Computer Notes/Security Services Platform/Accessing the K8 Cluster - Revision history

Mflavell: /* Step 1: Generate an SSH Key Pair on SSPI */

2026-09-10T00:05:38Z

Step 1: Generate an SSH Key Pair on SSPI

← Older revision		Revision as of 00:05, 10 September 2026
Line 24:		Line 24:
	# Generate a new Ed25519 key pair:		# Generate a new Ed25519 key pair:
	#: <code>ssh-keygen -t ed25519 -C "sspi-k8s-admin"</code>		#: <code>ssh-keygen -t ed25519 -C "sspi-k8s-admin"</code>
	# Press ~~{{Key\|Enter}}~~ to accept the default file location (<code>~/.ssh/id_ed25519</code>).		# Press ENTER to accept the default file location (<code>~/.ssh/id_ed25519</code>).
	# Optionally enter a passphrase to secure the private key on disk.		# Optionally enter a passphrase to secure the private key on disk.



	== Step 2: Retrieve Target Kubernetes Node IP Addresses ==		== Step 2: Retrieve Target Kubernetes Node IP Addresses ==

Mflavell at 00:04, 10 September 2026

2026-09-10T00:04:39Z

← Older revision		Revision as of 00:04, 10 September 2026
Line 2:		Line 2:

	Utilizing public-key cryptography eliminates the reliance on static passwords, simplifies automated node administration, and aligns with security best practices for infrastructure management.		Utilizing public-key cryptography eliminates the reliance on static passwords, simplifies automated node administration, and aligns with security best practices for infrastructure management.



	== Prerequisites ==		== Prerequisites ==
Line 9:		Line 11:
	* Operational access to the `kubectl` command-line utility configured on the SSPI host.		* Operational access to the `kubectl` command-line utility configured on the SSPI host.
	* Network connectivity on TCP port 22 (SSH) between the SSPI appliance and all target Kubernetes nodes (Control Plane and Worker nodes).		* Network connectivity on TCP port 22 (SSH) between the SSPI appliance and all target Kubernetes nodes (Control Plane and Worker nodes).



	== Step 1: Generate an SSH Key Pair on SSPI ==		== Step 1: Generate an SSH Key Pair on SSPI ==
Line 22:		Line 26:
	# Press {{Key\|Enter}} to accept the default file location (<code>~/.ssh/id_ed25519</code>).		# Press {{Key\|Enter}} to accept the default file location (<code>~/.ssh/id_ed25519</code>).
	# Optionally enter a passphrase to secure the private key on disk.		# Optionally enter a passphrase to secure the private key on disk.



	== Step 2: Retrieve Target Kubernetes Node IP Addresses ==		== Step 2: Retrieve Target Kubernetes Node IP Addresses ==
Line 34:		Line 40:

	To establish trust, copy the generated public key (<code>id_ed25519.pub</code>) to the <code>~/.ssh/authorized_keys</code> file on the target node.		To establish trust, copy the generated public key (<code>id_ed25519.pub</code>) to the <code>~/.ssh/authorized_keys</code> file on the target node.



	=== Method A: Using <code>ssh-copy-id</code> (Automated) ===		=== Method A: Using <code>ssh-copy-id</code> (Automated) ===
Line 41:		Line 49:

	Enter the node's password when prompted to append the key automatically.		Enter the node's password when prompted to append the key automatically.



	=== Method B: Manual Injection (Pre-deployment or Cluster Spec) ===		=== Method B: Manual Injection (Pre-deployment or Cluster Spec) ===
Line 50:		Line 60:
	# Ensure correct file permissions on the target node:		# Ensure correct file permissions on the target node:
	#: <code>chmod 700 /root/.ssh && chmod 600 /root/.ssh/authorized_keys</code>		#: <code>chmod 700 /root/.ssh && chmod 600 /root/.ssh/authorized_keys</code>



	== Step 4: Establish Passwordless SSH Connection ==		== Step 4: Establish Passwordless SSH Connection ==
Line 58:		Line 70:

	Upon successful authentication, the terminal prompt will update to reflect the target node's hostname without prompting for a password.		Upon successful authentication, the terminal prompt will update to reflect the target node's hostname without prompting for a password.



