OpenSSH Docker Security: Complete Guide#

This comprehensive guide covers the implementation of secure OpenSSH containers using Docker, focusing on security hardening, proper key management, network isolation, and enterprise-grade deployment strategies. Learn to build production-ready SSH jump hosts and secure remote access solutions.

Table of Contents#

Overview of OpenSSH Containerization#

Containerizing OpenSSH provides numerous benefits for secure remote access:

Isolation: Complete separation from host system
Scalability: Easy horizontal scaling of SSH services
Consistency: Identical SSH environments across deployments
Security: Reduced attack surface through containerization
Portability: Platform-independent SSH solutions

Common Use Cases#

SSH Jump Hosts: Secure bastion servers for infrastructure access
CI/CD Integration: Secure deployment pipelines
Development Environments: Isolated SSH access for development
Emergency Access: Backup SSH access methods
Multi-tenant SSH: Isolated SSH services per tenant

Secure Dockerfile Implementation#

Basic Secure Dockerfile#

1
# Use minimal base image for reduced attack surface
2
FROM alpine:3.18
3

4
# Add metadata for container identification
5
LABEL maintainer="Security Team"
6
LABEL version="1.0"
7
LABEL description="Hardened OpenSSH Server Container"
8
LABEL security.level="high"
9

10
# Install OpenSSH and security tools
11
RUN apk add --no-cache \
12
    openssh-server \
13
    openssh-keygen \
14
    openssh-client \
15
    shadow \
16
    sudo \
17
    rsyslog \
18
    fail2ban \
19
    && rm -rf /var/cache/apk/*
20

21
# Create SSH directory with proper permissions
22
RUN mkdir -p /var/run/sshd \
23
    && mkdir -p /etc/ssh/keys \
24
    && mkdir -p /var/log/ssh
25

26
# Generate host keys with strong encryption
27
RUN ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" \
28
    && ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N "" \
29
    && ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
30

31
# Set proper permissions for host keys
32
RUN chmod 600 /etc/ssh/ssh_host_*_key \
33
    && chmod 644 /etc/ssh/ssh_host_*_key.pub
34

35
# Create non-root SSH user
36
RUN addgroup -g 1000 sshuser \
37
    && adduser -D -u 1000 -G sshuser -s /bin/ash sshuser \
38
    && mkdir -p /home/sshuser/.ssh \
39
    && chown -R sshuser:sshuser /home/sshuser/.ssh \
40
    && chmod 700 /home/sshuser/.ssh
41

42
# Copy hardened SSH configuration
43
COPY sshd_config /etc/ssh/sshd_config
44
COPY ssh_banner /etc/ssh/banner
45

46
# Copy security scripts
47
COPY entrypoint.sh /entrypoint.sh
48
COPY healthcheck.sh /healthcheck.sh
49

50
# Set proper permissions
51
RUN chmod +x /entrypoint.sh /healthcheck.sh \
52
    && chmod 644 /etc/ssh/sshd_config \
53
    && chmod 644 /etc/ssh/banner
54

55
# Create log directory
56
RUN mkdir -p /var/log/auth \
57
    && touch /var/log/auth/sshd.log \
58
    && chmod 640 /var/log/auth/sshd.log
59

60
# Expose SSH port (non-standard for security)
61
EXPOSE 2222
62

63
# Add healthcheck
64
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
65
    CMD /healthcheck.sh
66

67
# Use non-root user for runtime (where possible)
68
# Note: SSH daemon requires root for initial startup
69
USER root
70

71
# Set entrypoint
72
ENTRYPOINT ["/entrypoint.sh"]
73
CMD ["/usr/sbin/sshd", "-D", "-e"]

Hardened SSH Configuration#

1
# /etc/ssh/sshd_config - Hardened SSH Configuration
2

3
# Network and Protocol Settings
4
Port 2222
5
Protocol 2
6
AddressFamily inet
7
ListenAddress 0.0.0.0
8

9
# Host Key Configuration
10
HostKey /etc/ssh/ssh_host_rsa_key
11
HostKey /etc/ssh/ssh_host_ecdsa_key
12
HostKey /etc/ssh/ssh_host_ed25519_key
13

