Secure shell public key audit system
A system for auditing authorized key files associated with secure shell (SSH) servers is disclosed. In an example, the system may include a purpose-built SSH audit server. The SSH audit server may be configured to receive an authorized key file and a list of users. The SSH audit sever may generate and provide unique registration codes for each of the users in the list. The SSH audit server may associate particular users with particular public keys as each of the users accesses the SSH audit server using a public key and inputs a registration code.
1. A system, comprising:
one or more communication interfaces to communicate with one or more client devices;
one or more hardware processors; and
computer-readable storage media storing computer-executable instructions, which when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
receive a request to open a secure communication channel from a client device associated with an individual, the request including information generated based at least in part on a private key;
authenticate the request based at least in part on a public key associated with the individual;
receive a registration code from the client device corresponding to the individual;
attempt to validate the registration code by determining whether the registration code is valid for the individual;
mark the public key for further investigation responsive to determining that the registration code is invalid for the individual;
based on the further investigation, determining an identity of an owner of the private key;
based on the identity of the owner of the private key, permit a second registration code to be received from the client device; and
associate the individual with the public key based on the second registration code.
2. The system of claim 1 , the request includes a request to open a secure communication channel from the client device the operations further comprising:
open the secure communication channel;
request input of any registration code;
in response to requesting input of the any registration code, receiving the registration code from the client device; and
associate the individual with the public key.
3. The system of claim 2 , the operations further comprising identify the registration code as valid by matching the registration code with a predetermined registration code.
4. The system of claim 2 , the operations further comprising identify the registration code as invalid by failing to match the registration code with a predetermined registration code; and
remove the public key from an authorized key file.
5. A method, comprising:
generating, at an audit server, a unique registration code;
associating the unique registration code with a user;
sending the unique registration code to a client device of the user;
receiving a public key and a request to open a communication channel from the client device;
establishing the communication channel based at least in part on the public key;
receiving an input of a registration code from the client device;
attempting to validate the registration code by determining whether the registration code corresponds to the unique registration code;
marking the public key for further investigation responsive to determining that the registration code does not correspond to the unique registration code;
based on the further investigation of the public key, determining an identity of an owner of a private key that is associated with the client device;
based on the identity of the owner of the private key, permitting a second registration code to be received from the client device; and
associating the user with the public key based on the second registration code.
6. The method of claim 5 , further comprising:
generating a second unique registration code;
associating the second unique registration code with a second user;
sending the second unique registration code to a second client device of the second user;
receiving a second request to open a second communication channel from the second client device;
establishing the second communication channel based at least in part on a second public key;
receiving a second input of the second unique registration code from the second client device; and
associating the second user with the second public key based at least in part on receiving the second unique registration code via the second communication channel.
7. The method of claim 5 , further comprising sending a login credential to the client device to establish the communication channel with the audit server.
8. The method of claim 5 , wherein the communication channel includes a secure shell.
9. The method of claim 5 , further comprising:
receiving, prior to generating the unique registration code, an authorized key file associated with a server being audited, the authorized key file including the public key; and
receiving, prior to generating the unique registration code, contact information associated with a plurality of individuals authorized to access the server, the plurality of individuals including the user.
10. One or more non-transitory computer-readable storage media configured to store computer-executable instructions, which when executed by one or more processors, cause a system to perform operations comprising:
generate a plurality of registration codes, a registration code of the plurality of registration codes associated with a user;
send the registration code to a client device of the user;
receive an input of the registration code over a communication channel established based in part on a public key;
attempt to validate the registration code by determining whether the registration code is valid for the user;
mark the public key for further investigation responsive to determining that the registration code is invalid for the user;
based on the further investigation of the public key, determine an identity of an owner of a private key that is associated with the client device;
based on the identity of the owner of the private key, permit a second registration code to be received from the client device; and
associate the user with the public key based on the second registration code.
11. The one or more non-transitory computer-readable storage media of claim 10 , wherein execution of the instructions further cause the system to receive, prior to generating the registration code, contact information associated with a plurality of individuals authorized to access a server being audited, the plurality of individuals including the user.
12. The one or more non-transitory computer-readable storage media of claim 10 , wherein execution of the instructions further cause the system to receive, prior to generating the plurality of registration codes, an authorized key file associated with a server being audited, the authorized key file including the public key.
13. The one or more non-transitory computer-readable storage media of claim 10 , wherein execution of the instructions further cause the system to:
receive a request to open the communication channel from the client device; and
establish the communication channel based at least in part on the public key.
14. The one or more non-transitory computer-readable storage media of claim 10 , wherein the one or more non-transitory computer-readable storage media is a resource associated with a secure shell audit server.
15. The one or more non-transitory computer-readable storage media as recited in claim 10 , wherein execution of the instructions further cause the system to generate a list of registered public keys, the list of registered public keys including the public key and an indication of the user as an owner of the public key.
16. The one or more non-transitory computer-readable storage media as recited in claim 15 , wherein execution of the instructions further cause the system to provide the list of registered public keys to an administrator system after a predetermined period of time has elapsed.