	== Security Best Practices ==		== Security Best Practices ==
Line 64:		Line 78:
	* '''Audit Authorized Keys:''' Periodically audit the <code>/root/.ssh/authorized_keys</code> file on cluster nodes to remove obsolete or unauthorized public keys.		* '''Audit Authorized Keys:''' Periodically audit the <code>/root/.ssh/authorized_keys</code> file on cluster nodes to remove obsolete or unauthorized public keys.
	* '''Least Privilege:''' Limit direct node SSH access to emergency troubleshooting and diagnostic operations. Standard cluster administrative operations should be performed via `kubectl` or API endpoints.		* '''Least Privilege:''' Limit direct node SSH access to emergency troubleshooting and diagnostic operations. Standard cluster administrative operations should be performed via `kubectl` or API endpoints.



	== Troubleshooting ==		== Troubleshooting ==
Line 73:		Line 89:
	* Verbose SSH output can be reviewed by appending <code>-vvv</code> to the SSH command:		* Verbose SSH output can be reviewed by appending <code>-vvv</code> to the SSH command:
	*: <code>ssh -vvv -i ~/.ssh/id_ed25519 root@<NODE_INTERNAL_IP></code>		*: <code>ssh -vvv -i ~/.ssh/id_ed25519 root@<NODE_INTERNAL_IP></code>



	== See Also ==		== See Also ==
	* [[Secure Shell]]
	* [[Kubernetes]]
	* [[Public-key cryptography]]
	* [[ssh-keygen]]

	[[Category:Kubernetes]]		[[Category:Kubernetes]]

Mflavell at 00:03, 10 September 2026

2026-09-10T00:03:49Z

@@ Line 1: / Line 1: @@
-'''SSH key pair authentication''' is a public-key cryptographic mechanism used within the Secure Shell (SSH) protocol to authenticate users or machines attempting to establish a remote network connection. Unlike traditional password-based authentication, key pair authentication relies on asymmetric cryptography, utilizing a mathematically linked pair of cryptographic keys: a '''public key''' and a '''private key'''.
+'''Accessing Security Services Platform (SSP) Kubernetes Cluster Nodes from SSPI using Key Pair Authentication''' is a operational procedure used by system administrators to establish secure, passwordless SSH sessions between a VMware Security Services Platform Installer (SSPI) appliance and its managed Kubernetes (K8s) cluster nodes.
-== Mechanism and Architecture ==
+Utilizing public-key cryptography eliminates the reliance on static passwords, simplifies automated node administration, and aligns with security best practices for infrastructure management.
-* '''Private Key:''' Kept strictly confidential on the client machine. It is protected by local file permissions (typically <code>chmod 600</code>) and can be further secured using a passphrase.
+== Prerequisites ==
-When a client requests an SSH session:
+Before configuring key pair authentication, ensure the following requirements are met:
-# The client sends a signal to the server identifying the public key it wishes to use for authentication.
+* Administrative shell access (`sysadmin` or `root`) to the deployment SSPI appliance.
-# The server checks its <code>authorized_keys</code> file to confirm the key is authorized for the requested account.
+* Operational access to the `kubectl` command-line utility configured on the SSPI host.
-# The server generates a cryptographic challenge (a random string of data) and sends it to the client.
+* Network connectivity on TCP port 22 (SSH) between the SSPI appliance and all target Kubernetes nodes (Control Plane and Worker nodes).
-== Common Algorithms and Key Generation ==
+== Step 1: Generate an SSH Key Pair on SSPI ==
-* '''Ed25519:''' An Elliptic Curve Digital Signature Algorithm (EdDSA) scheme offering high performance, immunity to side-channel attacks, and a fixed key length of 256 bits. It is widely considered the modern standard.
+If an SSH key pair does not already exist on the SSPI appliance, generate a high-entropy key pair (such as Ed25519) from the SSPI terminal shell.
-== Advantages and Applications ==
+# Log into the SSPI host via SSH:
-SSH key pair authentication offers significant operational benefits over standard passwords:
+#: <code>ssh sysadmin@<SSPI_IP_ADDRESS></code>
-* '''Mitigation of Brute-Force Attacks:''' Modern SSH keys possess high entropy, rendering dictionary and online brute-force attacks mathematically infeasible.
+== Step 2: Retrieve Target Kubernetes Node IP Addresses ==
-* '''Non-Interactive Automation:''' Keys facilitate secure, automated execution of administrative scripts, deployment pipelines (CI/CD), and infrastructure management tools without human intervention.
-* '''Granular Access Control:''' System administrators can grant or revoke specific user access instantly by adding or removing individual public keys from a server, eliminating the need to reset global account passwords.
+Query the Kubernetes API server from the SSPI command line to identify the internal IP addresses of the cluster nodes:
 == See Also ==
 * [[Secure Shell]]
 * [[Public-key cryptography]]
 * [[ssh-keygen]]
-[[Category:Computer access control]]
+[[Category:Kubernetes]]
-[[Category:Network security]]
+[[Category:System Administration]]