14
# Encryption and Security
15
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
16
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
17
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
18

19
# Authentication Settings
20
LoginGraceTime 60
21
PermitRootLogin no
22
StrictModes yes
23
MaxAuthTries 3
24
MaxSessions 5
25
PubkeyAuthentication yes
26
AuthorizedKeysFile .ssh/authorized_keys
27
PasswordAuthentication no
28
PermitEmptyPasswords no
29
ChallengeResponseAuthentication no
30
KerberosAuthentication no
31
GSSAPIAuthentication no
32
UsePAM yes
33

34
# Access Control
35
AllowUsers sshuser
36
DenyUsers root
37
AllowGroups sshuser
38
X11Forwarding no
39
AllowTcpForwarding no
40
AllowAgentForwarding no
41
GatewayPorts no
42
PermitTunnel no
43

44
# Session Settings
45
ClientAliveInterval 300
46
ClientAliveCountMax 2
47
TCPKeepAlive yes
48
Compression no
49

50
# Logging
51
SyslogFacility AUTH
52
LogLevel VERBOSE
53

54
# Banner and Message
55
Banner /etc/ssh/banner
56
PrintMotd no
57
PrintLastLog yes
58

59
# File Transfer
60
Subsystem sftp internal-sftp
61

62
# Security Features
63
UseDNS no
64
PermitUserEnvironment no
65
AcceptEnv LANG LC_*
66

67
# Rate Limiting
68
MaxStartups 10:30:100
69

70
# Privilege Separation
71
UsePrivilegeSeparation sandbox

1
***************************************************************************
2
*                                WARNING                                   *
3
***************************************************************************
4
*                                                                         *
5
* This system is for authorized users only. All activities are logged    *
6
* and monitored. Unauthorized access is strictly prohibited and will be  *
7
* prosecuted to the full extent of the law.                              *
8
*                                                                         *
9
* By accessing this system, you acknowledge that:                        *
10
* - Your activities may be monitored and recorded                        *
11
* - You have no expectation of privacy                                   *
12
* - Misuse of this system is prohibited                                  *
13
*                                                                         *
14
***************************************************************************

Container Entrypoint Script#

1
#!/bin/bash
2
# /entrypoint.sh - Secure SSH container entrypoint
3

4
set -e
5

6
# Logging function
7
log() {
8
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a /var/log/auth/sshd.log
9
}
10

11
log "Starting SSH container initialization..."
12

13
# Validate environment
14
validate_environment() {
15
    log "Validating container environment..."
16

17
    # Check for required directories
18
    required_dirs=("/etc/ssh" "/var/run/sshd" "/home/sshuser/.ssh")
19
    for dir in "${required_dirs[@]}"; do
20
        if [[ ! -d "$dir" ]]; then
21
            log "ERROR: Required directory missing: $dir"
22
            exit 1
23
        fi
24
    done
25

26
    # Check for host keys
27
    host_keys=("/etc/ssh/ssh_host_rsa_key" "/etc/ssh/ssh_host_ecdsa_key" "/etc/ssh/ssh_host_ed25519_key")
28
    for key in "${host_keys[@]}"; do
29
        if [[ ! -f "$key" ]]; then
30
            log "ERROR: Host key missing: $key"
31
            exit 1
32
        fi
33
    done
34

35
    log "Environment validation completed"
36
}
37

38
# Setup authorized keys
39
setup_authorized_keys() {
40
    log "Setting up authorized keys..."
41

42
    # Check for authorized keys from environment variable
43
    if [[ -n "$SSH_PUBLIC_KEYS" ]]; then
44
        echo "$SSH_PUBLIC_KEYS" > /home/sshuser/.ssh/authorized_keys
45
        log "Authorized keys loaded from environment variable"
46
    fi
47

48
    # Check for authorized keys from mounted volume
49
    if [[ -f "/ssh-keys/authorized_keys" ]]; then
50
        cp /ssh-keys/authorized_keys /home/sshuser/.ssh/authorized_keys
51
        log "Authorized keys loaded from mounted volume"
52
    fi
53

