[saag] SSH user key management

A new draft "SSH Key Management for Automated Access - Current Recommended Practice" is now available at https://tools.ietf.org/html/draft-ylonen-sshkeybcp-01

The draft is relevant for anyone interested in SSH user key management and more generally identity and access management.  We have found hundreds of thousands to millions of SSH authorized keys from the IT environments of many large enterprises (many times more than they have interactive users), and bringing key-based access under control is very important.  The draft outlines the risks with unmanaged key-based access and presents a process for remediating the situation in an existing environment and implanting an ongoing process for monitoring and managing key-based access (and other automated passwordless access).

I am hoping the draft will evolve into a BCP (Best Current Practice) standard on managing SSH user keys in organizations.  The draft is mostly about process and policy, not technical protocols, as SSH user key management is really an identity and access management issue and the related problems largely policy, process, and auditing issues related to controlling access to information systems in an organization, especially with regards to automated machine-to-machine access.

A mailing list sshmgmt@ietf.org has been created for discussion about the draft (and other issues related to managing SSH).  Please send comments on the draft to the list.  To subscribe (or unsubscribe), go to: https://www.ietf.org/mailman/listinfo/sshmgmt

Regards,

Tatu Ylonen

[saag] SSH user key management - new draft and mailing list