Server remote login credential management methods, systems, devices, and storage media

Abstract

This application discloses a method, system, device, and storage medium for managing remote login credentials for servers. The method includes configuring an SSH CA key pair on the server side and configuring the CA public key of the SSH CA key pair to the managed Linux server. After the remote login credential application is approved, the SSH public key of the SSH key pair generated by the client is sent to the server, and the received SSH public key is signed using the private key of the SSH CA key pair to generate an SSH certificate. On the client authorized by the SSH certificate, the user logs into the Linux server specified in the remote login credential application as the administrator and user as designated by the SSH certificate, and performs maintenance operations. This invention avoids the work of removing the SSH public key already distributed to the server and removing the trust work of the public key of the key pair, thus avoiding the risk of unauthorized access to the managed Linux server.

Description

Technical Field

[0001] This application relates to the field of computer technology, and specifically to a method, system, device, and storage medium for managing remote login credentials for Linux servers based on SSH (Secure Shell Protocol) certificates. Background Technology

[0002] Data center operations and maintenance personnel typically manage servers via remote login. To establish a secure channel between the client and server, SSH is commonly used. SSH is an encrypted network transmission protocol that establishes a secure tunnel over the network to enable connections between SSH clients and servers, providing a secure transmission environment for network services in insecure networks. SSH uses asymmetric encryption for authentication, which can be achieved through various methods. For example, one method is to use an automatically generated SSH key pair (public key-private key) to simply encrypt the network connection, followed by password authentication. Another method is to manually generate an SSH key pair (public key and private key), place the SSH public key on the remote server to be logged into, and authenticate using the generated SSH private key. This allows login without a password; this authentication method is also known as server-side SSH public key authentication.

[0003] For security reasons, Linux servers typically prohibit users from remotely logging into the system via password authentication after deployment. Instead, they use SSH public key authentication for remote login and maintenance. This requires generating an SSH key pair (including an SSH public key and an SSH private key), distributing the SSH public key to the remotely managed server so that the server trusts the SSH key, and distributing the SSH private key to the maintenance personnel. After maintenance is completed, to prevent unauthorized access to these remotely managed servers, the SSH public key needs to be removed from the server.

[0004] With the continuous increase in the scale of data center servers, operations and maintenance personnel often need to remotely log in to different servers for system maintenance. Managing the lifecycle of these remote login credentials (SSH key pairs), including application, approval, issuance, revocation, and auditing, presents a significant challenge, primarily in the following aspects:

[0005] 1. If the remotely managed server is large, distributing the SSH public key can become a significant burden.

[0006] 2. The SSH public keys distributed to the server have no expiration date. After the operation and maintenance personnel have completed the remote maintenance, if the SSH public key is not removed from the server, the operation and maintenance personnel can log in to these servers at any time without authorization using the corresponding private key. Removing the previously distributed SSH public keys from these servers is also a tedious task.

[0007] 3. If the SSH private key is leaked, SSH public key authentication cannot prevent the corresponding private key from being used elsewhere, which greatly increases the risk of unauthorized access to the managed Linux server;

[0008] 4. When it is discovered or suspected that an SSH private key has been leaked, the use of this key pair needs to be revoked. This requires removing the trust of the public key of this key pair from all servers that trust the public key, which is also a tedious task.

[0009] 5. After maintenance personnel log in to the remotely managed server via SSH public key authentication, the system log will record the fingerprint of the public key, but not the actual identity information of the maintenance personnel. This will cause great difficulties in auditing the behavior of maintenance personnel, especially when multiple maintenance personnel log in to the managed server remotely with the same system user identity, making the auditing of the maintenance personnel behavior even more difficult.

[0010] The background description is provided for the purpose of understanding the relevant technologies in this field and is not intended as an admission of prior art. Summary of the Invention

[0011] Therefore, the present invention aims to provide a method, system, device and storage medium for managing remote login credentials for servers, in order to solve the problems caused by the heavy burden of SSH public key distribution when performing remote login maintenance on target servers using SSH public key authentication, the cumbersome work of removing the distributed SSH public key from the remote managed server and removing the trust of the SSH public key when the private key is leaked, the increased risk of unauthorized access to the server due to SSH private key leakage, and the difficulty of auditing the behavior of operation and maintenance personnel.

