Method and system for improving security of bastion host and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a method and system for improving security of a bastion host and a storage medium, and the method comprises the steps: enabling a special administrator account to carry out SSH login through dispersing the authority of the bastion host, limiting the special administrator account to only carry out related operation through a bastion host console, and improving the security of the bastion host. According to the method and the device, only part of permissions can be obtained when the administrator account is logged in for the first time, and the background can be entered and more permissions can be obtained when the administrator account is logged in for the second time, so that the access to the bastion host can be safely and remotely logged in through the SSH, and the technical problems of insufficient security of a remote login bastion host system and poor usability of forbidding the remote login bastion host in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and storage medium for improving the security of a bastion host. Background Art

[0002] After deploying a bastion host system, an enterprise usually entrusts its various assets to the bastion host. However, if the bastion host is compromised, the corresponding managed assets will face serious security issues.

[0003] In existing technologies, the following two methods are usually used to improve the security after deploying the bastion host: 1. Use public and private keys to log in to the bastion host remotely, and change the public and private keys regularly; Although this method can prevent leakage to the greatest extent, there is still the problem of leakage caused by the administrator's operation and maintenance machine being hacked or personnel leaving, and it is not secure enough.

[0004] 2. Directly disable remote SSH login to the bastion host, and strictly prohibit any user from logging in to the bastion host via SSH; Directly disabling SSH login can indeed solve the problem once and for all, but daily maintenance or abnormalities in the bastion host require going to the computer room for processing, which involves a series of additional applications and increases the workflow of daily maintenance.

[0005] Therefore, a method for improving the security of the bastion host is needed to solve the technical problems in the prior art of insufficient security of the remote login bastion host system and poor usability of disabling the remote login bastion host. Summary of the invention

[0006] The purpose of the present invention is to provide a method, system and storage medium for improving the security of a bastion host. The method disperses the permissions of the bastion host so that a special administrator account can log in through SSH, and restricts it to perform related operations only through the bastion host console. The administrator account can only obtain partial permissions when logging in for the first time, and can enter the background and obtain more permissions when logging in for the second time. This realizes safe remote login to the bastion host through SSH, and solves the technical problems in the prior art of insufficient security of the remote login bastion host system and poor usability of disabling remote login to the bastion host.

[0007] The present invention is achieved through the following technical solutions: In a first aspect, a method for improving the security of a bastion host is disclosed, comprising the following steps: Step S1: Receive a request from a maintenance personnel to log in to the bastion host through SSH using a target user with unique SSH login permission and corresponding public and private keys; Step S2: Perform the first security verification. When the first security verification passes, the target user is directly logged in to the bastion host console, so that the maintenance personnel can implement the first-level maintenance by selecting and using the first-level maintenance command preset in the bastion host console. When the first security verification fails, disconnect the SSH connection. Step S3: Receive a request from a maintenance person to log in to the bastion server backend; Step S4: Perform a second security verification. When the second security verification passes, redirect the maintenance command entered by the maintenance personnel to the bastion terminal to implement the second level of maintenance. When the second security verification fails, disconnect the SSH connection.

[0008] In order to better implement the present invention, further, a method for configuring a target user includes: Disable the sftp server, root login, and password login; only allow the target user to obtain root permissions; set the target user to directly enter the bastion host console after logging in.

[0009] In order to better implement the present invention, further, a method for configuring a target user includes: Modify the configuration file to disable root login, password login, and allow only the target user to obtain root privileges.

[0010] In order to better implement the present invention, further, a method of using a target user and corresponding public and private keys to log in to a bastion host through SSH and directly enter the bastion host console includes: When the bastion host recognizes that the maintenance personnel use the public and private keys to log in to the target user through SSH, the bastion host console service is started; The bastion host console displays the challenge code login interface on the console service login interface and generates the first challenge code; The response code generation module receives the first challenge code input by the maintenance personnel and generates a first response code; The bastion host console receives the first response code entered by the maintenance personnel and starts the console service management interface after the first response code is verified.

[0011] In order to better implement the present invention, further, after starting the bastion host console service, the concurrent number of bastion host consoles at the same time is limited so that all maintenance personnel can only establish a fixed number of SSH connections with the bastion host at the same time.

[0012] In order to better implement the present invention, further, the method for the bastion host console to generate the first challenge code includes: A random original string is generated, and then encrypted using the SM2 algorithm and the public key of the SM2 algorithm is stored, and the encrypted original string is used as the first challenge code.

