Challenges in Managing SSH Keys – and a Call for Solutions Tatu Ylonen University of Helsinki
[email protected] Abstract In some cases a single key can access tens of thousands of servers, such as for keys originally installed for emergency SSH (Secure Shell) uses public keys for authenticating servers response, auditing, or patch management purposes. Some of and users. While SSH’s key management design was great these keys are very old. for grass-roots deployments, it is now causing significant Second, extensive monitoring of the usage of the keys has operational and security challenges in large computing envi- revealed that typically about 90% of the authorized keys are ronments. This paper summarizes progress in SSH key man- unused. That is, they are access credentials that were provi- agement so far, highlights outstanding problems, and presents sioned years ago, the need for which ceased to exist or the requirements for a long-term solution. Proposals are solicited person having the private key left, and the authorized key from the research community to address the issue; so far the was never deprovisioned. Thus, the access was not terminated industry has been unable to come up with an ideal solution. when the need for it ceased to exist. This signifies a failure of The problem is of high practical importance, as most of our identify and access management (IAM) practices. critical Internet infrastructure, cloud services, and open source software development is protected using these keys. In many organizations – even very security-conscious or- ganizations – there are many times more obsolete authorized keys than they have employees.