SSH Security Zones let you select a group of hosts, by host tags, and declare that they belong in a zone. You may then select SSH public keys, by tags, that are allowed on hosts inside that zone.

If a host is in a zone and a key that is not permitted by the zone is found on the host, Sandfly will generate an alert result during scans and indicate zone violations in the SSH Investigation pages in the Sandfly User Interface (UI).

Key status icons

In addition to alerts from future scans, real-time status is shown throughout the SSH Investigation views in the UI. For example, the SSH keys, SSH users, and SSH hosts lists all have status icons indicating a zone violation is occurring related to the key/user/host (indicated by a red shield icon), and violations are indicated in the detail pages and graph views of the SSH Security Zones.

The icons in the Status column of the SSH keys page show how each key is involved with security zones. Hover over an icon to see what it means:

A green shield means that the key is permitted in at least one security zone, and is not currently found in any other security zones causing a violation.

A gray, dashed-line shield means that the key is not permitted in any security zones, and has not been found on any host that is in a security zone. This is the "default state" when non-zoned keys are only found on non-zoned hosts.

Finally, a red shield with an exclamation mark means a zone violation: the key was found on one or more hosts in a security zone that does not permit it, whether or not another zone permits the key. Hover over the icon to see how many hosts violate zone policy.

Zone Status

The SSH security zones page (SSH investigation > Security zones) lists all of the created zones along with presenting a quick overview of the integrity of SSH public key access to your network.

In the Status column, a red shield means that the zone has violations – that is, one or more hosts in the zone have an SSH key that is not permitted in the zone. A red key icon means that a banned key is in use on one or more hosts in the zone. A green shield means that the zone has allowed keys and no security zone alerts. Click any zone for more details.

A zone's Summary tab shows all the hosts in the zone that match the criteria. When a host has an SSH key that is not permitted in the zone and/or is banned, an associated red icon is displayed in the Status column.

Clicking a host will open the SSH host page. Under the Users & Key Entries tab, you can see the specific users and the entries in their authorized_keys files that are in violation of the zone:

The Explorer view, under the Visualization tab, also shows a zone violation icon if the tree node or one of its descendants contains a zone violation:

---

VIDEO SPOTLIGHT: SSH Security Zones - Full demo of how to track, secure, and monitor SSH keys on Linux agentlessly.

Visit Sandfly Security's YouTube Channel for all of our videos.