[0013] In order to better implement the present invention, further, the reply code generation module is independent of the bastion host, and the method for the reply code generation module to generate the first reply code includes: The first challenge code is decrypted using the SM2 algorithm to obtain the original string and combined with the preset salt value, the combined hash value is calculated using the SM3 hash algorithm, and a specified part of the hash value is intercepted as the first response code.

[0014] In order to better implement the present invention, further, a method for triggering a secondary login in the bastion host console using a target user includes: When the bastion host console recognizes the specified command entered by the maintenance personnel, it jumps to the secondary login interface; The bastion host console displays the challenge code login interface on the secondary login interface and generates a second challenge code; The response code generation module receives the second challenge code input by the maintenance personnel and generates a second response code; The bastion host console receives the second response code entered by the maintenance personnel and redirects the input to the bastion host terminal after the second response code is verified.

[0015] In a second aspect, the present application discloses a system for improving the security of a bastion host, including: A first login module, the first login module is used to receive a request from a maintenance personnel to log in to the bastion host through SSH using a target user with unique SSH login permission and corresponding public and private keys; A first verification module, wherein the first verification module is used to perform a first security verification. When the first security verification passes, the target user is directly logged in to the bastion host console, so that the maintenance personnel can implement the first-level maintenance by selecting and using the first-level maintenance command preset in the bastion host console. When the first security verification fails, the SSH connection is disconnected; A second login module, the second login module is used to receive a request from a maintenance personnel to log in to the bastion host backend; The second verification module is used to perform a second security verification. When the second security verification passes, the maintenance command entered by the maintenance personnel is redirected to the bastion machine terminal to achieve second-level maintenance. When the second security verification fails, the SSH connection is disconnected.

[0016] In a third aspect, the present application discloses a computer-readable storage medium having a computer program stored thereon, characterized in that when the program is executed by a processor, the method for improving the security of a bastion host as described in any one of the first aspects is implemented.

[0017] Compared with the prior art, the present invention has the following advantages and beneficial effects: Using the bastion host console to host the bastion host terminal can effectively restrict people from logging into the bastion host terminal remotely, thus improving the security of the bastion host system. Separate permissions to prevent the bastion host backend from being compromised due to staff resignation or a single person's machine being compromised. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention is further described in conjunction with the following drawings and embodiments, and all the concepts and innovations of the present invention should be regarded as the disclosed contents and the protection scope of the present invention.

[0019] Figure 1 This is a flowchart of Example 1 of the method for improving the security of the bastion host in this application.

[0020] Figure 2 A flowchart of implementing the first-level maintenance and the second-level maintenance of Example 1 of the method for improving the security of the bastion host in the present application.

[0021] Figure 3 A schematic diagram of implementing the first level maintenance and the second level maintenance of Example 2 of the method for improving the security of the bastion host in the present application.

[0022] Figure 4 A schematic diagram of a system embodiment for improving the security of a bastion host in the present application. DETAILED DESCRIPTION

[0023] Example 1 A method for improving the security of a bastion host includes the following steps: Step S1: Receive a request from a maintenance personnel to log in to the bastion host through SSH using a target user with unique SSH login permission and corresponding public and private keys; Step S2: Perform the first security verification. When the first security verification passes, the target user is directly logged in to the bastion host console, so that the maintenance personnel can implement the first-level maintenance by selecting and using the first-level maintenance command preset in the bastion host console. When the first security verification fails, disconnect the SSH connection. Step S3: Receive a request from a maintenance person to log in to the bastion server backend; Step S4: Perform a second security verification. When the second security verification passes, redirect the maintenance command entered by the maintenance personnel to the bastion terminal to implement the second level of maintenance. When the second security verification fails, disconnect the SSH connection.

[0024] In this embodiment, the bastion host system is a comprehensive operation and maintenance management platform that integrates system operation and maintenance and security auditing; the bastion host console is a service installed on the bastion host for hosting the bastion host terminal; the bastion host terminal is the bash of the bastion host system; the person who logs in to the target user is the maintenance personnel of the bastion host system, rather than the personnel who use the bastion host system for asset operation and maintenance; the first-level maintenance includes low-privilege operations such as shutdown, restart, restore to factory settings, reset the bastion host web administrator password, and check the operation of other bastion host services. The target user selects the first-level maintenance command and executes the above-mentioned low-privilege operations by using simple methods such as the arrow keys and the Enter key; the second-level maintenance is a series of high-privilege operations that cannot use preset commands and require entering the bastion host background and using the command line interface to enter commands.