54
    # Set proper permissions
55
    if [[ -f "/home/sshuser/.ssh/authorized_keys" ]]; then
56
        chown sshuser:sshuser /home/sshuser/.ssh/authorized_keys
57
        chmod 600 /home/sshuser/.ssh/authorized_keys
58
        log "Authorized keys permissions set"
59
    else
60
        log "WARNING: No authorized keys found - SSH access will not be possible"
61
    fi
62
}
63

64
# Configure fail2ban
65
setup_fail2ban() {
66
    log "Configuring fail2ban..."
67

68
    cat > /etc/fail2ban/jail.local << EOF
69
[sshd]
70
enabled = true
71
port = 2222
72
filter = sshd
73
logpath = /var/log/auth/sshd.log
74
maxretry = 3
75
bantime = 3600
76
findtime = 600
77
EOF
78

79
    # Start fail2ban
80
    fail2ban-server -b
81
    log "Fail2ban configured and started"
82
}
83

84
# Setup logging
85
setup_logging() {
86
    log "Configuring logging..."
87

88
    # Create rsyslog configuration for SSH
89
    cat > /etc/rsyslog.d/50-sshd.conf << EOF
90
# SSH logging configuration
91
auth,authpriv.*                 /var/log/auth/sshd.log
92
EOF
93

94
    # Start rsyslog
95
    rsyslogd
96
    log "Logging configured"
97
}
98

99
# Security hardening
100
apply_security_hardening() {
101
    log "Applying security hardening..."
102

103
    # Set secure umask
104
    umask 027
105

106
    # Disable core dumps
107
    echo "* hard core 0" >> /etc/security/limits.conf
108
    echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf
109

110
    # Set process limits
111
    echo "* hard nproc 1024" >> /etc/security/limits.conf
112
    echo "* soft nproc 1024" >> /etc/security/limits.conf
113

114
    # Apply sysctl settings
115
    sysctl -p /etc/sysctl.conf > /dev/null 2>&1 || true
116

117
    log "Security hardening applied"
118
}
119

120
# Health monitoring setup
121
setup_health_monitoring() {
122
    log "Setting up health monitoring..."
123

124
    # Create health check script
125
    cat > /usr/local/bin/ssh-health-check << 'EOF'
126
#!/bin/bash
127
# SSH health check script
128

129
# Check if SSH daemon is running
130
if ! pgrep -f "sshd" > /dev/null; then
131
    echo "ERROR: SSH daemon not running"
132
    exit 1
133
fi
134

135
# Check if SSH port is listening
136
if ! netstat -tln | grep -q ":2222 "; then
137
    echo "ERROR: SSH port not listening"
138
    exit 1
139
fi
140

141
# Test SSH configuration
142
if ! sshd -t; then
143
    echo "ERROR: SSH configuration invalid"
144
    exit 1
145
fi
146

147
echo "SSH service healthy"
148
exit 0
149
EOF
150

151
    chmod +x /usr/local/bin/ssh-health-check
152
    log "Health monitoring configured"
153
}
154

155
# Main initialization
156
main() {
157
    validate_environment
158
    setup_authorized_keys
159
    setup_logging
160
    setup_fail2ban
161
    apply_security_hardening
162
    setup_health_monitoring
163

164
    log "SSH container initialization completed"
165
    log "Starting SSH daemon..."
166

167
    # Execute the main command
168
    exec "$@"
169
}
170

171
# Run main function
172
main "$@"

Health Check Script#

1
#!/bin/bash
2
# /healthcheck.sh - Container health check
3

4
# Check SSH daemon process
5
if ! pgrep -f "sshd.*-D" > /dev/null; then
6
    echo "SSH daemon not running"
7
    exit 1
8
fi
9

10
# Check SSH port availability
11
if ! nc -z localhost 2222; then
12
    echo "SSH port not accessible"
13
    exit 1
14
fi
15

16
# Check configuration validity
17
if ! sshd -t; then
18
    echo "SSH configuration invalid"
19
    exit 1
20
fi
21

22
# Check log file exists and is writable
23
if [[ ! -w /var/log/auth/sshd.log ]]; then
24
    echo "Log file not writable"
25
    exit 1
26
fi
27

