Key rotation method based on privileged account management system, storage medium and device

Abstract

The application discloses a key rotation method based on a privileged account management system, a storage medium and equipment, target asset information is input into the privileged account management system, and a rotation plan is created in the system; and the execution of tasks is carried out according to a rotation period. The application realizes key generation and replacement through periodic rotation of target assets, and solves the problem of SSH key automatic security management. The application can also perform rotation in the case that a key and a password cannot be used to log in to a target asset; can support failure rollback during key rotation, and guarantee the safety and reliability of the rotation plan; and all operation inputs and outputs are stored in the system in the form of logs, so that the task execution process can be audited and traced back. The application can enable a user to configure asset information and rotation plan information in the system only once, and then automatically complete the SSH key automatic complete management of the target asset, so that the safety of the SSH key of the target asset is guaranteed, and the application has good practicability.

Description

Technical Field

[0001] The present invention belongs to the technical field of key security management, and in particular relates to a key rotation method, storage medium and device based on a privileged account management system. Background Art

[0002] When managing Linux server accounts based on a privileged account management system, many users use SSH keys for authentication, login, and hosting. However, if keys are not replaced for extended periods, this poses a significant security risk. To implement periodic key replacement, users currently manually generate new keys, log in to the Linux server, replace the public key, and simultaneously enter the key into the privileged account management system. This can be extremely tedious and time-consuming when running on a large number of Linux servers. Therefore, a secure, fast, and stable solution is needed to address this need.

[0003] To address the demand for automated and secure management of SSH keys in existing asset management, the present invention discloses a solution for automatic periodic rotation of SSH keys based on the privileged account management system. This solution can improve the security and convenience of SSH key management while ensuring the safe, reliable execution and audit backtracking of rotation tasks. Summary of the Invention

[0004] The purpose of the present invention is to provide a key rotation method, storage medium and device based on a privileged account management system, aiming to solve the above-mentioned problems.

[0005] The present invention is mainly achieved through the following technical solutions:

[0006] The key rotation method based on the privileged account management system includes the following steps:

[0007] Step S1: First, enter the target asset information into the privileged account management system;

[0008] Step S2: Create a rotation plan in the system: set the rotation period and key generation strategy;

[0009] Step S3: Execute the task according to the rotation cycle:

[0010] Step S31: Generate a new key according to the key generation strategy, and prepare the private key, encryption password, and public key;

[0011] Step S32: SSH connection is made to the target asset. If the connection is successful, the process goes to step S33. If the connection is unsuccessful, the process attempts to connect using the password. If the connection is successful, the process goes to step S33. If the connection fails using the password, the process attempts to log in using the privileged account of the asset. If the connection is successful, the process goes to step S36. If the connection fails, the process marks the connection as failed and the task ends.

[0012] Step S33: Read the contents of ~ / .ssh / authorized_keys and transfer the contents to the system;

[0013] Step S34: Back up the read content and replace the old public key in the content with the new public key. Create a new file ~ / .ssh / authorized_keys_new on the target asset using the new content.

[0014] Step S35: Execute mv ~ / .ssh / authorized_keys_new ~ / .ssh / authorized_keys to replace the old file with the new file. After the execution is completed, jump to step S39;

[0015] Step S36: Use the privileged account to connect and read / home / {account name of the account to be modified} / .ssh / authorized_keys, and read the content into the system;

[0016] Step S37: Back up the read content and check whether the content contains the old public key data. If so, replace the old public key in the content with the new public key. If not, append the new public key data to the end of the content and use the new content to create a new file / home / {account name of the account to be modified} / .ssh / authorized_keys_new on the target asset.

[0017] Step S38: Execute mv / home / {account name of the account to be modified} / .ssh / authorized_keys_new / home / {account name of the account to be modified} / .ssh / authorized_keys to replace the old file with the new file;

[0018] Step S39: Keep the current SSH connection open, reopen a new SSH connection, and use the new private key and encryption password for login authentication; if successful, disconnect the connection and set the scheduled task status to success; if failed, use the backup file content to restore and roll back, and set the scheduled task status to failure.

