Managing and monitoring SSH Key Authorization Rules

SSH Manager for Machines running AuthZHelper lets administrators observe and control SSH access by using the Trust Protection Foundation (TPF) > SSH Manager for Machines admin console. AuthZHelper reports SSH authorization information to TPF so you can see who is connecting, where they connect, and which keys they use.

An SSH Key Authorization Rule is a rolled-up summary of an SSH authorization event (for example, Hostname, Account, and SSH key fingerprint). SSH Manager updates the rule and reports key usage over time (First Seen, Last Seen, and Usage).

Before you begin: Ensure that the AuthZHelper utility is installed, configured, and authenticated so that SSH authorization events are reported to the system. See Setting up AuthZHelper and SSH Key Authorization Rules.

Use this topic to complete the following tasks:

• Manage SSH Authorization Profile policy

• Manage SSH Authorization Permissions

• Manage SSH Key Authorization Rules

• Manage SSH Key Authorization Hosts

• Manage SSH Authorization Keys

---

Manage SSH Authorization Profile policy

The SSH authorization profile controls how SSH Manager evaluates and, if needed, blocks SSH connections in your environment. SSH Manager uses AuthZHelper to record and evaluate each incoming SSH connection against the profile settings. This improves your ability to observe and control SSH authorization activity on your network.

Use the profile to:

• Decide how SSH connections are handled (Observe or Enforce)

• Control which cryptographic algorithms are allowed

• Enforce SSH key rotation by limiting key age

Before you begin

Make sure that AuthZHelper is installed, configured, authenticated, and reporting SSH authorization events to Trust Protection Foundation (TPF). The Authorization menu in the TPF admin console is available only after AuthZHelper is running correctly.

Open the Profile Policy page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager for Machines.

3. In the main navigation menu, select Authorization > Profile > Profile Policy.

The Profile Policy page displays the current SSH authorization profile and its enforcement and policy settings.

Choose Observe or Enforce mode

The selected mode determines whether SSH connections are only observed or also when they are not compliant with policy.

Observe mode

• All SSH connections are evaluated and logged.

• If a connection does not meet policy, the rule is marked as a policy violation.

• You can review authorization rules and compliance details on the SSH Key Authorization Rules page.

• Without a connection to TPF, if a local authorized key exists (for example, in authorized_keys), the connection is allowed, even if it violates policy.

Use Observe mode when first deploying or changing policy so you can understand how the profile behaves before you start blocking access.

Enforce mode

• SSH connections that do not meet policy are blocked.

• Details about blocked connections are sent to the log channel.

• Without a connection to TPF, if a local authorized key exists, the connection is still blocked as a policy violation.

Specify allowed algorithms

Under Key Settings, use Allowed Algorithms to define which SSH key algorithms are permitted.

• These settings control which key types are considered compliant.

• The options that appear are based on Trust Protection Foundation encryption type settings.

• If a connection uses a key algorithm that is not selected, the key is treated as non‑compliant, and the current mode (Observe or Enforce) applies.

Behavior by mode:

• In Observe mode, connections that use disallowed algorithms are recorded as non‑compliant, but not blocked.

• In Enforce mode, connections using disallowed algorithms are blocked.

Restricting algorithms helps enforce security standards and remove weak or outdated algorithms.

Set maximum key age

Use Maximum key age (days) to control how long an SSH key can be used before it is considered too old.

• In Observe mode, keys that exceed the maximum age are reported as non‑compliant.

• In Enforce mode, connections using over-age keys are blocked.

This setting helps ensure regular SSH key rotation and reduces risk from long‑lived keys. The key's age is calculated from the first observation of the key is used and an SSH Key Authorization Rule is created.

---

Manage SSH Authorization Permissions

Use the Permissions page to see who can view and manage this SSH authorization profile and related items. From here, you can:

• Grant or remove access for specific identity objects (users, groups, directories)

• See which permissions are set directly on this profile

• See which permissions are inherited from higher levels

This helps you control who can view authorization data, change policy, and revoke keys.

Open the Permissions page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager for Machines.

3. In the main navigation menu, select Authorization > Profile > Permissions.

Manage local permissions

The Local Permissions page shows the permissions set directly on an object (for example, the current SSH Authorization Profile). These permissions also apply to any objects below it in the tree.

Use this page to:

• Add or remove identity items

• Adjust what each identity item is allowed to do

You can:

• Use Filter Identities to search for a specific user or group.

• For each identity, select the checkboxes that match the access you want to allow, such as:

  • View – See this identity item.

  • Read – View details and configuration.

  • Write – Change settings.

  • Manage Policy – Change SSH authorization policy for this item.

  • Create / Delete / Rename / Associate / Revoke – Create or remove related items, link items, or revoke.

  • Read Private Key / Write Private Key – View or manage private key material (use with care).

  Apply permissions for Authorization Profile and Inventory as:

  Permission level	Profile page	Inventory
  No rights	Authorization menu group is hidden. GetRules API is restricted.
  View	Authorization menu group is hidden. GetRules API is restricted.
  Read	Read Only	Read Only
  Read+Write	Read Only	Read Only
  Read+Write+Revoke	Read Only	Can Revoke/Deny
  Read+Write+Manage Policy	Can Edit	Read Only
  Read+Write+Manage Policy+Revoke	Can Edit	Can Revoke/Deny

Add an identity to local permissions

You can give a user or group specific permissions on this SSH authorization object (for example, the default SSH Authorization profile).

Click the +Add Identity button, select the name of the user or group, and then choose the permissions you want to grant by selecting one or more checkboxes:

• View – See this identity item in the UI.

• Read – View full details and configuration.

• Write – Change settings on this identity item.

• Manage Policy – Change SSH authorization policy for this identity item.