28
echo "SSH container healthy"
29
exit 0

Advanced Security Features#

Multi-Factor Authentication#

1
# Add MFA support to Dockerfile
2
RUN apk add --no-cache \
3
    google-authenticator \
4
    libpam-google-authenticator
5

6
# Copy PAM configuration
7
COPY pam_sshd /etc/pam.d/sshd

1
# /etc/pam.d/sshd - PAM configuration with MFA
2
auth required pam_google_authenticator.so
3
auth required pam_unix.so nullok
4
account required pam_unix.so
5
password required pam_unix.so
6
session required pam_unix.so
7
session required pam_limits.so

Certificate-Based Authentication#

1
# Setup SSH Certificate Authority
2
setup_ssh_ca() {
3
    log "Setting up SSH Certificate Authority..."
4

5
    # Generate CA key if not exists
6
    if [[ ! -f /etc/ssh/ca/ssh_ca ]]; then
7
        mkdir -p /etc/ssh/ca
8
        ssh-keygen -t rsa -b 4096 -f /etc/ssh/ca/ssh_ca -N "" -C "SSH-CA"
9
        chmod 600 /etc/ssh/ca/ssh_ca
10
        chmod 644 /etc/ssh/ca/ssh_ca.pub
11
        log "SSH CA key generated"
12
    fi
13

14
    # Configure SSH to trust CA
15
    echo "TrustedUserCAKeys /etc/ssh/ca/ssh_ca.pub" >> /etc/ssh/sshd_config
16

17
    log "SSH Certificate Authority configured"
18
}

Advanced Logging and Monitoring#

1
# Enhanced logging configuration
2
setup_advanced_logging() {
3
    log "Configuring advanced logging..."
4

5
    # JSON structured logging
6
    cat > /etc/rsyslog.d/60-ssh-json.conf << 'EOF'
7
# JSON format for SSH logs
8
$template ssh_json,"{\"timestamp\":\"%timegenerated:::date-rfc3339%\",\"host\":\"%hostname%\",\"process\":\"%programname%\",\"pid\":\"%procid%\",\"message\":\"%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\"}\n"
9

10
# Send SSH logs in JSON format
11
auth,authpriv.* @@logserver:514;ssh_json
12
EOF
13

14
    # Setup log rotation
15
    cat > /etc/logrotate.d/ssh << 'EOF'
16
/var/log/auth/sshd.log {
17
    daily
18
    rotate 30
19
    compress
20
    delaycompress
21
    missingok
22
    notifempty
23
    create 640 root root
24
    postrotate
25
        /usr/bin/killall -HUP rsyslogd
26
    endscript
27
}
28
EOF
29

30
    log "Advanced logging configured"
31
}
32

33
# Real-time monitoring
34
setup_monitoring() {
35
    log "Setting up real-time monitoring..."
36

37
    # Create monitoring script
38
    cat > /usr/local/bin/ssh-monitor << 'EOF'
39
#!/bin/bash
40
# Real-time SSH monitoring
41

42
LOGFILE="/var/log/auth/sshd.log"
43
ALERT_EMAIL="security@company.com"
44

45
# Monitor for suspicious activities
46
tail -F "$LOGFILE" | while read line; do
47
    # Check for brute force attempts
48
    if echo "$line" | grep -q "Failed password"; then
49
        ip=$(echo "$line" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
50
        # Alert if more than 5 failures from same IP
51
        failures=$(grep "Failed password.*$ip" "$LOGFILE" | wc -l)
52
        if [[ $failures -gt 5 ]]; then
53
            echo "ALERT: Brute force detected from $ip" | \
54
                mail -s "SSH Security Alert" "$ALERT_EMAIL"
55
        fi
56
    fi
57

58
    # Check for successful logins
59
    if echo "$line" | grep -q "Accepted"; then
60
        echo "INFO: Successful SSH login detected"
61
        # Log to security monitoring system
62
        logger -p auth.info "SSH_LOGIN_SUCCESS: $line"
63
    fi
64

65
    # Check for privilege escalation attempts
66
    if echo "$line" | grep -q "sudo"; then
67
        echo "ALERT: Sudo usage detected in SSH session"
68
        logger -p auth.warning "SSH_SUDO_USAGE: $line"
69
    fi
70
done &
71
EOF
72

