role may only view and edit logons that are on servers in server groups they own.	No
Logon: Edit Access (map an SSH key to a logon)	Yes	Limited21 Users with the Server Admin role may only map SSH keys from user accounts to Linux logons on servers that are in server groups they own.	No
Logon: Delete	Yes	Limited22 Users with the Server Admin role may only view and delete logons that are on servers in server groups they own.	No
User: View and Search for Users	Yes	Limited23 Users with the Server Admin role may only view and search for users that are associated with logons that are in server groups they own.	No
User: Edit Access (map an SSH key to a logon)	Yes	Limited24 Users with the Server Admin role may only map SSH keys from user accounts to Linux logons on servers that are members of server groups that they own.	No
User: Delete	Yes	Limited25 Users with the Server Admin role may only view and delete users that are associated with logons that are in server groups they own.	No