[0012] In a first aspect, embodiments of the present invention provide a method for managing remote login credentials for a Linux server, the method comprising:

[0013] Configure an SSH CA key pair on the server side, and configure the CA public key of the SSH CA key pair to the managed Linux server;

[0014] Submit a remote login credential request on the server.

[0015] Once the remote login credential application is approved, the SSH public key of the SSH key pair generated by the client is sent to the server, and the private key of the SSH CA key pair is used to sign the received SSH public key to generate an SSH certificate, which is then returned to the client.

[0016] Log in to the Linux server in the remote login credential application on the client authorized by the SSH certificate, using the identity of the maintenance personnel and the user specified in the SSH certificate, and perform maintenance operations.

[0017] Furthermore, the CA public key is configured to the managed Linux server via a secure API interface or a copy operation.

[0018] Furthermore, the remote login credential request includes a list of Linux servers to be accessed, a login time range, and the client used for login.

[0019] Furthermore, after the remote login credential application is submitted, the reviewer will be notified via email, DingTalk, or WeChat to conduct the review.

[0020] Once the reviewer receives the review notification, they will conduct the review via the link in the notification.

[0021] Furthermore, when revocation is required, an SSH certificate revocation list is generated based on the valid SSH certificates, and the SSH certificate revocation list is distributed to the managed Linux servers.

[0022] Furthermore, when logging into the managed Linux server, the system log records the login time, the identity of the operations and maintenance personnel contained in the SSH certificate, the user identity, and the SSH public key information.

[0023] Furthermore, when auditing is required, the system logs are obtained, and the application and review of the remote login credentials, as well as the issuance and revocation of the SSH certificates, are audited based on the system logs.

[0024] In a second aspect, embodiments of the present invention provide a Linux server remote login credential management system, including a client and a server. The server includes an SSH CA management module, a server asset management module, a user remote access permission management module, a user credential application module, a user credential issuance module, a user credential revocation module, a user credential auditing module, and a credential distribution module.

[0025] The client is used to generate SSH key pairs. After the remote login credential application submitted by the user credential application module is approved, the client sends the SSH public key of the SSH key pair to the user credential issuance module. The client also saves the SSH certificate returned by the user credential issuance module to log in to the Linux server in the remote login credential application based on the SSH certificate and perform operation and maintenance.

[0026] The SSH CA management module is used to configure SSH CA key pairs and send the CA public key of the SSH CA key pair to the credential distribution module;

[0027] The server asset management module is used to maintain a list of managed Linux servers and group the servers according to their different uses.

[0028] The user remote access permission management module is used to manage users and configure the server groups that users access;

[0029] The user credential application module is used to submit a remote login credential application;

[0030] The user credential issuance module is used to sign the received SSH public key using the private key of the SSH CA key pair, generate an SSH certificate, and return the SSH certificate to the client.

[0031] The user credential revocation module is used to generate an SSH certificate revocation list based on the valid SSH certificates when revocation is required, and send the SSH certificate revocation list to the credential distribution module.

[0032] When auditing is required, the user credential auditing module obtains system logs and audits the application and review of remote login credentials, as well as the issuance and revocation of SSH certificates, based on the system logs.

[0033] The credential distribution module is used to configure the CA public key to the managed Linux server and to distribute the SSH certificate revocation list to the managed Linux server.

[0034] In a third aspect, embodiments of the present invention provide an electronic device, including: a processor and a memory storing a computer program, wherein the processor is configured to execute any of the Linux server remote login credential management methods of the present invention when running the computer program.

[0035] In a fourth aspect, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the Linux server remote login credential management method of any embodiment of the present invention.

[0036] In the Linux server remote login credential management method used in this embodiment of the invention, SSH certificates are issued using the private key of the SSH CA key pair to the user's SSH public key. The issuance includes the user's SSH public key information, the identity of the operations and maintenance personnel, the user's identity, the validity period, and the authorized client IP address information. By specifying the user's identity, the authorized client address, and the validity period, the key pair is restricted to use only on the specified client and within the specified validity period, avoiding the tedious work of removing the SSH public key already distributed on the server. Even if the key is leaked, it cannot be used on unauthorized clients, avoiding the risk of unauthorized access to the managed Linux server and eliminating the tedious work of removing the public key of the key pair when the key is leaked.

