Secure Shell (SSHD Host)

Before Bravura Security Fabric can perform operations on an SSH target, you must:

You may also need to create manual lock files when targeting SSH systems that are slow to respond, or in case of issues with requests containing multiple operations, where only one operation is failing.

For each system, add a target (Manage the system >Resources >Target systems):

The SSH target system address syntax is entered as:

{[script=<ScriptFileName>;]server=<server>;[port=<port>;][compression=<true|false>;][hostKeys=<DenyUnmatch|AllowAppend>;][file=<FilePath>;][authkey=<AuthKeyPath>;]} 

Consult the documentation included with your specific application to learn how to create an account to use as a template in Bravura Identity . You can then add account attributes to determine how new accounts should be created based on the template account’s parameters.

Bravura Security Fabric still requires a template account, even though attributes may or may not be copied from the template account, for example, if the configured action for all account attributes is Set.

The attributes that define accounts are unique to specific applications; you must therefore create your own set of account attributes. You can view the complete list of attributes that Bravura Security Fabric can manage, including native and pseudo-attributes, using in the Manage the system (PSA) module account attributes menu. See Account attributes for more information.

If group management functions are supported by your application, you can configure Bravura Security Fabric’s workflow engine to manage group membership on your targets. You can also map profile attributes to group attributes on the target so that users can select groups when making a request; however, this method is currently incompatible with group management through Bravura Security Fabric ’s workflow configuration. Changes made in one method are not updated in the other.

For more information about account attributes and managed groups, see Groups.

When managing SSH keys for authentication keys and host keys for SSH targets, use the appropriate programs (sshkeygen for user keys and sshhostkey for host keys). Ensure that SSH keys are properly stored and managed to maintain security and prevent authentication issues.

For authentication keys, If you do not have a SSH key pair for the Bravura Security Fabric server, you need to manually create one using the sshkeygen program. The public key must be manually copied to the correct location on the target SSH system.

For host keys, the first time that agtssh connects to an SSH target, agtssh stores that target’s public key. On subsequent connections to the same target, agtssh validates the target’s public key against the previously stored value. In the event that a target’s public key has changed, agtssh does not update the stored value, but instead indicates that the value has changed. This behavior is intentional and is used to indicate that there might be a security issue. You must manually remove the old public key using the sshhostkey program and then reconnect to the target; the new value will then be stored. Host file keys are either stored in the registry or in the <Program Files path>\Bravura Security\Bravura Security Fabric\<instance>\ script\ directory. Storing host keys in the registry is preferred, but if you do opt to store the host keys in a kvg file using the “Host keys file” option, you should not need to manually modify this file. Rather, see the sshhostkey -f option.

To manage public host keys for SSH targets, use the sshhostkey program. See usage information for sshhostkey .

To manage the public/private authentication keys for SSH targets, use the sshkeygen program. See usage information for sshkeygen .

Keys for users are also either stored in the registry or in the <Program Files path>\Bravura Security\Bravura Security Fabric\<instance>\ script\ directory.

The agtssh program does not allow empty administrator passwords for password-based authentication, and it does not allow empty passphrases for public key authentication. Also, agtssh does not fall back on password authentication when using a private key file.

When public key authentication is used, the passphrase has to be provided. You must enter it in the target system’s administrator ID password field. If public key authentication is unavailable, agtssh will automatically use that field as the password for a target that does not recognize your public key or passphrase.

sshhostkey print|delete|verify|update -s <Server>:<Port> [-v] [-f <filename>] [--instance <instance>]

sshkeygen [options]

# KVGROUP-V1.0
"" "" = {
    "Comment" = " "
    "Encrypted" = " "
    "KeyFingerprint" = " "
    "KeyType" = " "
    "PrivateKey" = " "
    "PrivateMAC" = " "
    "PublicKey" = " "
}

# KVGROUP-V1.0
"" "" = {
    "A1-RSA-Signature" = "SSH PRIVATE KEY FILE FORMAT 1.1\n"
    "Comment" = " "
    "KeyFingerprint" = " "
    "RSA-SSH1-Key" = " "
    "authorized_keys" = " "
}

When configuring SSH connections, there are two general scenarios. The first involves generating a public/private key pair, then adding the public key to the authorized key file of the target SSH system. The second scenario entails using a pre-existing public/private key pair, typically in PEM/PPK format, such as when authenticating to an AWS UNIX instance.

To facilitate these processes,

Bravura Security Fabric provides two utilities, located in the utils directory, to facilitate this process:

Unable to find or validate private SSH authentication key [<path>] - [fall through/unknown key type.]. Falling back to username+password login.

sshkeyconvert [options]