73
    chmod +x /usr/local/bin/ssh-monitor
74
    log "Real-time monitoring configured"
75
}

Container Security Hardening#

Security Contexts and Capabilities#

1
# docker-compose.yml with security contexts
2
version: "3.8"
3

4
services:
5
  openssh:
6
    build: .
7
    ports:
8
      - "2222:2222"
9
    volumes:
10
      - ssh-keys:/ssh-keys:ro
11
      - ssh-logs:/var/log/auth
12
    security_opt:
13
      - no-new-privileges:true
14
      - seccomp:unconfined
15
    cap_drop:
16
      - ALL
17
    cap_add:
18
      - SETUID
19
      - SETGID
20
      - CHOWN
21
      - DAC_OVERRIDE
22
      - FOWNER
23
      - NET_BIND_SERVICE
24
    read_only: true
25
    tmpfs:
26
      - /tmp:size=100M,noexec,nosuid,nodev
27
      - /var/run:size=50M,noexec,nosuid,nodev
28
    environment:
29
      - SSH_PUBLIC_KEYS=${SSH_PUBLIC_KEYS}
30
    restart: unless-stopped
31
    networks:
32
      - ssh-network
33

34
networks:
35
  ssh-network:
36
    driver: bridge
37
    ipam:
38
      config:
39
        - subnet: 172.20.0.0/16
40

41
volumes:
42
  ssh-keys:
43
    driver: local
44
  ssh-logs:
45
    driver: local

AppArmor Profile#

1
# AppArmor profile for SSH container
2
#include <tunables/global>
3

4
profile docker-openssh flags=(attach_disconnected,mediate_deleted) {
5
  #include <abstractions/base>
6
  #include <abstractions/nameservice>
7
  #include <abstractions/openssl>
8
  #include <abstractions/ssl_certs>
9

10
  # Network access
11
  network inet tcp,
12
  network inet udp,
13
  network inet6 tcp,
14
  network inet6 udp,
15

16
  # File system access
17
  /etc/ssh/ r,
18
  /etc/ssh/** r,
19
  /var/log/auth/ rw,
20
  /var/log/auth/** rw,
21
  /var/run/sshd/ rw,
22
  /var/run/sshd/** rw,
23
  /home/sshuser/ r,
24
  /home/sshuser/.ssh/ r,
25
  /home/sshuser/.ssh/** r,
26

27
  # Binary execution
28
  /usr/sbin/sshd ix,
29
  /bin/bash ix,
30
  /bin/ash ix,
31

32
  # Deny dangerous capabilities
33
  deny capability sys_admin,
34
  deny capability sys_module,
35
  deny capability sys_rawio,
36
  deny capability sys_time,
37

38
  # Allow necessary capabilities
39
  capability setuid,
40
  capability setgid,
41
  capability chown,
42
  capability dac_override,
43
  capability fowner,
44
  capability net_bind_service,
45
}

