Managing and monitoring SSH Key Authorization Rules

SSH Manager, using AuthZHelper allows administrators to observe and control SSH access through the Trust Protection Foundationweb admin console. AuthZHelper reports real-time authorization data to TPF, providing visibility into who is connecting, which hosts they are accessing, and which keys they are using.

An SSH Key Authorization Rule is a summary of these authorization events, mapping a specific combination of Hostname, Account, and SSH key fingerprint.

Before you begin: Ensure that the AuthZHelper utility is installed, configured, and authenticated so that SSH authorization events are reported to the system. See Setting up AuthZHelper and SSH Key Authorization Rules.

Working with Rules Modes: Observe vs. Enforce

Authorization rules operate in one of two modes. The mode determines how the system handles connection attempts for a specific host and account:

• Observe (Learning Mode): This is the default mode. The system monitors SSH traffic and automatically records new connections as "Observed" rules. In this mode, all connections are allowed by default unless a key is explicitly denied. Use this mode to build an inventory of legitimate access before locking down an account.

• Enforce (Lockdown Mode): In this mode, the system adopts a "positive authorization" model. Only keys explicitly marked as Allowed can connect. Any other key—including those in the "Observed" state—is automatically rejected. This is known as an Implicit Deny.

Key Authorization States

The state of a key within a rule determines its access level based on the current mode:

State	Description	Access in Observe Mode	Access in Enforce Mode
Observed	A newly discovered key that has not yet been reviewed.	Allowed	Denied (Implicit Deny)
Allowed	A trusted key explicitly approved by an administrator.	Allowed	Allowed
Denied	A key explicitly blocked for this specific host and account.	Denied	Denied
Revoked	A key globally blocked across the entire organization.	Denied	Denied

Transitioning to Enforce Mode

To safely lock down an account without disrupting legitimate access, follow these steps:

1. In the SSH Key Authorization Rules inventory, locate the rule for the target host and account.

2. Review the list of Observed keys.

3. For each trusted key, click Allow Authorization to change its state to Allowed.

4. Once all legitimate keys are approved, click Change Impact.

5. Review the confirmation dialog. The system will warn you that switching to Enforce mode will immediately block all keys not marked as Allowed.

6. Confirm the change to switch the rule to Enforce mode.

Monitoring and Troubleshooting

• Implicit Deny Visibility: Connection attempts blocked by an implicit deny are recorded in the TPF logs and appear in the Rules Inventory as implicitly denied entries for audit and review.

• Keyset Links: Keyset names in the inventory are clickable links that open the corresponding Keyset details in a new tab.

 

---

Manage SSH Authorization Profile policy

The SSH authorization profile controls how SSH Manager evaluates and, if needed, blocks SSH connections across your environment based on global cryptographic standards. SSH Manager uses AuthZHelper to record and evaluate each incoming SSH connection against these profile settings..

Use the profile to:

• Decide how compliance violations are handled globally (Observe or Enforce mode).

• Control which cryptographic algorithms are allowed.

• Control how long a key can be used for authorization. Key age is calculated from the First Seen timestamp when the key was first recorded by AuthZHelper.

Before you begin

Make sure that AuthZHelper is installed, configured, authenticated, and reporting SSH authorization events to Trust Protection Foundation (TPF). The Authorization menu in the TPF admin console is available only after AuthZHelper is running correctly.

Open the Profile Policy page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager.

3. In the main navigation menu, select Authorization > Profile > Profile Policy.

The Profile Policy page displays the current SSH authorization profile along with its enforcement and key policy settings.

Choose Observe or Enforce mode

The selected mode determines whether SSH connections that violate cryptographic or key age policies are only observed and flagged or actively blocked:

• Observe mode:

  • All SSH connections are evaluated and logged.

  • If a connection does not meet the profile settings, the connection is still permitted. On the SSH Key Authorization Rules page, the rule's Effective Access displays Allowed, and the Status column displays a Compliance Warning badge.

  • In the nested Keys table, the key displays its active authorization state.

  • Use Observe mode when initially onboarding systems or rolling out new cryptographic standards so you can assess potential impact before blocking access.

• Enforce mode:

  • SSH connections that do not meet the profile settings are immediately blocked at authentication.

  • On the SSH Key Authorization Rules page, the rule's Effective Access displays Denied.

  • In the nested Keys table, the key's State displays Denied (Compliance).

  • Details about blocked connection attempts are recorded in Trust Protection Foundation system logs.

  CAUTION: Switching directly to Enforce mode without prior observation may unintentionally block valid SSH access across your network.

Specify allowed algorithms

Under Key Settings, use Allowed Algorithms to define which SSH key algorithms are permitted (such as RSA, ECDSA, or Ed25519):

• These settings control which key types are considered compliant across your environment.

