Two-step authentication auditing system based on SSHCertificate and LDAP

Abstract

The invention discloses a two-step authentication auditing system based on SSH Certificate and LDAP. The two-step authentication auditing system based on SSH Certificate and LDAP comprises the following steps: step (1), when a domain administrator creates a user in a domain (or LDAP) server, creating a corresponding ObjectClass attribute for the user to store sshpublickey and Role information, filling a corresponding user public key and a role corresponding to an authority which can be obtained by the user, and due to safety consideration, only inputting a public key pair based on an ED25519 algorithm by internal requirements, and the domain administrator audits the public key security algorithm and the authority corresponding to the role. According to the system, the instability of loginauthentication service is greatly improved, all subsequent authentication passes through a digital signature mode after internal authentication is completed, a third-party system is not involved during transnational network server authentication, the availability of the whole service is ensured as much as possible, and after authentication is completed in the VPN network of the OA, the limitationof the VPN can be broken away in a short time, the influence of the fault of the OA system is avoided, and higher flexibility is provided.

Description

technical field [0001] The invention relates to the technical field of server security, in particular to a two-step authentication and auditing system based on SSH Certificate and LDAP. Background technique [0002] SSH is a remote management service for Unix / Linux servers. Commonly used login authentication methods are only passwords and public / private keys for user authentication. Among them, the password method has defects such as easy leakage and dissemination, difficult control, and low security. [0003] The public key / key method has high security, but in large-scale servers, the management is aimed at IT / operation and maintenance management personnel changes, and the cost of updating and replacing is relatively high, and systems such as bastion hosts also have security loopholes and hidden dangers. The vulnerability itself leads to the leakage of the private key, which will lead to the complete exposure of the server. [0004] At the same time, the company / organizat...

AI Technical Summary

Problems solved by technology

[0005] In addition, for different departments or groups in the same company / organization, it is hoped to isolate or differentiate the use of bastion hosts, and provide combined authentication capabilities for personnel across departments / groups. The original SSH system basically cannot meet the above highly customized requirements.

[0006] At the same time, the current hybrid cloud platform of public cloud / private cloud may involve the deployment of online business systems across countries or even across continents. The simple point-to-point authentication method cannot achieve stable security and availability guarantees in such a complex network situation and hybrid cloud environment.

Images