[0037] As long as the managed server is configured with a list of trusted SSH CA public keys, SSH certificates issued with the private keys of the SSH CA key pair can be trusted by the server. There is no need to distribute SSH public keys separately to the operations and maintenance personnel, thus avoiding the problem of heavy SSH public key distribution when the managed server scale is large.

[0038] After logging into the managed remote Linux server using an SSH certificate issued by an SSH CA, the logs record not only the fingerprint of the SSH key, but also the identity of the operations and maintenance personnel and the user identity specified at the time of issuance. This greatly facilitates the auditing of operations and maintenance personnel behavior and solves the problem of the difficulty in auditing operations and maintenance personnel behavior.

[0039] This invention provides unified functions for the application, review, revocation, distribution, and auditing of remote login credentials for operations and maintenance personnel through SSH CA certificate authentication. It manages the entire lifecycle of credentials for remote access by operations and maintenance personnel and allows for fine-grained management of the range of servers that operations and maintenance personnel need to access and the time window for operations.

[0040] Other optional features and technical effects of the embodiments of the present invention are partly described below and partly apparent from reading this document. Attached Figure Description

[0041] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The elements shown are not limited to the scale shown in the drawings, and the same or similar reference numerals in the drawings denote the same or similar elements, wherein:

[0042] Figure 1An example flowchart of a Linux server remote login credential management method according to an embodiment of the present invention is shown;

[0043] Figure 2 An exemplary structural diagram of a Linux server remote login credential management system according to an embodiment of the present invention is shown;

[0044] Figure 3 An exemplary structural schematic diagram of an electronic device capable of implementing the method according to an embodiment of the present invention is shown. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0046] The term "comprising" and its variations as used herein signify open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "at least partially based on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0047] For remote authentication of Linux servers, password authentication or SSH public key authentication is generally used. Due to security considerations, Linux servers typically prohibit users from remotely logging in via password authentication after deployment, instead using SSH public key authentication for remote login and maintenance. However, using SSH public key authentication leads to the following problems: 1. When the managed server is large, the SSH public key distribution burden is heavy; 2. To prevent unauthorized access by maintenance personnel using the corresponding private key to log in to the managed server at any time, the distributed SSH public key needs to be removed, resulting in tedious work; 3. Leaked SSH private keys increase the risk of unauthorized access to the managed Linux server; 4. Leaked SSH private keys increase the tedious work of removing the public key trust of the key pair; 5. The lack of actual maintenance personnel identification information makes auditing their behavior difficult.

[0048] To address the aforementioned technical problems, embodiments of the present invention provide a method, system, device, and storage medium for managing remote login credentials for servers, which will be described in detail below.

[0049] Please see Figure 1 , Figure 1A flowchart of a Linux server remote login credential management method provided in this embodiment of the invention includes the following steps:

[0050] Step S101: Configure an SSH CA key pair on the server side, and configure the CA public key of the SSH CA key pair to the managed Linux server.

[0051] System administrators can generate SSH CA key pairs using encryption algorithms. An SSH CA key pair includes a CA public key and a private key. The CA public key is configured on the managed Linux server, enabling the remote managed Linux server to trust the SSH certificate generated using the private key of the SSH CA key pair. This eliminates the need to separately distribute SSH public keys to operations and maintenance personnel, avoiding the problem of heavy SSH public key distribution when the managed server scale is large.

[0052] In this embodiment, the CA public key is configured to the managed Linux server through a secure API interface or a copy operation. The CA public key is uploaded to the managed Linux server through the secure API interface, thereby improving security.

[0053] Step S102: Submit a remote login credential application on the server.

[0054] As needed, maintenance personnel can log in to the server of the Linux server remote login credential management system through a browser and submit a remote login credential request on the server. The remote login credential request includes a list of Linux servers to be accessed and a login time range, etc. The login time range restricts the time for remote login to Linux servers in the list of Linux servers using SSH certificates.