[0025] See also Figure 2 In an optional implementation of this embodiment, after creating a target user and corresponding public and private keys and configuring the permissions of the target user and other users, the method for implementing the first-level maintenance and the second-level maintenance includes the following steps: Step S101: receiving a request from a maintenance personnel to log in to a target user through SSH using a public or private key; Step S102: Display a login interface to the maintenance personnel; Step S103, verifying the one-time login information of the maintenance personnel, specifically receiving the one-time login information from the maintenance personnel, and displaying the bastion host console service management interface to the maintenance personnel when the one-time login information verification passes, and disconnecting the SSH connection when the one-time login information verification fails; Step S104: Implement the first-level maintenance according to the first-level maintenance command selected by the maintenance personnel in the service management interface of the bastion host console; Step S105: receiving a secondary login request from a maintenance personnel; Step S106: Display a secondary login interface to the maintenance personnel; Step S107, verify the secondary login information of the maintenance personnel and perform the second level maintenance, specifically receiving the secondary login information from the maintenance personnel. When the secondary login information verification is passed, redirect the input to the bastion terminal. When the secondary login information verification fails, disconnect the SSH connection.

[0026] By adopting this implementation method, a dual security maintenance mechanism based on permission hierarchy and operation isolation is constructed through the idea of ​​permission dispersion, so that the target user can log in through SSH as a special administrator account, and is restricted to perform related operations only through the bastion console; through the first-level maintenance of low-privilege operations, the risk of direct exposure of high-risk instructions is eliminated. Only when it is necessary to log in to the bastion backend, that is, when the second-level maintenance is required, the permission will be granted through the second login method, and the commands entered by the user will be transferred to the bastion terminal through the bastion console, avoiding direct exposure of the bastion terminal interface, and the permission can be eliminated in time, which is different from the bastion backend password or public and private keys that cannot be modified in time in the prior art; In addition, the following settings can be made: users who approve the second-level maintenance authority do not have the authority to apply for access to the bastion host backend. This can prevent the bastion host backend from being compromised due to staff resignation or a single person's machine being compromised.

[0027] Example 2 This embodiment is further optimized on the basis of the above-mentioned embodiment 1. In this embodiment, the method for configuring the target user includes: Disable the sftp server, root login, and password login; only allow the target user to obtain root permissions; set the target user to directly enter the bastion host console after logging in.

[0028] Furthermore, the method for configuring the target user includes: Modify the configuration file to disable root login, password login, and allow only the target user to obtain root privileges.

[0029] Specifically, by modifying the / etc / passwd file, you can set the target user to directly enter the bastion host console after logging in; by modifying the SSH configuration file / etc / SSH / SSHd_config, you can disable root login and password login; by modifying / etc / sudoers, you can disable other users from obtaining root permissions, and only allow the newly created target user to obtain root permissions.

[0030] By adopting the above implementation method, the separation of bastion host permissions can be achieved more conveniently by modifying the configuration file; disabling the sftp server can limit the file transfer capability through the SSH protocol, thereby reducing the attack surface of the bastion host system, centrally controlling permissions, and further improving security; by disabling root login, the attack surface of the system can be reduced, and attackers cannot directly launch brute force cracking or vulnerability exploits against the default privileged account (root); by disabling password login, SSH key authentication can be forced to be used to avoid the risks of weak passwords, database collision attacks, or man-in-the-middle eavesdropping.

[0031] In this embodiment, the method of using the target user and the corresponding public and private keys to log in to the bastion host through SSH and directly enter the bastion host console includes: When the bastion host recognizes that the maintenance personnel use the public and private keys to log in to the target user through SSH, the bastion host console service is started; The bastion host console displays the challenge code login interface on the console service login interface and generates the first challenge code; The response code generation module receives the first challenge code input by the maintenance personnel and generates a first response code; The bastion host console receives the first response code entered by the maintenance personnel and starts the console service management interface after the first response code is verified.

[0032] By adopting this implementation mode, the usability can be improved while ensuring safety.

[0033] Furthermore, after starting the bastion host console service, the number of concurrent bastion host consoles at the same time is limited so that all maintenance personnel can only establish a fixed number of SSH connections with the bastion host at the same time.

[0034] By adopting this implementation, the probability of the bastion host console being cracked by brute force can be minimized.

