Cloudflare Now Let's You Manage SSH Via the Cloudflare Dashboard

-



Cloudflare Now Let's You Manage SSH Via the Cloudflare Dashboard


Introduction

Cloudflare has introduced "Access for Infrastructure" as part of its Zero Trust network services, aiming to simplify and secure access to servers, databases, and other critical systems. This is done through the integration of short-lived SSH certificates, making it easier for organizations to apply Zero Trust principles across their infrastructure. Traditional methods like long-lived credentials often introduce risks and complexities. In contrast, short-lived certificates, issued by a Cloudflare-managed Certificate Authority (CA), accessible through the Cloudflare dashboard, are designed to reduce vulnerabilities, eliminate the need for manual key management, and enhance overall security.

Manage SSH Access Within Cloudflare

The integration of Cloudflare's new feature means organizations can now manage SSH access natively within Cloudflare's infrastructure protection platform. By leveraging single sign-on (SSO), multi-factor authentication (MFA), and device posture, organizations can eliminate the risks associated with managing SSH keys and passwords. Policies can also be centrally managed, ensuring that only the right individuals have access to the right servers at the right time, all while maintaining clear audit trails.


Dynamic SSH Certificates for Enhanced Security

A key part of this new approach is eliminating traditional SSH credentials in favor of dynamic SSH certificates. These certificates are valid for only a short duration, allowing secure SSH access while eliminating risks associated with long-term credentials that could be compromised. Importantly, organizations do not need to alter existing SSH workflows—developers can continue using their preferred SSH clients, while Cloudflare manages access seamlessly in the background.


Current Approach:  Manually Manage SSH

Currently, clients must manually manage SSH keys and passwords for each server, often resulting in long-lived credentials that can be easily compromised. This process involves generating SSH keys, distributing them securely, configuring each server to trust specific keys, and rotating keys periodically to mitigate security risks. Additionally, maintaining visibility over who has access to which servers can be cumbersome, especially in large environments.


New Approach:  Manage SSH Via the Cloudflare Dashboard

With Cloudflare's new Access for Infrastructure, clients can simplify this entire process. Instead of managing and distributing SSH keys, clients configure their servers to trust a Cloudflare-managed Certificate Authority (CA). This setup allows Cloudflare to dynamically issue short-lived SSH certificates, eliminating the need for static, long-lived credentials. Access policies are centrally managed through Cloudflare's platform, which determines who can access which server, and logs all activities for compliance. Going forward, this approach reduces the administrative burden while enhancing security, as credentials are no longer a static element that attackers can exploit.


Improved Workflow with SSH Command Logs

For compliance and visibility, Cloudflare captures SSH command logs through an SSH proxy, allowing organizations to review developer activities while ensuring logs remain encrypted at rest. This integration into Cloudflare's Secure Access Service Edge (SASE) architecture enables organizations to enforce robust access controls without compromising on usability, scalability, or security. Access for Infrastructure is currently available for free to teams under 50 users and seamlessly integrates with existing Cloudflare setups, helping organizations accelerate their journey toward Zero Trust infrastructure.



Source:  Cloudflare Blog - Fearless SSH: short-lived certificates bring Zero Trust to infrastructure

Image:  Roman from Pixabay

Image:  Cloudflare

Comments

Post a Comment

Popular posts from this blog

The New ChatGPT Reason Feature: What It Is and Why You Should Use It

-
Image
The New ChatGPT Reason Feature: What It Is and Why You Should Use It Offers More Than Just a Simple Answer ChatGPT continues to evolve, constantly introducing new features that make user interactions more tailored and insightful. One of the latest additions is the Reason option, which you can access through the slash menu. At its core, this feature gives you more control over the depth of responses, specifically when you’re looking for more than just a simple answer. In this article, we’ll explore what the Reason feature is, where it originated, why it matters, and how you can make the most of it. What Is the Reason Feature? The Reason option prompts ChatGPT to provide a detailed, structured explanation that dives into the reasoning behind an answer. It focuses on giving a logical breakdown of how the conclusion was reached, rather than just providing a surface-level response. Essentially, it’s a way of saying, "I want to understand not just the answer, but the reasoning behind it...
Read more

Raspberry Pi Connect vs. RealVNC: A Comprehensive Comparison

-
Image
Raspberry Pi Connect vs. RealVNC:  A  Comprehensive Comparison The Raspberry Pi has revolutionized the way we interact with computers, providing a low-cost, highly adaptable platform for countless applications. One critical aspect of using a Raspberry Pi, especially for remote management and control, is the ability to access it from another device. Historically, RealVNC has been the go-to solution for this purpose. However, the recent introduction of Raspberry Pi Connect offers an integrated alternative. This article will compare Raspberry Pi Connect and RealVNC, exploring their features, requirements, and practical applications. Introduction to Raspberry Pi Connect Raspberry Pi Connect is a new VNC service directly integrated into Raspberry Pi OS 12. Designed for simplicity and ease of use, Connect aims to provide a seamless remote desktop experience for Raspberry Pi users. Currently in beta, Raspberry Pi Connect is free to use and requires a Raspberry Pi 4, 400, or 5 running...
Read more

The Reasoning Chain in DeepSeek R1: A Glimpse into AI’s Thought Process

-
Image
The Reasoning Chain in DeepSeek R1: A Glimpse into AI’s Thought Process Imagine a user interacting with DeepSeek R1, searching for documentation on the model. They enter the following prompt: User: Where is user documentation for DeepSeek-R1? DeepSeek R1 - Reasoning Chain Output: Okay, the user is asking about DeepSeek-R1 again. I remember they previously asked for user documentation, and I provided some general steps, but now they want a description. Let me check if there’s any new information post my knowledge cutoff in July 2024. Wait, DeepSeek-R1 wasn’t in my training data up to July 2024. But maybe it’s a model they released after that. The user might be referring to an AI model by DeepSeek, given the context of previous questions. In their previous interaction, I mentioned checking official sources like GitHub or the DeepSeek website. Now, they want a description. Since I don’t have specific data on R1, I should proceed carefully. Maybe there’s some informat...
Read more