About the SSH keyset inventory list

The SSH keyset inventory shows you all the SSH keysets that are being tracked by Trust Protection Platform, allows you to filter your keyset list to find a specific group of keysets, allows you to create new keysets, and allows you to access the detailed information about each keyset in your system.

NOTE  To see keys and keysets, you will need to have both the Read and View permissions to the folders where the keys are stored in SSH Protect.

The keyset inventory page contains the filters panel on the left, and the keyset list on the right. The keyset list contains the following columns:

Column

Description

Access

Describes what access this keyset is used for. For User keysets, "<from> -> <to>" notation is used, with "unknown" meaning that there are no keys on client or server side and "many" meaning that there are multiple keys on client or server side.

Type

Type of keyset, either User (keys used for interactive and service user authentication) or Host (keys used for host identity).

Key Type

Shows the key algorithm and the length of the key.

Private

The number of private keys linked to the keyset.

Public

The number of public keys linked to the keyset.

Last Rotated

The date that the keyset was last rotated by Trust Protection Platform.

Risks

Security vulnerabilities or risks that have been identified for this keyset. See About SSH risks and how to resolve them for more details.

Status

The status of the keyset in Trust Protection Platform. Status can be one of:

  • OK - Keyset is in a steady state, but the keyset is not in a policy folder, so permissions are being inherited from the device.
  • OK-in policy - Keyset is in a steady state, and the keyset is in a policy folder. This keyset's permissions are managed by policy, and can be overridden on the keyset details page.
  • OK-migration to policy - Keyset is being moved to a policy folder as a background task. When this task is complete, the status will be updated.
  • Key Operation Running - keys are being added, deleted and/or edited in this keyset. 
  • Rotation Suspended - rotation has been suspended waiting for user interaction.
  • Rotation Failed - there was an unrecoverable issue with rotation.
  • Rolling Back - rotation is being rolled back.
  • Rollback Failed - there was an unrecoverable issue with rolling back rotation.
  • Keys out of sync - a rotation was attempted, but a device was not available, and the user chose to automatically skip disconnected devices. Reconnect the device and rotate the keyset again.
  • Environment Crossing - the private key and the public key for this keyset are in separate environments. Remove the key from one of the environments and issue separate key sets for different environments.

NIST Control Number

When Trust Protection Platform identifies a risk, at least one associated NIST Control Number is displayed. For details about the control number, see NIST Special Publication 800-53 (Rev. 4).

MD5 Finger print

The MD5 fingerprint associated with the keyset.

SHA256 Fingerprint

The SHA256 fingerprint associated with the keyset.

Keyset ID

Allows you to display the full keyset id for the keyset.

The keyset filter panel lets you filter the list of keysets in the inventory list to a subset of keysets that match a specific criteria.

The keyset filter is divided into two sections, common filters and properties. For more information see Finding SSH assets using filters.

If you are looking for a key with a specific fingerprint, you can enter the complete fingerprint in the quick match box at the top of the inventory screen.

To view an individual keyset, click the Access link. You see the keyset details page that lists not only information about the keyset, but also the linked private and public keys.

For more information on the keyset details page, see Keyset details.

By default, all available columns are displayed on the keyset inventory list. However, if you want to hide some columns or change the order, click the Edit Columns link.

Make any desired changes, and then click Apply.

Create New Keysets

When you need to establish new trusts, you can create new keysets. For more information, see Creating new keysets.