[0035] Furthermore, the method for the bastion host console to generate the first challenge code includes: A random original string is generated, and then encrypted using the SM2 algorithm and the public key of the SM2 algorithm is stored, and the encrypted original string is used as the first challenge code.

[0036] Furthermore, the reply code generation module is independent of the bastion server, and the method for the reply code generation module to generate the first reply code includes: The first challenge code is decrypted using the SM2 algorithm to obtain the original string and combined with the preset salt value, the combined hash value is calculated using the SM3 hash algorithm, and a specified part of the hash value is intercepted as the first response code.

[0037] By adopting this implementation, the response code generation module is completely independent of the bastion host system and has an independent user authority system. The authority of the maintenance personnel who perform daily maintenance on the bastion host system and the root authority to enter the bastion host backend can be separated, and the authority can be eliminated in time; By using the SM2 and SM3 national encryption algorithms, a challenge code-response code system was designed to further reduce the probability of brute force cracking of the bastion host backend; In order to facilitate personnel input, the first response code can be set to about 10 digits, and the first 10 digits of the hash value are intercepted as the first response code.

[0038] Furthermore, methods for triggering secondary login using the target user in the bastion host console include: When the bastion host console recognizes the specified command entered by the maintenance personnel, it jumps to the secondary login interface; The bastion host console displays the challenge code login interface on the secondary login interface and generates a second challenge code; The response code generation module receives the second challenge code input by the maintenance personnel and generates a second response code; The bastion host console receives the second response code entered by the maintenance personnel and redirects the input to the bastion host terminal after the second response code is verified.

[0039] Specifically, the specified command entered by the maintenance personnel can be in the form of an Easter egg command, which is invisible when input in the menu of the bastion host console service management interface. By entering the Easter egg command, as long as a certain segment of the input matches the Easter egg, it will be triggered, and then the bastion host console will directly jump to the secondary login interface; the generation logic of the second reply code is the same as that of the first reply code, but the key and salt value are different.

[0040] Optionally, when displaying the challenge code on the console service login interface, in addition to displaying the challenge code in string form, a QR code is also displayed in the form of an image; Since the challenge code may be relatively long, the response code generation system and the bastion host background service may need to transfer data. If you cannot directly copy the challenge code, you can choose to take a photo and use the QR code.

[0041] Optionally, limit the time and number of times the challenge code can be entered; For example, the input window for the challenge code (including the first challenge code and the second challenge code) is only 5 minutes, and each incorrect input will directly generate a new challenge code. If the input is incorrect three times, the SSH connection will be directly disconnected.

[0042] In a specific implementation, by modifying the configuration file, root login and password login are disabled, only the target user can obtain root permissions and directly enter the bastion host console after logging in, and after disabling the sftp server, see Figure 3 , the method for implementing the first level maintenance and the second level maintenance includes the following steps: Step S201: The bastion host console receives a request from a maintenance personnel to log in to a target user through SSH using a public or private key; Step S202: The bastion host console displays a challenge code login interface on the console service login interface and generates a first challenge code; Step S203: The response code generation module receives the first challenge code input by the maintenance personnel and generates a first response code; Step S204, verifying the first response code, specifically, the bastion host console receives the first response code from the maintenance personnel, and when the first response code verification is successful, the bastion host console service management interface is displayed to the maintenance personnel; when the first response code verification fails, the SSH connection is disconnected; Step S205: Performing first-level maintenance, specifically, the bastion host console implements first-level maintenance according to the first-level maintenance command selected by the maintenance personnel in the bastion host console service management interface; Step S206: The bastion host console receives the Easter egg command from the maintenance personnel; Step S207: The bastion host console displays a challenge code login interface to the maintenance personnel and generates a second challenge code; Step S208: The response code generation module receives the second challenge code input by the maintenance personnel and generates a second response code; Step S209, verify the second reply code and perform second-level maintenance, specifically, the bastion host console receives the second reply code from the maintenance personnel, when the second reply code verification is passed, the input is redirected to the bastion host terminal, when the second reply code verification fails, the SSH connection is disconnected.

[0043] Embodiment 3: See also Figure 4 , a system for improving the security of a bastion host, comprising a bastion host console, the bastion host console being used to create a target user and corresponding public and private keys and configure permissions for the target user and other users, so that only the target user and the public and private keys can be used to log in to the bastion host through SSH and directly enter the bastion host console, and the first level of maintenance is achieved by selecting and using a preset first level maintenance command in the bastion host console; By using the target user to trigger a secondary login in the bastion host console and after successful login, enter the maintenance command in the bastion host console and redirect the maintenance command to the bastion host terminal to implement the second-level maintenance.

