KeyBox

Inspiration

KeyBox is a web-based SSH console that centrally manages administrative access to systems. KeyBox combines key management and administration through profiles assigned to defined users.

Administrators can login using two-factor authentication with FreeOTP or Google Authenticatior. From there they can manage their public SSH keys or connect to their systems through a web-shell. Commands can be shared across shells to make patching easier and eliminate redundant command execution.

KeyBox layers TLS/SSL on top of SSH and can act as a bastion host for administration. Layering protocols for security is described in detail in The Security Implications of SSH whitepaper. SSH key management is enabled by default to prevent unmanaged public keys and enforce best practices.

How it works

Upon startup KeyBox generates a public key it uses to connect to systems after they have been registered (or you can supply a custom key pair) . Relationships between systems, administrators, and their keys are kept in an embedded H2 datastore. The authorized_keys file on registered systems are updated/refreshed periodically based on the relationships defined in the application. Users with full-privileges may review and disable any administrative key forcing rotation. The web-shell uses terms.js connecting via secure websockets to JSch session(s) running on the server.

What's next for KeyBox

Audit the administrative activity on the systems and prevent malicious users from deleting history or logs.

Built With

• h2
• java
• javascript
• jetty
• jsch
• terms.js