SSH Key Authorization Rules and AuthZHelper

SSH Key Authorization Rules are the policies you define in Trust Protection Foundation (TPF) > SSH Manager for Machines that let you control SSH access. You can define access policy restrictions such as the maximum key age and required algorithm type, and then monitor how that policy is applied and tracked. Additionally, AuthZHelper can be used to enforce immediate revocation of compromised SSH keys globally and apply strict denial rules.

AuthZHelper is the component that connects your SSH hosts (servers) to the Trust Protection Foundation (TPF) instance and your SSH infrastructure. When a user attempts to open an SSH session, AuthZHelper sends the authorization information to TPF. TPF then checks the request against your SSH Key Authorization Rules and returns an allow or deny decision. This process provides consistent, policy‑driven access control and clear visibility into key usage, which helps you observe and enforce compliance with your SSH access policies.

AuthZHelper is an executable script, not a long-running agent. It does not require constant resources on the host nor does it continuously monitor activity. It is invoked (runs) only during SSH connection attempts to perform real‑time authorization based on your configured rules.

Why use SSH Key Authorization Rules and AuthZHelper

SSH Key Authorization Rules and AuthZHelper give you centralized, predictable control over SSH access, without forcing you to enforce compliance all at once.

They help you:

  • Use a Global Profile for the global policy settings. You set the standard authorization behavior once, and the system uses it everywhere.

  • Use Rules for exceptions. You can add specific deny rules for a certain account, host, or key.

  • Use existing Hosts and Keys as your source of truth. AuthZHelper passively relies on the authorized_keys files on each server. It brings these controls to your existing authorized keys management methods.

  • Get better visibility and audit records. You can see who/what connected, to which host, using which key, and when—all recorded centrally. The visibility and enforcement combine for both human (user) and machine (automated processes) identities.

  • Start safely, then enforce later. You can start in Observe Mode to see real activity first. Turn on Enforce Mode when you are ready.

This lowers risk and gives you clearer, more consistent SSH access control, observability, and reporting.

How AuthZHelper works

AuthZHelper integrates directly with sshd (the SSH server component) on each host. It is invoked (runs) only during SSH authorization and does not run as a long‑lived agent.

When a user attempts to connect using SSH, the process flow looks like this:

  1. User initiates SSH connection. The user connects to a host using an SSH key or SSH certificate.

  2. sshd calls AuthZHelper. During the authorization phase, sshd invokes AuthZHelper (for example, using the command AuthorizedKeysCommand) and passes details about the pending login.

  3. AuthZHelper gathers details and communicates with TPF.

  4. TPF records and (optionally) enforces the decision

    • In Observe Mode, TPF records authorization events centrally for visibility and reporting, but does not change the outcome of the SSH login.

    • In Enforce Mode, TPF uses your policies and rules to determine whether the authorization should be allowed or denied, and AuthZHelper’s response to sshd reflects that decision.

  5. TPF replies to AuthZHelper with an authorization result. AuthZHelper returns the allowed key/certificate material back to sshd (or nothing, if access should not be authorized).

  6. sshd continues managing the SSH session.

  7. After authorization completes, sshd manages the SSH session as normal. AuthZHelper is no longer involved until the next authorization attempt.

This entire process ensures that every SSH connection is evaluated in real-time against your centralized policies in TPF. Because AuthZHelper is only invoked during the initial login attempt, the process remains lightweight on the host server, providing consistent, immediate enforcement without requiring a constantly running agent.

Next steps

To deploy AuthZHelper, follow the instructions in Setting up AuthZHelper and SSH Key Authorization Rules. After AuthZHelper is installed and reporting data, use Managing and monitoring SSH Key Authorization Rules to review SSH access and apply monitoring or enforcement policies.