[0019] In order to better implement the present invention, further, in step S1, the asset information includes IP, SSH service port number, account name, private key and encryption password of the key currently used by the account; if the account has a usable password, the password of the account can be entered at the same time; if there is privileged account information of the asset, the privileged account and key or password of the asset can be entered.

[0020] In order to better implement the present invention, further, in step S32, an SSH connection is performed on the target asset using the IP, SSH service port number, account name, private key of the currently used key, and encryption password.

[0021] In order to better implement the present invention, further, in step S2, the rotation cycle includes the first execution time and the number of repeated days, and the key generation strategy includes the algorithm, key length, whether to use an encryption password, specify the encryption password, and the encryption password length range.

[0022] In order to better implement the present invention, further, in step S3, all inputs and outputs of task execution are stored in the system in the form of logs to facilitate user auditing and exception handling.

[0023] A computer-readable storage medium stores a computer program, which implements the above method when executed by a processor.

[0024] An electronic device comprises a memory and a processor; the memory stores a computer program; the processor is configured to execute the computer program in the memory to implement the above method.

[0025] The beneficial effects of the present invention are as follows:

[0026] The present invention implements key generation and replacement by periodically rotating the target assets, solving the problem of automated security management of SSH keys. The present invention can also perform rotation when the key and password cannot log in to the target asset. It can support failure rollback during key rotation to ensure the security and reliability of the rotation plan; and all operation inputs and outputs are stored in the system in log form to ensure that the task execution process is auditable and traceable. In the rotation plan, the present invention supports specified algorithms, specified passwords, and random passwords, and can be adjusted at any time. The present invention allows users to configure asset information and rotation plan information only once in the system, and can automatically complete the automated and complete management of the SSH keys of the target assets, ensuring the security of the SSH keys of the target assets and having good practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 The present invention is a flowchart of a key rotation method based on a privileged account management system. DETAILED DESCRIPTION

[0028] Example 1:

[0029] A key rotation method based on a privileged account management system, such as Figure 1 As shown, the following steps are included:

[0030] First, the target Linux asset information needs to be entered into the privileged account management system, including the IP, SSH service port number, account name, the private key and encryption password of the key currently used by the account. If the account has a usable password, the password of the account can be entered at the same time. If there is privileged account information for the asset, the privileged account and key or password of the asset (such as root) can be entered. After entering, a rotation plan is created in the system. The rotation cycle (first execution time and number of repetition days) is set in the plan. The key generation strategy is set, including the algorithm (RSA, DSA, ECDSA), key length, whether to use an encryption password, specify the encryption password, and the encryption password length range (supports specified algorithms, specified passwords, random passwords, and can be adjusted at any time). The rotation plan will execute tasks according to the rotation cycle. The task execution steps are as follows:

[0031] 1. Generate a new key according to the key generation strategy and prepare the private key, encryption password, and public key.

[0032] 2. Use the IP address, SSH service port number, account name, the private key of the currently used key, and the encryption password to establish an SSH connection to the target asset. If the connection is successful, proceed to step 3. If the connection is unsuccessful, try to connect using the password. If the connection is successful, proceed to step 3. If the connection fails using the password, try to log in using the asset's privileged account. If the connection is successful, proceed to step 6. If the connection fails, mark the task as failed and the task ends. This feature supports rotation even when the key and password cannot log in to the target asset.

[0033] 3. After connecting, read the contents of ~ / .ssh / authorized_keys and read the contents into this system.

[0034] 4. Back up the read content and replace the old public key in the content with the new public key. Use the new content to create a new file ~ / .ssh / authorized_keys_new on the target asset.

[0035] 5. Run the command mv ~ / .ssh / authorized_keys_new ~ / .ssh / authorized_keys to replace the old file with the new one. After the command completes, skip to step 9.

[0036] 6. Use the privileged account to connect and read / home / {account name to be modified} / .ssh / authorized_keys, and read the contents into this system.

