Securing SSH Access by Pavel Shukhman at OWASP Ottawa Meetup, August 2019
- 1. Securing SSH Access Pavel Shukhman, OWASP Meetup Ottawa, August 2019
- 2. Attack Vectors • Brute-force attacks • SSH traffic intercepts (MITM) • Attacks on administrator workstations • Insider attacks Photo by Olga Levshina
- 3. PART 1. BRUTE-FORCE ATTACKS
- 4. Brute Force Today • Millions of daily brute-force attacks on a large honeypot built by UIUC (2017-2018) • Bots increasingly try keys • Chalubo IoT Botnet (September 2018) Photo by Markus Spiske on Unsplash
- 5. Protect from Brute Force - I • Disable password authentication • Disable root user access • White-list user logins that may access SSH • Use non-standard port, i.e. 5xxxx instead of 22
- 6. Protect from Brute Force - II • Limit the source IP range • Use 2FA on SSH, i.e. with Google- Authenticator • Just-in-time access configured on Provider • Add monitoring on auth.log
- 7. Protect from Brute Force - Tools • SSHGuard (default on GCP images) • Fail2ban (protects SSH and other services) • DenyHosts
- 9. MITM Vulnerabilities • SSH v1 was proven vulnerable in late 90-s • Theoretical vulnerability with CBC ciphers in November 2008 • Timing attacks • Snowden leaked information about NSA breaking SSH (Dec 2014)Photo by Samuel Zeller on Unsplash
- 10. MITM Mitigation • Update Ciphers block in sshd_config to only include strong ciphers (AES, ChaCha20) • Require only strong ciphers on clients • How to manage host keys?
- 11. Bastion-style Infrastructure • Idea: only allow external SSH on Bastion nodes • SSH to production nodes only done through Bastions • Mitigation of MITM honeypot because it is hard to replicate • Mitigates other attacks on infrastructure
- 12. Bastion Architecture VPC Bastions SSH SSH Application Nodes (only private IPs)
- 13. Signed SSH Certificates • HashiCorp Vault provides an open source solution • CA for signing public keys • Additional layer of security with host key signing • A PAM solution, but super-admin can circumvent
- 14. PART 3. ADMIN WORKSTATION
- 15. Suppose, laptop is broken into… What can an attacker get? • Private keys? • Host IPs? • Host public keys? • Cloud Service Provider tokens?
- 16. Known Hosts, Remote IPs, Host Keys • Add HashKnownHosts yes to ssh_config on client • Did not find an alternative on Windows • Essentially, remote IPs are hard to protect cat ~/.ssh/known_hosts
- 17. Where do you store private keys? • Your Laptop (Better: secured location on laptop) • USB key (Better: encrypted) • SmartCard (i.e. YubiKey) • Worst: When people start moving private keys around
- 18. Using YubiKeys • Best option security-wise • But: non-user-friendly configuration • Have to use PGP instead of standard SSH keys • Need at least 2 keys per person • Must generate keys on the card and back up cert
- 19. Authentication Strategies • Keep organization-wide inventory of public keys with rotation and scanners • LDAP / Kerberos • Signed certificates (HashiCorp Vault style)
- 20. Cloud Provider Access • Require MFA for Cloud Provider access • Try not to store access tokens on laptop • General hygiene: encrypted disks, secured access to OS, lock laptop when away, etc
- 21. PART 4. INSIDER ATTACKS
- 22. HR Considerations • Limit the number of SSH admins to minimum • Select most trusted people for the job (i.e., >2 years on the job) • Regular, at least bi-weekly, one-on-ones • Keep staff happy and motivated • Establish proper offboarding process
- 23. IAM, PIM, PAM • Mainly commercial tools in the space • May proxy SSH connections • May record SSH sessions • But questions remain
- 24. Remaining Questions on PIM, PAM • “You have to trust someone” (CS101) • Chicken-and-egg problem • What about PIM/PAM vendors? • Video recording of sessions not enough to prevent attacks (like street cameras)
- 25. Other Options • Minimize number of times when SSH access is needed • Shamir’s Secret Sharing principle and separation of concerns – a path forward • Open Source Solution – HashiCorp Vault • Recommendations solve many issues, but unable to mitigate all insider attacks
- 26. References • https://www.usenix.org/system/files/nsdi19-cao.pdf • https://en.wikipedia.org/wiki/Secure_Shell#Vulnerabilities • https://www.vaultproject.io/docs/secrets/ssh/signed-ssh- certificates.html • https://worklifenotes.com/2019/07/05/yubikey-for-ssh-on- windows-complete-walkthrough/ • https://www.engineerbetter.com/blog/yubikey-ssh/ • https://www.youtube.com/watch?v=exjorJyddok
- 27. About me, Pavel Shukhman • Working with Infrastructure, DevOps, DevSecOps, DataOps for more than 10 years • In the early stage of building Reliza, my 3rd self-founded Start-Up, and 5th total • https://www.linkedin.com/in/pshukhman
- 28. Thank you!