• Create – Create related objects under this identity item.

• Delete – Remove this item or related objects.

• Rename – Change the name of this identity item.

• Associate – Link this item to other objects.

• Revoke – Revoke keys or related identity items.

• Read Private Key – View private key material.

• Write Private Key – Upload or replace private key material.

• Manage Permissions – Change who has access (add/remove identities, change their rights).

The identity item appears in Local Permissions and its rights are included in Cumulative Permissions for this object and any child objects.

Manage cumulative permissions

Cumulative Permissions show all permissions that apply to an identity item, including:

• Permissions set locally on the identity item

• Permissions inherited from parent objects

This view helps you understand the effective access for each identity.

Key points:

• Group membership is not taken into account in the table. It shows only permissions granted directly to each listed identity item.

• To see where a permission came from, you can:

  • Click the identity name, or

    Use Troubleshoot Permissions (link in the explanation) for a detailed view of inherited and direct permissions.

Use this information when you need to:

• Confirm who can view or modify this profile

• Verify that sensitive permissions (like Manage Policy, Revoke, Read/Write Private Key, or Manage Permissions) are only assigned to the right admins

• Diagnose why someone can or cannot access this identity item

---

Manage SSH Key Authorization Rules

An SSH Key Authorization Rule is a rolled-up summary of an SSH authorization event (for example, Hostname, Account, and SSH key fingerprint).

Open the SSH Key Authorization Rules page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager for Machines.

3. Select Authorization > Rules.

Review SSH Key Authorization Rule details

Each rule includes details to help you understand what is happening, including:

• Impact (what the system did)

• Status (why the system did it)

• Host (target hostname)

• Account (Linux account used)

• Algorithm

• Key (fingerprint)

• Signing key

• Usage (how many times this rule was seen)

• First Seen and Last Seen (first time and most recent time this rule was seen)

When reviewing rules, look for high usage, unexpected hosts or accounts, weak algorithms, keys used on many hosts, and sudden changes in usage.

If you need connection-level details for audit or troubleshooting, use the Trust Protection Foundation log (and forward it to a SIEM if needed). The SSH Key Authorization Rules page is designed to show a rolled-up view as authorization rules.

Deny authorization

On the Rules page, use Deny Authorization when you want to block a specific type of SSH access without revoking the key. This action blocks future connections that match the same Account name, Host, and Key fingerprint.

Revoke keys

On the Rules page, use Revoke Key to permanently invalidate an SSH key across the environment. Revoking a key is permanent and cannot be undone. Before you confirm, the system shows how many hosts and rules are affected.

Use Revoke Key when a key is compromised, unauthorized, or must be removed immediately.

---

Manage SSH Key Authorization Hosts

Use the SSH Key Authorization Hosts page to see which servers and machines are being accessed over SSH and how they are used over time. Each entry in the table represents one destination host.

SSH Key Authorization Hosts are tracked over time so you can see when a host first appeared, how often it is accessed, and which accounts, keys, and authorization activity are linked to it.

You can not block access directly from this page. Instead, use the information on this page to decide where action is needed (for example, which hosts you should investigate on the SSH Authorization Key Rules page or where you might need to revoke a key).

Open the SSH Key Authorization Hosts page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager for Machines.

3. Select Authorization > Hosts

The SSH Key Authorization Hosts page lists each host detected during SSH connection attempts.

Analyze SSH Key Authorization Host details

The SSH Key Authorization Hosts page reports information such as:

• Hostname and IP address

• Number of Linux accounts used to access the host

• Number of SSH keys used on the host (Keys)

• Number of authorization entries linked to the host (Rules)

• When the host was first accessed and most recently accessed

• The version of AuthZHelper installed on the host

When analyzing the records, pay attention to:

• Hosts with many accounts or keys, which may indicate key sprawl

• Hosts that appear unexpectedly or are outside planned infrastructure

• Hosts with frequent or recent activity linked to non‑compliant rules

• Hosts running an outdated AuthZHelper version, which may limit enforcement

---

Manage SSH Authorization Keys

The SSH Authorization Keys page lets administrators see which SSH keys and certificates are being used to access hosts in the environment and how they are used over time. Each entry represents one SSH credential that has been observed during SSH authorization activity.

Keys are tracked centrally so you can see where a key is used, how often it is used, and whether it should still be trusted. Use this page to identify risky credentials and decide when a key should be more closely monitored or revoked.

Be aware that revoking a key is permanent. Once a key is revoked, it cannot be used again.

Open the SSH Authorization Keys page

1. Sign in to the Trust Protection Foundation admin console.

2. Switch to SSH Manager for Machines.

3. Select Authorization > Keys.

The SSH Authorization Keys page reports all SSH keys and certificates observed during SSH connections.

Analyze key details

Each key entry includes information to help you review usage, such as:

• Key fingerprint

• Algorithm

• Number of hosts where the key has been used

• Whether the key is signed

• When the key was first used

• The most recent use of the key

These details help you understand how widely a key is used and whether that use is expected.

When analyzing key details, look for:

• Keys used on many hosts without a clear reason

• Keys using weak or non‑compliant algorithms

• Keys that should have been retired but are still active

• Keys linked to repeated or suspicious authorization activity

These patterns can indicate key sprawl or misuse.

Revoke keys

On the SSH Authorization Keys page, use Revoke Key to permanently invalidate an SSH key.

Revoking a key:

• Immediately blocks the key on all hosts

• Applies across the entire environment

• Cannot be undone

Before you confirm, the system shows a summary of how many hosts and authorization entries (rules) are affected.

You should revoke a key when a credential is compromised, unauthorized, or must be removed immediately. If you only need to block access for a specific host or account, use Deny Authorization on the SSH Key Authorization Rules page instead.

---