• In Observe mode: connections that use disallowed algorithms are recorded as non‑compliant, but not blocked.

• In Enforce mode: connections using disallowed algorithms are blocked.

Restricting algorithms helps enforce organization-wide cryptographic standards and eliminate weak or obsolete ciphers.

Set maximum key age

Use Maximum key age (days) to define how long an SSH key can remain in active use before requiring rotation:

• Key age is calculated from the First Seen timestamp when the key was first recorded by AuthZHelper.

• In Observe mode: Keys that exceed the maximum age threshold are flagged with a Compliance Warning in the Status column.

• In Enforce mode: Connections attempting to authenticate with over-age keys are blocked and display Denied (Compliance).

This setting helps automate compliance reporting, drive regular SSH key rotation, and minimize risks associated with stale, unmanaged credentials.

---

Manage SSH Authorization Permissions

Use the Permissions page to see who can view and manage this SSH authorization profile and related items. From here, you can:

• Grant or remove access for specific identity objects (users, groups, directories)

• See which permissions are set directly on this profile

• See which permissions are inherited from higher levels

This helps you control who can view authorization data, change policy, and revoke keys.

Open the Permissions page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager.

3. In the main navigation menu, select Authorization > Profile > Permissions.

Manage local permissions

The Local Permissions page shows the permissions set directly on an object (for example, the current SSH Authorization Profile). These permissions also apply to any objects below it in the tree.

Use this page to:

• Add or remove identity items

• Adjust what each identity item is allowed to do

You can:

• Use Filter Identities to search for a specific user or group.

• For each identity, select the checkboxes that match the access you want to allow, such as:

  • View – See this identity item.

  • Read – View details and configuration.

  • Write – Change settings.

  • Manage Policy – Change SSH authorization policy for this item.

  • Create / Delete / Rename / Associate / Revoke – Create or remove related items, link items, or revoke.

  • Read Private Key / Write Private Key – View or manage private key material (use with care).

  Apply permissions for Authorization Profile and Inventory as:

  Permission level	Profile page	Inventory
  No rights	Authorization menu group is hidden. GetRules API is restricted.
  View	Authorization menu group is hidden. GetRules API is restricted.
  Read	Read Only	Read Only
  Read+Write	Read Only	Read Only
  Read+Write+Revoke	Read Only	Can Revoke/Deny
  Read+Write+Manage Policy	Can Edit	Read Only
  Read+Write+Manage Policy+Revoke	Can Edit	Can Revoke/Deny

Add an identity to local permissions

You can give a user or group specific permissions on this SSH authorization object (for example, the default SSH Authorization profile).

Click the +Add Identity button, select the name of the user or group, and then choose the permissions you want to grant by selecting one or more checkboxes:

• View – See this identity item in the UI.

• Read – View full details and configuration.

• Write – Change settings on this identity item.

• Manage Policy – Change SSH authorization policy for this identity item.

• Create – Create related objects under this identity item.

• Delete – Remove this item or related objects.

• Rename – Change the name of this identity item.

• Associate – Link this item to other objects.

• Revoke – Revoke keys or related identity items.

• Read Private Key – View private key material.

• Write Private Key – Upload or replace private key material.

• Manage Permissions – Change who has access (add/remove identities, change their rights).

The identity item appears in Local Permissions and its rights are included in Cumulative Permissions for this object and any child objects.

Manage cumulative permissions

Cumulative Permissions show all permissions that apply to an identity item, including:

• Permissions set locally on the identity item

• Permissions inherited from parent objects

This view helps you understand the effective access for each identity.

Key points:

• Group membership is not taken into account in the table. It shows only permissions granted directly to each listed identity item.

• To see where a permission came from, you can:

  • Click the identity name, or

    Use Troubleshoot Permissions (link in the explanation) for a detailed view of inherited and direct permissions.

Use this information when you need to:

• Confirm who can view or modify this profile

• Verify that sensitive permissions (like Manage Policy, Revoke, Read/Write Private Key, or Manage Permissions) are only assigned to the right admins

• Diagnose why someone can or cannot access this identity item

---

Manage SSH Key Authorization Rules

An SSH key authorization rule is a rolled-up summary of an SSH key authorization event (for example, Hostname, Account, and SSH key fingerprint).

Open the SSH Key Authorization Rules page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager.

3. Select Authorization > Rules.

Review SSH Key Authorization Rule details

Each rule provides a rolled-up summary of SSH authorization activity for a specific host and account. Use these details to audit access, assess compliance, and identify potential security risks.

• Host and Account: The target server and the Linux account used for the connection.

• Effective Access: The net authorization outcome evaluated for the rule (positioned as the third column in the grid):

  • Allowed — The rule grants SSH access to the target host and account.

  • Denied — Access is blocked due to an administrative deny rule, compliance profile violation, expired key, or default deny logic.