Mflavell: Created page with "'''SSH key pair authentication''' is a public-key cryptographic mechanism used within the Secure Shell (SSH) protocol to authenticate users or machines attempting to establish a remote network connection. Unlike traditional password-based authentication, key pair authentication relies on asymmetric cryptography, utilizing a mathematically linked pair of cryptographic keys: a '''public key''' and a '''private key'''. == Mechanism and Architecture == SSH key authenticatio..."

2026-09-10T00:02:35Z

Created page with "'''SSH key pair authentication''' is a public-key cryptographic mechanism used within the Secure Shell (SSH) protocol to authenticate users or machines attempting to establish a remote network connection. Unlike traditional password-based authentication, key pair authentication relies on asymmetric cryptography, utilizing a mathematically linked pair of cryptographic keys: a '''public key''' and a '''private key'''. == Mechanism and Architecture == SSH key authenticatio..."

New page

'''SSH key pair authentication''' is a public-key cryptographic mechanism used within the Secure Shell (SSH) protocol to authenticate users or machines attempting to establish a remote network connection. Unlike traditional password-based authentication, key pair authentication relies on asymmetric cryptography, utilizing a mathematically linked pair of cryptographic keys: a '''public key''' and a '''private key'''.

== Mechanism and Architecture ==
SSH key authentication operates on a challenge-response model designed to verify identity without ever transmitting sensitive credential data over the network.

* '''Private Key:''' Kept strictly confidential on the client machine. It is protected by local file permissions (typically <code>chmod 600</code>) and can be further secured using a passphrase.
* '''Public Key:''' Placed on the target server, where it is stored in the remote user's configuration file (commonly <code>~/.ssh/authorized_keys</code>).

When a client requests an SSH session:
# The client sends a signal to the server identifying the public key it wishes to use for authentication.
# The server checks its <code>authorized_keys</code> file to confirm the key is authorized for the requested account.
# The server generates a cryptographic challenge (a random string of data) and sends it to the client.
# The client uses its local private key to sign the challenge, generating a digital signature, which is sent back to the server.
# The server uses the stored public key to verify the signature. If valid, the session is established.

== Common Algorithms and Key Generation ==
Key pairs are generated using software utilities such as OpenSSH's <code>ssh-keygen</code>. The security and performance of the key pair depend on the underlying mathematical algorithm:

* '''Ed25519:''' An Elliptic Curve Digital Signature Algorithm (EdDSA) scheme offering high performance, immunity to side-channel attacks, and a fixed key length of 256 bits. It is widely considered the modern standard.
* '''ECDSA:''' An elliptic curve implementation based on NIST curves. While secure, implementation flaws in random number generation can compromise private keys.
* '''RSA:''' A historical standard based on the integer factorization problem. Modern security guidelines mandate key lengths of 3072 or 4096 bits, as shorter lengths (e.g., 2048-bit) are increasingly vulnerable to advancing computational power.

== Advantages and Applications ==
SSH key pair authentication offers significant operational benefits over standard passwords:

* '''Mitigation of Brute-Force Attacks:''' Modern SSH keys possess high entropy, rendering dictionary and online brute-force attacks mathematically infeasible.
* '''Non-Interactive Automation:''' Keys facilitate secure, automated execution of administrative scripts, deployment pipelines (CI/CD), and infrastructure management tools without human intervention.
* '''Granular Access Control:''' System administrators can grant or revoke specific user access instantly by adding or removing individual public keys from a server, eliminating the need to reset global account passwords.

== See Also ==
* [[Secure Shell]]
* [[Public-key cryptography]]
* [[ssh-keygen]]

[[Category:Computer access control]]
[[Category:Network security]]