Secure access to a corporate application in an SSH session using a transparent SSH proxy
Secure access to a corporate application in an SSH session using a transparent SSH proxy. In some embodiments, a method may include receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter. The method may also include forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request. The method may further include brokering, by the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy, with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD.
1. A computer-implemented method for secure access to a corporate application in a secure shell (SSH) session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising:
receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter;
forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and
brokering, between the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy deployed at the secure access cloud PoD, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD.
2. The method of claim 1 , wherein the transparent SSH proxy comprises an SSH server paired with an SSH client that are both transparent to the client application.
3. The method of claim 2 , further comprising:
receiving SSH session requests, at the SSH server, from the client application;
sending the SSH session requests, from the SSH server, to the SSH client; and
sending the SSH session requests, from the SSH client, to the corporate application via the connector.
4. The method of claim 3 , wherein authentication between the client application and the SSH server is separate from authentication between the SSH client and the corporate application to prevent direct access to the corporate application by the client application.
5. The method of claim 1 , wherein the transparent SSH proxy comprises:
an SSH server paired with an SSH client that are both transparent to the client application; and
an HTTP/S proxy.
6. The method of claim 5 , further comprising:
receiving SSH session requests, at the HTTP/S proxy, from the client application;
sending the SSH session requests, from the HTTP/S proxy, to the SSH server;
sending the SSH session requests, from the SSH server, to the SSH client; and
sending the SSH session requests, from the SSH client, to the corporate application via the connector.
7. The method of claim 6 , wherein authentication between the client application and the SSH server is separate from authentication between the SSH client and the corporate application to prevent direct access to the corporate application by the client application.
8. A computer-implemented method for secure access to a corporate application in an SSH session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising:
receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter;
forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and
brokering, between the connector and the secure access cloud PoD, authentication of a user using an identity provider (IdP), authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy deployed at the secure access cloud PoD, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD.
9. The method of claim 8 , wherein the authentication of the user using the IdP comprises: the user logging in to a web portal;
redirecting the user to the IdP which enforces authentication of the user;
returning, from the IdP, a token; and
authenticating the user in the SSH session using the token.
10. The method of claim 9 , wherein the IdP enforces Multi-Factor Authentication (MFA) of the user.
11. The method of claim 8 , wherein the authentication of the user using the IdP comprises:
the user logging in to a web portal;
redirecting the user to the IdP which enforces authentication of the user;
returning, from the IdP, an SSH certificate; and
authenticating the user in the SSH session using the SSH certificate.
12. The method of claim 11 , wherein the IdP enforces Multi-Factor Authentication (MFA) of the user.
13. The method of claim 11 , wherein the SSH certificate is also used for the authorization of access by the user.
14. The method of claim 13 , wherein an expiration of the SSH certificate is controlled by the transparent SSH proxy.
15. The method of claim 13 , wherein a validity of the SSH certificate is controlled by the transparent SSH proxy.
16. The method of claim 11 , further comprising enforcing an out-of-bound second factor authentication request to the user.
17. A computer-implemented method for secure access to a corporate application in an SSH session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising:
receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter;
forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and
brokering, between the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy, deployed at the secure access cloud PoD, the SSH proxy having a transparent SSH agent, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD.
18. The method of claim 17 , wherein the transparent SSH agent creates session keys for the SSH session.
19. The method of claim 17 , wherein the transparent SSH agent enforces authorization policy for the SSH session.
20. The method of claim 17 , wherein the transparent SSH agent caches SSH keys/credentials for the SSH session and allows automated authentication of the user.