[0037] 7. Back up the read content and check whether there is old public key data in the content. If so, replace the old public key in the content with the new public key. If not, append the new public key data to the end of the content and use the new content to create a new file / home / {account name of the account to be modified} / .ssh / authorized_keys_new on the target asset.

[0038] 8. Execute mv / home / {account name of the account to be modified} / .ssh / authorized_keys_new / home / {account name of the account to be modified} / .ssh / authorized_keys to replace the old file with the new file.

[0039] 9. Keep the current SSH connection open, open a new one, and log in using the new private key and encrypted password. If successful, disconnect and set the scheduled task status to Success. If unsuccessful, restore the backup file contents and set the scheduled task status to Failure. The task ends. Automatic recovery and rollback are supported after a modification fails, ensuring that the old key remains usable.

[0040] 10. After the task is completed, the next scheduled execution time will be recalculated. When the system reaches the next execution time, the task steps will be repeated. All input and output of this task execution are stored in the system as logs for user auditing and exception handling.

[0041] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A key rotation method based on a privileged account management system, characterized in that: The following steps are involved: Step S1: First, enter the target asset information into the privileged account management system; Step S2: Create a rotation plan in the system: set the rotation period and key generation strategy; Step S3: Execute the task according to the rotation cycle: Step S31: Generate a new key according to the key generation strategy, and prepare the private key, encryption password, and public key; Step S32: SSH connection is made to the target asset. If the connection is successful, the process goes to step S33. If the connection is unsuccessful, the process attempts to connect using the password. If the connection is successful, the process goes to step S33. If the connection fails using the password, the process attempts to log in using the privileged account of the asset. If the connection is successful, the process goes to step S36. If the connection fails, the process marks the connection as failed and the task ends. Step S33: Read the contents of ~ / .ssh / authorized_keys and transfer the contents to the system; Step S34: Back up the read content and replace the old public key in the content with the new public key. Create a new file ~ / .ssh / authorized_keys_new on the target asset using the new content. Step S35: Execute mv ~ / .ssh / authorized_keys_new ~ / .ssh / authorized_keys to replace the old file with the new file. After the execution is completed, jump to step S39; Step S36: Use the privileged account to connect and read / home / {account name of the account to be modified} / .ssh / authorized_keys, and read the content into the system; Step S37: Back up the read content and check whether the content contains the old public key data. If so, replace the old public key in the content with the new public key. If not, append the new public key data to the end of the content and use the new content to create a new file / home / {account name of the account to be modified} / .ssh / authorized_keys_new on the target asset. Step S38: Execute mv / home / {account name of the account to be modified} / .ssh / authorized_keys_new / home / {account name of the account to be modified} / .ssh / authorized_keys to replace the old file with the new file; Step S39: Keep the current SSH connection open, reopen a new SSH connection, and use the new private key and encryption password for login authentication; if successful, disconnect the connection and set the scheduled task status to success; if failed, use the backup file content to restore and roll back, and set the scheduled task status to failure.

2. The key rotation method based on the privileged account management system according to claim 1, characterized in that: In step S1, the asset information includes the IP, SSH service port number, account name, the private key and encryption password of the key currently used by the account. If the account has a usable password, the password of the account can be entered at the same time. If there is privileged account information for the asset, the privileged account and key or password of the asset can be entered.

3. The key rotation method based on the privileged account management system according to claim 2, characterized in that: In step S32, an SSH connection is established to the target asset using the IP, SSH service port number, account name, private key of the currently used key, and encryption password.

4. The key rotation method based on the privileged account management system according to claim 1, characterized in that: In step S2, the rotation cycle includes the first execution time and the number of repeated days, and the key generation strategy includes the algorithm, key length, whether to use an encryption password, a specified encryption password, and an encryption password length range.

5. The key rotation method based on the privileged account management system according to any one of claims 1 to 4, characterized in that: In step S3, all inputs and outputs of the task execution are stored in the system in the form of logs to facilitate user auditing and exception handling.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

7. An electronic device, characterized in that: The method comprises a memory and a processor; the memory stores a computer program; the processor is configured to execute the computer program in the memory to implement the method according to any one of claims 1 to 5.

Images