[0055] After the remote login credential application is submitted, the reviewer will be notified via email, DingTalk, or WeChat to conduct the review. Upon receiving the notification, the reviewer will conduct the review via a link provided in the notification, improving the convenience of the review process. The review result will be either approved or rejected.

[0056] Step S103: After the remote login credential application is approved, the SSH public key of the SSH key pair generated by the client is sent to the server, and the private key of the SSH CA key pair is used to sign the received SSH public key to generate an SSH certificate. The SSH certificate is then returned to the client.

[0057] When signing the received SSH public key using the private key of an SSH CA key pair, the signature includes the user's SSH public key information, the administrator's identity, the user's identity, the validity period, and the authorized client IP address information. The client stores the contents of the SSH certificate returned by the server. By specifying the user identity, authorized client address, and validity period through the SSH certificate, the key pair can only be used on the specified client and within the specified validity period, avoiding the need to remove the SSH public key already distributed on the server. Even if the key is leaked, it cannot be used on unauthorized clients, avoiding the risk of unauthorized access to the managed Linux server and eliminating the need to remove the public key of the key pair in the event of a key leak.

[0058] SSH certificates can only be used within a specified validity period. After the validity period expires, the SSH certificate becomes invalid. The validity period specified by the SSH certificate and the login time range applied for by the remote login credentials limit the time that the operation and maintenance personnel can remotely log in to the managed Linux server.

[0059] Step S104: Log in to the Linux server in the remote login credential application on the client authorized by the SSH certificate as the user specified by the SSH certificate, and perform operation and maintenance.

[0060] After the SSH certificate is issued, operations and maintenance personnel use the SSH private key and the CA-issued SSH certificate to log in to the Linux servers in the Linux server list as a specified user on an authorized client within a specified time window (including the validity period specified in the SSH certificate and the login time range requested by the remote login credentials) to perform operations and maintenance tasks. When operations and maintenance personnel remotely log in to the Linux servers they need to manage or maintain, the system log records the login time, the operations and maintenance personnel's identity contained in the SSH certificate, the user identity logging into the system, and the fingerprint information of the SSH public key, which facilitates the auditing of operations and maintenance personnel's behavior.

[0061] SSH certificates that have expired are invalid. Therefore, when revocation is required, an SSH certificate revocation list is generated based on the valid SSH certificates, and the SSH certificate revocation list is distributed to the managed Linux servers. Even if the SSH certificate is still valid, the operations and maintenance personnel cannot remotely log in to the managed Linux servers based on the SSH certificate.

[0062] When maintenance personnel log in to a remotely managed Linux server using an SSH certificate, the Linux server remote login credential management system logs will record the login time, the maintenance personnel's identity, user identity, and SSH public key information contained in the SSH certificate. This facilitates the auditing of remote login credential applications and reviews, as well as the issuance and revocation of SSH certificates, based on the system logs, and also facilitates the auditing of maintenance personnel.

[0063] Please see Figure 2 , Figure 2 The present invention provides a structural block diagram of a Linux server remote login credential management system 200. The system 200 includes a client 210 and a server 220. The server 220 includes an SSH CA management module 221, a server asset management module 222, a user remote access permission management module 223, a user credential application module 224, a user credential issuance module 225, a user credential revocation module 226, a user credential auditing module 227, and a credential distribution module 228.

[0064] The client 210 is used to generate SSH key pairs. After the remote login credential application submitted by the user credential application module 224 is approved, the client sends the SSH public key of the SSH key pair to the user credential issuance module 225. The client saves the SSH certificate returned by the user credential issuance module 225 to log in to the Linux server in the remote login credential application based on the SSH certificate and perform operation and maintenance.

[0065] The SSH CA management module 221 is used to configure the SSH CA key pair and send the CA public key of the SSH CA key pair to the credential distribution module 228.

[0066] The server asset management module 222 is used to maintain a list of managed Linux servers and group the servers according to their different uses.

[0067] The user remote access permission management module 223 is used to manage users and configure the server groups that users access.

[0068] The user credential application module 224 is used to submit a remote login credential application, which includes a list of Linux servers to be accessed, a login time range, and the client used for login.