Seccomp Profile#

1
{
2
  "defaultAction": "SCMP_ACT_ERRNO",
3
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
4
  "syscalls": [
5
    {
6
      "names": [
7
        "accept",
8
        "accept4",
9
        "access",
10
        "bind",
11
        "brk",
12
        "chdir",
13
        "chmod",
14
        "chown",
15
        "chown32",
16
        "clock_gettime",
17
        "close",
18
        "connect",
19
        "dup",
20
        "dup2",
21
        "epoll_create",
22
        "epoll_create1",
23
        "epoll_ctl",
24
        "epoll_wait",
25
        "execve",
26
        "exit",
27
        "exit_group",
28
        "fchdir",
29
        "fchmod",
30
        "fchown",
31
        "fchown32",
32
        "fcntl",
33
        "fcntl64",
34
        "fork",
35
        "fstat",
36
        "fstat64",
37
        "getdents",
38
        "getdents64",
39
        "getegid",
40
        "getegid32",
41
        "geteuid",
42
        "geteuid32",
43
        "getgid",
44
        "getgid32",
45
        "getgroups",
46
        "getgroups32",
47
        "getpgrp",
48
        "getpid",
49
        "getppid",
50
        "getrlimit",
51
        "getsid",
52
        "getsockname",
53
        "getsockopt",
54
        "getuid",
55
        "getuid32",
56
        "ioctl",
57
        "kill",
58
        "listen",
59
        "lseek",
60
        "lstat",
61
        "lstat64",
62
        "mmap",
63
        "mmap2",
64
        "mprotect",
65
        "munmap",
66
        "nanosleep",
67
        "open",
68
        "openat",
69
        "pipe",
70
        "pipe2",
71
        "poll",
72
        "read",
73
        "readlink",
74
        "recv",
75
        "recvfrom",
76
        "recvmsg",
77
        "rt_sigaction",
78
        "rt_sigprocmask",
79
        "rt_sigreturn",
80
        "select",
81
        "send",
82
        "sendmsg",
83
        "sendto",
84
        "setgid",
85
        "setgid32",
86
        "setgroups",
87
        "setgroups32",
88
        "setresuid",
89
        "setresuid32",
90
        "setsid",
91
        "setsockopt",
92
        "setuid",
93
        "setuid32",
94
        "shutdown",
95
        "socket",
96
        "socketpair",
97
        "stat",
98
        "stat64",
99
        "time",
100
        "uname",
101
        "unlink",
102
        "wait4",
103
        "waitpid",
104
        "write"
105
      ],
106
      "action": "SCMP_ACT_ALLOW"
107
    }
108
  ]
109
}

Key Management and Rotation#

Automated Key Rotation#

1
#!/bin/bash
2
# ssh-key-rotation.sh - Automated SSH key rotation
3

4
KEY_ROTATION_INTERVAL=${KEY_ROTATION_INTERVAL:-30} # days
5
BACKUP_DIR="/etc/ssh/backup"
6
LOG_FILE="/var/log/auth/key-rotation.log"
7

8
log() {
9
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
10
}
11

12
# Check if key rotation is needed
13
check_key_age() {
14
    local key_file="$1"
15
    local max_age="$KEY_ROTATION_INTERVAL"
16

17
    if [[ -f "$key_file" ]]; then
18
        local key_age=$(( ($(date +%s) - $(stat -f %m "$key_file")) / 86400 ))
19
        if [[ $key_age -gt $max_age ]]; then
20
            return 0  # Rotation needed
21
        fi
22
    fi
23
    return 1  # No rotation needed
24
}
25

26
# Backup existing keys
27
backup_keys() {
28
    log "Backing up existing SSH keys..."
29

30
    mkdir -p "$BACKUP_DIR/$(date +%Y%m%d_%H%M%S)"
31
    local backup_path="$BACKUP_DIR/$(date +%Y%m%d_%H%M%S)"
32

33
    cp /etc/ssh/ssh_host_*_key* "$backup_path/" 2>/dev/null || true
34

35
    log "Keys backed up to $backup_path"
36
}
37

38
# Generate new host keys
39
generate_new_keys() {
40
    log "Generating new SSH host keys..."
41

42
    # Remove old keys
43
    rm -f /etc/ssh/ssh_host_*_key*
44

45
    # Generate new keys
46
    ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" -C "$(hostname)-$(date +%Y%m%d)"
47
    ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N "" -C "$(hostname)-$(date +%Y%m%d)"
48
    ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" -C "$(hostname)-$(date +%Y%m%d)"
49

50
    # Set proper permissions
51
    chmod 600 /etc/ssh/ssh_host_*_key
52
    chmod 644 /etc/ssh/ssh_host_*_key.pub
53

54
    log "New SSH host keys generated"
55
}
56

57
# Update known_hosts on client systems
58
update_known_hosts() {
59
    log "Updating known_hosts on client systems..."
60

61
    # Extract public keys
62
    local rsa_key=$(cat /etc/ssh/ssh_host_rsa_key.pub)
63
    local ecdsa_key=$(cat /etc/ssh/ssh_host_ecdsa_key.pub)
64
    local ed25519_key=$(cat /etc/ssh/ssh_host_ed25519_key.pub)
65

