Configure SSHepherd to Require Reauthentication for Privileged Actions
SSHepherd’s re-authentication security settings are used to ensure that users interactively provide their credentials again before performing sensitive actions. This is particularly important for mitigating risks and ensuring that the user is genuinely authorized to perform the action.
SSHepherd Security Settings Explained
- API_LIMIT_SINGLE_USE
If API_LIMIT_SINGLE_USE is set to TRUE, users will be prompted to re-authenticate each time they perform an action that requires an API call or administrative privileges. For example, listing hosts (list-host) will not prompt for additional authentication, but creating a user (create-user) , or starting a tunnel (ssh-tunnel) will require re-authentication.
- API_LIMIT_FRESHNESS
If API_LIMIT_FRESHNESS is set to TRUE, users will be prompted to re-authenticate each time they perform an action that requires an API call or administrative privileges within the time limit configured in the API_LIMIT_FRESH_WITHIN_SECONDS setting. If API_LIMIT_FRESHNESS is set to FALSE, this feature is disabled, and the API_LIMIT_FRESH_WITHIN_SECONDS setting is ignored.
- API_LIMIT_FRESH_WITHIN_SECONDS
If API_LIMIT_FRESHNESS is set to TRUE, the API_LIMIT_FRESH_WITHIN_SECONDS setting specifies the number of seconds within which users can perform multiple API calls or an action that requires administrative privileges without being prompted to re-authenticate. For instance, setting this to 300 means users can make multiple API calls or perform actions that require administrative privilege for up to 300 seconds without needing to re-authenticate. Once the timer expires, users will be prompted to enter their credentials again to continue performing these actions.
NOTE: If you choose to enable both security settings at the same time, you may be prompted to enter your credentials twice for some commands, depending on the timing of the request.
How to Configure the SSHepherd Reauthentication Security Settings
Manually edit the statefulset
- Establish an SSH connection to your SSHepherd C3 Server
- Run the following command to edit the statefulset. Add the values below to the env: section in the file to update the values with your security preferences. Make sure to match the format displayed in the image below.
KUBE_EDITOR=nano microk8s kubectl -n sshepherd edit statefulset python-flask
- name: API_LIMIT_SINGLE_USE
- value: “False”
- name: API_LIMIT_FRESHNESS
- value: “False”
- name: API_LIMIT_FRESH_WITHIN_SECONDS
- value: “0”
- Save and exit the file