[0069] The user credential issuance module 225 is used to sign the received SSH public key using the private key of the SSH CA key pair, generate an SSH certificate, and return the SSH certificate to the client 210.

[0070] The user credential revocation module 226 is used to generate an SSH certificate revocation list based on the valid SSH certificates when revocation is required, and send the SSH certificate revocation list to the credential distribution module 228.

[0071] The user credential auditing module 227 is used to obtain system logs when auditing is required, and to audit the application and review of the remote login credential, and the issuance and revocation of the SSH certificate based on the system logs.

[0072] The credential distribution module 228 is used to configure the CA public key to the managed Linux server and to distribute the SSH certificate revocation list to the managed Linux server.

[0073] In some embodiments, the Linux server remote login credential management system 200 may incorporate the methodological features of any embodiment of the Linux server remote login credential management method, and vice versa, which will not be elaborated here.

[0074] In an embodiment of the present invention, an electronic device is provided, comprising: a processor and a memory storing a computer program, wherein the processor is configured to execute the Linux server remote login credential management method of any embodiment of the present invention when running the computer program.

[0075] Figure 3 The diagram illustrates a method for implementing embodiments of the present invention or an electronic device 1000 for implementing embodiments of the present invention. In some embodiments, it may include more or fewer electronic devices than illustrated. In some embodiments, it may be implemented using a single or multiple electronic devices. In some embodiments, it may be implemented using cloud-based or distributed electronic devices.

[0076] like Figure 3 As shown, the electronic device 1000 includes a processor 1001, which can perform various appropriate operations and processes based on programs and / or data stored in read-only memory (ROM) 1002 or programs and / or data loaded from storage portion 1008 into random access memory (RAM) 1003. The processor 1001 may be a multi-core processor or may contain multiple processors. In some embodiments, the processor 1001 may include a general-purpose main processor and one or more special coprocessors, such as a central processing unit (CPU), graphics processing unit (GPU), neural network processor (NPU), digital signal processor (DSP), etc. Various programs and data required for the operation of the electronic device 1000 are also stored in RAM 1003. The processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. An input / output (I / O) interface 1005 is also connected to bus 1004.

[0077] The processor and memory described above are used together to execute a program stored in the memory. When the program is executed by a computer, it can implement the methods, steps, or functions described in the above embodiments.

[0078] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, touchscreen, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 1010 as needed so that computer programs read from it can be installed into storage section 1008 as needed. Figure 3 The diagram only shows a portion of the components and does not imply that the electronic device 1000 includes only these components. Figure 3 The components shown.

[0079] The systems, devices, modules, or units described in the above embodiments can be implemented by a computer or its associated components. The computer may be, for example, a mobile terminal, smartphone, personal computer, laptop computer, in-vehicle human-machine interface device, personal digital assistant, media player, navigation device, game console, tablet computer, wearable device, smart TV, Internet of Things system, smart home, industrial computer, server, or a combination thereof.

[0080] Although not shown, in this embodiment of the invention, a storage medium is provided storing a computer program configured to execute, when run, the Linux server remote login credential management method of any embodiment of the invention.

[0081] Storage media in embodiments of the present invention include articles that are permanent and non-permanent, removable and non-removable, capable of storing information by any method or technology. Examples of storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0082] The methods, programs, systems, apparatuses, etc., in embodiments of the present invention can be executed or implemented in one or more networked computers, or practiced in a distributed computing environment. In the embodiments of this specification, in these distributed computing environments, tasks can be performed by remote processing devices connected via a communication network.

[0083] Those skilled in the art will understand that the embodiments described in this specification can be provided as methods, systems, or computer program products. Therefore, those skilled in the art will realize that the functional modules / units or controllers and related method steps described in the above embodiments can be implemented in software, hardware, or a combination of both.

[0084] Unless explicitly stated otherwise, the actions or steps of the methods and procedures described in the embodiments of the present invention do not necessarily have to be performed in a specific order and can still achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] This document describes several embodiments of the present invention; however, for the sake of brevity, the descriptions of the embodiments are not exhaustive, and identical or similar features or parts between the embodiments may be omitted. In this document, "one embodiment," "some embodiments," "example," "specific example," or "some examples" refers to embodiments applicable to at least one, but not all, of the present invention. The above terms do not necessarily refer to the same embodiments or examples. Without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described herein, as well as the features of the different embodiments or examples.