[0044] Example 4 A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for improving the security of a bastion host as described in any one of Embodiments 1 to 2.

[0045] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for improving the security of a bastion host, characterized in that: The following steps are involved: Step S1: Receive a request from a maintenance personnel to log in to the bastion host through SSH using a target user with unique SSH login permission and corresponding public and private keys; Step S2: Perform the first security verification. When the first security verification passes, the target user is directly logged in to the bastion host console, so that the maintenance personnel can implement the first-level maintenance by selecting and using the first-level maintenance command preset in the bastion host console. When the first security verification fails, disconnect the SSH connection. Step S3: Receive a request from a maintenance person to log in to the bastion server backend; Step S4: Perform a second security verification. When the second security verification passes, redirect the maintenance command entered by the maintenance personnel to the bastion terminal to implement the second level of maintenance. When the second security verification fails, disconnect the SSH connection.

2. The method for improving the security of a bastion host according to claim 1, characterized in that: Methods for configuring target users include: Disable the sftp server, root login, and password login; only allow the target user to obtain root permissions; set the target user to directly enter the bastion host console after logging in.

3. The method for improving the security of the bastion host according to claim 2, characterized in that: Methods for configuring target users include: Modify the configuration file to disable root login, password login, and allow only the target user to obtain root privileges.

4. The method for improving the security of a bastion host according to claim 1, characterized in that: The method for conducting the first security verification includes: When the bastion host recognizes that the maintenance personnel use the public and private keys to log in to the target user through SSH, the bastion host console service is started; The bastion host console displays the challenge code login interface on the console service login interface and generates the first challenge code; The response code generation module receives the first challenge code input by the maintenance personnel and generates a first response code; The bastion host console receives the first response code entered by the maintenance personnel and starts the console service management interface after the first response code is verified.

5. The method for improving the security of a bastion host according to claim 4, characterized in that: After starting the bastion host console service, limit the number of concurrent bastion host consoles at the same time so that all maintenance personnel can only establish a fixed number of SSH connections with the bastion host at the same time.

6. The method for improving the security of the bastion host according to claim 4, characterized in that: The methods for the bastion host console to generate the first challenge code include: A random original string is generated, and then encrypted using the SM2 algorithm and the public key of the SM2 algorithm is stored, and the encrypted original string is used as the first challenge code.

7. The method for improving the security of a bastion host according to claim 6, characterized in that: The response code generation module is independent of the bastion host, and the method for the response code generation module to generate the first response code includes: The first challenge code is decrypted using the SM2 algorithm to obtain the original string and combined with the preset salt value, the combined hash value is calculated using the SM3 hash algorithm, and a specified part of the hash value is intercepted as the first response code.

8. The method for improving the security of a bastion host according to claim 6, characterized in that: Methods for using the target user to trigger secondary login in the bastion host console include: When the bastion host console recognizes the specified command entered by the maintenance personnel, it jumps to the secondary login interface; The bastion host console displays the challenge code login interface on the secondary login interface and generates a second challenge code; The response code generation module receives the second challenge code input by the maintenance personnel and generates a second response code; The bastion host console receives the second response code entered by the maintenance personnel and redirects the input to the bastion host terminal after the second response code is verified.

9. A system for improving the security of a bastion host, characterized in that: include: A first login module, the first login module is used to receive a request from a maintenance personnel to log in to the bastion host through SSH using a target user with unique SSH login permission and corresponding public and private keys; A first verification module, wherein the first verification module is used to perform a first security verification. When the first security verification passes, the target user is directly logged in to the bastion host console, so that the maintenance personnel can implement the first-level maintenance by selecting and using the first-level maintenance command preset in the bastion host console. When the first security verification fails, the SSH connection is disconnected; A second login module, the second login module is used to receive a request from a maintenance personnel to log in to the bastion host backend; The second verification module is used to perform a second security verification. When the second security verification passes, the maintenance command entered by the maintenance personnel is redirected to the bastion machine terminal to achieve second-level maintenance. When the second security verification fails, the SSH connection is disconnected.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for improving the security of the bastion host as described in any one of claims 1-8 is implemented.

Images