[OPS-AREA] SSH Key Management for Automated access

A new draft "SSH Key Management for Automated Access - Current Recommended Practice" has been published on managing SSH keys.  The topic has been discussed in SAAG in the last two IETF meetings, and we also had a side meeting on the topic in Orlando.  I'm sending this to ops-area, because the topic relates to operations and management more than technical details on security (though admittedly more to general management of IT systems, especially unix/linux environments, than management of routers or networks, but SSH is also very widely used for managing routers and telecommunications networks).

The draft can be found at https://tools.ietf.org/html/draft-ylonen-sshkeybcp-01

The draft is relevant for anyone interested in SSH user key management and more generally identity and access management for automated access and/or based on the SSH protocol.  We have found hundreds of thousands to millions of SSH authorized keys from the IT environments of many large enterprises (many times more than they have interactive users), and bringing key-based access under control is very important.  The draft outlines the risks with unmanaged key-based access and presents a process for remediating the situation in an existing environment and implementing an ongoing process for monitoring and managing key-based access (and other automated access).

I am hoping the draft will evolve into a BCP (Best Current Practice) standard on managing SSH user keys in organizations.  The draft is mostly about process and policy, not technical protocols, as SSH user key management is really an identity and access management issue and the problems involve policy, process, and auditing related to controlling access to information systems in an organization, especially with regards to automated machine-to-machine access.

A mailing list sshmgmt@ietf.org has been created for discussion about the draft (and other issues related to managing SSH).  Please send comments on the draft to the list.  To subscribe (or unsubscribe), go to: https://www.ietf.org/mailman/listinfo/sshmgmt

Regards,

Tatu Ylonen