[0086] The exemplary systems and methods of the present invention have been specifically shown and described with reference to the above embodiments, which are merely examples of the best mode for implementing the systems and methods. Those skilled in the art will understand that various changes can be made to the embodiments of the systems and methods described herein without departing from the spirit and scope of the invention as defined in the appended claims when implementing the systems and / or methods.

Claims

1. A method for managing remote login credentials on a Linux server, characterized in that, The method includes: Configure an SSH CA key pair on the server side, and configure the CA public key of the SSH CA key pair to the managed Linux server; Submit a remote login credential request on the server. Once the remote login credential application is approved, the SSH public key of the SSH key pair generated by the client is sent to the server, and the private key of the SSH CA key pair is used to sign the received SSH public key to generate an SSH certificate, which is then returned to the client. Log in to the Linux server in the remote login credential application on the client authorized by the SSH certificate, using the identity of the maintenance personnel and the user specified in the SSH certificate, and perform maintenance operations.

2. The Linux server remote login credential management method according to claim 1, characterized in that, The CA public key is configured to the managed Linux server via a secure API interface or a copy operation.

3. The Linux server remote login credential management method according to claim 1, characterized in that, The remote login credential request includes a list of Linux servers to be accessed, a login time range, and the client to be used for login.

4. The Linux server remote login credential management method according to claim 1, characterized in that, After the remote login credential application is submitted, the reviewer will be notified via email, DingTalk, or WeChat to conduct the review. Once the reviewer receives the review notification, they will conduct the review via the link in the notification.

5. The Linux server remote login credential management method according to any one of claims 1 to 4, characterized in that, When revocation is required, an SSH certificate revocation list is generated based on the valid SSH certificates, and the SSH certificate revocation list is distributed to the managed Linux servers.

6. The Linux server remote login credential management method according to any one of claims 1 to 4, characterized in that, When logging into the managed Linux server, the system log records the login time, the identity of the operations and maintenance personnel contained in the SSH certificate, the user identity, and the SSH public key information.

7. The Linux server remote login credential management method according to claim 6, characterized in that, When auditing is required, the system logs are retrieved, and the application and review of the remote login credentials, as well as the issuance and revocation of the SSH certificates, are audited based on the system logs.

8. A Linux server remote login credential management system, characterized in that, The system includes a client and a server. The server includes an SSH CA management module, a server asset management module, a user remote access permission management module, a user credential application module, a user credential issuance module, a user credential revocation module, a user credential auditing module, and a credential distribution module. The client is used to generate SSH key pairs. After the remote login credential application submitted by the user credential application module is approved, the client sends the SSH public key of the SSH key pair to the user credential issuance module. The client also saves the SSH certificate returned by the user credential issuance module to log in to the Linux server in the remote login credential application based on the SSH certificate and perform operation and maintenance. The SSH CA management module is used to configure SSH CA key pairs and send the CA public key of the SSH CA key pair to the credential distribution module; The server asset management module is used to maintain a list of managed Linux servers and group the servers according to their different uses. The user remote access permission management module is used to manage users and configure the server groups that users access; The user credential application module is used to submit a remote login credential application; The user credential issuance module is used to sign the received SSH public key using the private key of the SSH CA key pair, generate an SSH certificate, and return the SSH certificate to the client. The user credential revocation module is used to generate an SSH certificate revocation list based on the valid SSH certificates when revocation is required, and send the SSH certificate revocation list to the credential distribution module. When auditing is required, the user credential auditing module obtains system logs and audits the application and review of remote login credentials, as well as the issuance and revocation of SSH certificates, based on the system logs. The credential distribution module is used to configure the CA public key to the managed Linux server and to distribute the SSH certificate revocation list to the managed Linux server.

9. An electronic device, characterized in that, The device includes a processor and a memory storing a computer program, the processor being configured to execute the Linux server remote login credential management method according to any one of claims 1 to 7 when running the computer program.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein when the program is executed by a processor, it implements the Linux server remote login credential management method according to any one of claims 1 to 7.

Images