Secure Shell (SSH) is mainly used for managing most of the world’s web servers. It creates a secure channel on top of an unsecured network by using the client-server model. The problem arises with the increase in the number of clients that leads to a
corresponding increase in the maintenance work for the server administration. This thesis offers an insight into this problem and the solution to it. The SSH Configuration Interface (SSH CI) is one possible solution to simplify the process. It’s a client-server application that provides a simple but intuitive user interface (UI) to the users, so they can upload their public key directly to the server. The server thereon handles the request and, thus, excludes the need of an administration interaction from this process.
The SSH protocol uses encryption to secure the connection between a client and a server. It’s mainly used to log into a remote machine and execute commands, but there are other useful features available like tunneling and forwarding of Transmission Control Protocol (TCP) ports. An SSH connection supports multiple methods of authentication, the most common being the public key authentication. The advantage of it over a simple password, for example, is security and flexibility. Public key authentication provides a security level that even extremely long passwords can’t offer. In a situation where multiple users have access to the same account on the server by using SSH key authentication, it is easy to revoke access to any of them just by deleting their public key from the server. No password has to be shared across the users.
Inhaltsverzeichnis (Table of Contents)
- 1 Introduction
- 2 Technologies
- 2.1 Multitier Architecture
- 2.1.1 Back-end
- 2.1.2 Front-end
- 2.2 Persistence Layer
- 2.2.1 Novell's Library for LDAP
- 2.3 NLog Framework
- 2.4 Security Layer
- 2.5 Tools
- 2.1 Multitier Architecture
- 3 Architecture
- 3.1 User Activity
- 3.2 Physical Deployment Model
- 3.3 Application Structure
- 3.3.1 MVC
- 3.3.2 Programming Model
- 3.3.3 Request Lifecycle
- 3.3.4 Dependency Injection
- 3.3.5 Improved Service Registration Mechanism
- 3.4 Data Access
- 3.4.1 Directory Service
- 3.4.2 Directory Service compared to DBMS
- 3.4.3 Authentication and Authorization
- 3.5 Configurations
- 4 Implementation
- 4.1 Hosting Environment
- 4.2 Error Handling
- 4.3 Logging
- 4.4 Identity Framework with LDAP
- 4.5 Key Storage Mechanism
- 4.6 Key Monitoring
- 4.7 Key Upload/Update
- 4.8 Key Delete
- 5 Security
- 5.1 Google reCaptcha v3
- 5.2 Open-Redirect Attack
Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)
The SSH Configuration Interface (SSH CI) aims to streamline the process of managing SSH access for numerous clients. It addresses the challenge of increasing administrative workload associated with a growing number of users requiring SSH access. The thesis explores the design and implementation of a client-server application that simplifies user authentication and key management, reducing the need for server administration intervention.
- User authentication and authorization
- Multitier architecture and its components
- Data storage and management using LDAP
- Security considerations and implementation of security features
- Implementation details and challenges faced during development
Zusammenfassung der Kapitel (Chapter Summaries)
- Chapter 1: Introduction This chapter sets the stage for the thesis by introducing the problem of managing SSH access for a large number of clients. It discusses the limitations of traditional SSH configuration methods and highlights the need for a more efficient solution.
- Chapter 2: Technologies This chapter delves into the technologies utilized in the development of the SSH CI. It discusses the multitier architecture employed, including front-end and back-end components. Additionally, it explores the persistence layer, focusing on LDAP as the chosen data storage mechanism. The chapter also introduces the NLog framework for logging and security considerations.
- Chapter 3: Architecture This chapter details the overall architecture of the SSH CI, including the application structure, data access mechanisms, and configurations. It explores the Model-View-Controller (MVC) pattern and its role in the application structure. The chapter also discusses the use of dependency injection and improved service registration mechanisms, as well as the advantages of using a directory service (LDAP) compared to a traditional database management system (DBMS).
- Chapter 4: Implementation This chapter focuses on the implementation aspects of the SSH CI. It discusses the hosting environment, error handling strategies, and the integration of the identity framework with LDAP. Additionally, it delves into the key storage and monitoring mechanisms, along with the key upload/update and deletion functionalities.
- Chapter 5: Security This chapter examines the security considerations and implementations in the SSH CI. It discusses the use of Google reCaptcha v3 for combating bot traffic and mitigating the risk of open-redirect attacks.
Schlüsselwörter (Keywords)
The main keywords and focus topics of this thesis include SSH, client-server architecture, user authentication, key management, LDAP, multitier architecture, security, Google reCaptcha, open-redirect attack, and efficient server administration.
Frequently Asked Questions
What is the SSH Configuration Interface (SSH CI)?
The SSH CI is a client-server application designed as a "student self-service portal." It allows users to upload their public SSH keys directly to a server, automating access management and reducing administrative workload.
How does SSH public key authentication work?
It uses a pair of cryptographic keys: a public key stored on the server and a private key kept by the user. This method is more secure and flexible than traditional passwords, as access can be easily revoked by deleting the public key.
Why is LDAP used for data storage in this project?
LDAP (Lightweight Directory Access Protocol) is used as the persistence layer because it is optimized for read-heavy operations and directory-style data, making it suitable for managing user identities and authentication.
What are the benefits of the multitier architecture used in SSH CI?
The multitier architecture separates the front-end, back-end, and persistence layers. This improves scalability, security, and maintainability by isolating different functional parts of the application.
How does the application protect against automated bot traffic?
The implementation includes Google reCaptcha v3, which helps identify and block bot activities without requiring user interaction, enhancing the overall security of the portal.
What is an open-redirect attack and how is it prevented?
An open-redirect attack involves tricking a user into being redirected to a malicious website. The SSH CI includes security measures to validate redirection targets and prevent such vulnerabilities.
- Arbeit zitieren
- Gheorghe Mironica (Autor:in), 2020, SSH Configuration Interface. Design and Implementation of a “student self-service portal” for accessing to Linux-VMs, München, GRIN Verlag, https://www.grin.com/document/1147465