• Status: Displays the policy compliance and evaluation state:

  • Compliant — The connection meets all active authorization rules and compliance profile requirements.

  • Compliance Warning — The connection was evaluated against a compliance profile in Observe mode where violations (such as key age or disallowed algorithms) were detected, but access was not blocked.

• Impact: Indicates the current rule mode (Observe or Enforce).

• Keyset: A clickable link that opens the Keyset details in a new tab. Expanding a rule reveals the nested keys table, which displays the individual State for each key:

  • Allowed — Key is valid and authorized for connection.

  • Denied (Admin) — Access blocked by an administrator rule override.

  • Denied (Default deny) — Access blocked because no active rule explicitly allows the key.

  • Denied (Compliance) — Access blocked due to a Compliance Profile violation in Enforce mode.

  • Revoked — Key has been permanently invalidated across the environment.

  • Expired — Key has exceeded its maximum validity lifetime.

• Usage and Seen Dates: Tracks how many times the rule was evaluated and displays the first seen and last seen timestamps.

Manage Rule Impact and Authorization

Use the action buttons to transition rules and manage trusted access:

• Allow Authorization: Promotes an Observed key to the Allowed state. In Enforce mode, only keys in the Allowed state can establish an SSH connection.

• Change Impact: Toggles the rule between Observe and Enforce modes.

  • Switching to Enforce immediately locks down the account, applying a Default Deny (Implicit Deny) to all keys not explicitly marked as Allowed.

  • A confirmation dialog appears to warn you of the impact before the change is applied.

• Deny Authorization: Explicitly blocks a specific host-account-key combination, setting its state to Denied (Admin) regardless of the rule mode.

• Revoke Key: Permanently invalidates an SSH key across the entire environment, setting its state to Revoked.

---

Manage SSH Key Authorization Hosts

Use the SSH Key Authorization Hosts page to see which servers and machines are being accessed over SSH and how they are used over time. Each entry in the table represents one destination host.

SSH key authorization hosts are tracked over time so you can see when a host first appeared, how often it is accessed, and which accounts, keys, and authorization activity are linked to it.

You can not block access directly from this page. Instead, use the information on this page to decide where action is needed (for example, which hosts you should investigate on the SSH Key Authorization Rules page or where you might need to revoke a key).

Open the SSH Key Authorization Hosts page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager.

3. Select Authorization > Hosts

The SSH Key Authorization Hosts page lists each host detected during SSH connection attempts.

Analyze SSH Key Authorization Host details

The SSH Key Authorization Hosts page reports information such as:

• Hostname and IP address

• Number of Linux accounts used to access the host

• Number of SSH keys used on the host (Keys)

• Number of authorization entries linked to the host (Rules)

• When the host was first accessed and most recently accessed

• The version of AuthZHelper installed on the host

When analyzing the records, pay attention to:

• Hosts with many accounts or keys, which may indicate key sprawl

• Hosts that appear unexpectedly or are outside planned infrastructure

• Hosts with frequent or recent activity linked to non‑compliant rules

• Hosts running an outdated AuthZHelper version, which may limit enforcement

---

Manage SSH Authorization Keys

The SSH Authorization Keys page lets administrators see which SSH keys and certificates are being used to access hosts in the environment and how they are used over time. Each entry represents one SSH credential that has been observed during SSH authorization activity.

Keys are tracked centrally so you can see where a key is used, how often it is used, and whether it should still be trusted. Use this page to identify risky credentials and decide when a key should be more closely monitored or revoked.

Be aware that revoking a key is permanent. Once a key is revoked, it cannot be used again.

Open the SSH Authorization Keys page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager.

3. Select Authorization > Keys.

The SSH Authorization Keys page reports all SSH keys and certificates observed during SSH connections.

Analyze key details

Each entry represents a unique SSH credential observed during authorization activity. Use these details to identify widely used or risky credentials.

• Key Fingerprint: The unique identifier for the key.

• Algorithm: The cryptographic algorithm used by the key.

• Hosts: The number of unique hosts where this key has been used.

• Status: Violations, if any.

• First and Last Seen: Timestamps tracking the lifecycle of the key's activity in your environment.

Revoke keys

Use Revoke Key to permanently invalidate an SSH key or certificate across the entire organization.

• Impact: Revoking a key immediately blocks it on all hosts, regardless of individual rule settings or profile modes. In the nested keys table on the SSH Key Authorization Rules page, the key's State updates to Revoked across all associated rules.

• Scope vs. Deny Authorization: Revocation cannot be undone and applies globally. If you only want to block access for a specific host and account combination rather than revoking the key everywhere, use Deny Authorization on the SSH Key Authorization Rules page instead, which sets the key state to Denied (Admin).

• Confirmation: Before you confirm, the system displays a summary showing exactly how many hosts and authorization rules will be affected by the revocation.

---