66
    # Send notification to configuration management system
67
    # This would typically integrate with your CM system (Ansible, Puppet, etc.)
68
    curl -X POST "${CM_WEBHOOK_URL}" \
69
         -H "Content-Type: application/json" \
70
         -d "{
71
           \"action\": \"update_known_hosts\",
72
           \"hostname\": \"$(hostname)\",
73
           \"keys\": {
74
             \"rsa\": \"$rsa_key\",
75
             \"ecdsa\": \"$ecdsa_key\",
76
             \"ed25519\": \"$ed25519_key\"
77
           }
78
         }" || log "WARNING: Failed to notify CM system"
79

80
    log "Known_hosts update notification sent"
81
}
82

83
# Restart SSH daemon
84
restart_ssh() {
85
    log "Restarting SSH daemon..."
86

87
    # Test configuration first
88
    if sshd -t; then
89
        # Send SIGHUP to reload configuration
90
        pkill -HUP sshd
91
        log "SSH daemon reloaded successfully"
92
    else
93
        log "ERROR: SSH configuration test failed"
94
        return 1
95
    fi
96
}
97

98
# Main rotation process
99
main() {
100
    log "Starting SSH key rotation process..."
101

102
    # Check if any key needs rotation
103
    local rotation_needed=false
104
    for key_file in /etc/ssh/ssh_host_*_key; do
105
        if check_key_age "$key_file"; then
106
            rotation_needed=true
107
            break
108
        fi
109
    done
110

111
    if [[ "$rotation_needed" == "true" ]] || [[ "$1" == "--force" ]]; then
112
        log "SSH key rotation required"
113

114
        backup_keys
115
        generate_new_keys
116
        update_known_hosts
117
        restart_ssh
118

119
        log "SSH key rotation completed successfully"
120
    else
121
        log "SSH key rotation not required"
122
    fi
123
}
124

125
# Run main function
126
main "$@"

Key Distribution System#

1
#!/usr/bin/env python3
2
# ssh-key-distributor.py - SSH key distribution system
3

4
import json
5
import logging
6
import os
7
import subprocess
8
import sys
9
from datetime import datetime, timedelta
10
from pathlib import Path
11
import requests
12
import yaml
13

14
# Configure logging
15
logging.basicConfig(
16
    level=logging.INFO,
17
    format='%(asctime)s - %(levelname)s - %(message)s',
18
    handlers=[
19
        logging.FileHandler('/var/log/auth/key-distribution.log'),
20
        logging.StreamHandler()
21
    ]
22
)
23

24
class SSHKeyDistributor:
25
    def __init__(self, config_file='/etc/ssh/key-distribution.yaml'):
26
        self.config = self.load_config(config_file)
27
        self.logger = logging.getLogger(__name__)
28

29
    def load_config(self, config_file):
30
        """Load configuration from YAML file"""
31
        try:
32
            with open(config_file, 'r') as f:
33
                return yaml.safe_load(f)
34
        except FileNotFoundError:
35
            self.logger.error(f"Configuration file not found: {config_file}")
36
            sys.exit(1)
37

38
    def get_authorized_keys(self, username):
39
        """Retrieve authorized keys for a user from central system"""
40
        try:
41
            response = requests.get(
42
                f"{self.config['key_server']['url']}/users/{username}/keys",
43
                headers={
44
                    'Authorization': f"Bearer {self.config['key_server']['token']}",
45
                    'Content-Type': 'application/json'
46
                },
47
                timeout=30
48
            )
49
            response.raise_for_status()
50
            return response.json().get('keys', [])
51
        except requests.RequestException as e:
52
            self.logger.error(f"Failed to retrieve keys for {username}: {e}")
53
            return []
54

55
    def validate_key(self, public_key):
56
        """Validate SSH public key format"""
57
        try:
58
            # Use ssh-keygen to validate key
59
            result = subprocess.run(
60
                ['ssh-keygen', '-l', '-f', '/dev/stdin'],
61
                input=public_key.encode(),
62
                capture_output=True,
63
                text=True
64
            )
65
            return result.returncode == 0
66
        except Exception as e:
67
            self.logger.error(f"Key validation failed: {e}")
68
            return False
69

70
    def update_authorized_keys(self, username, keys):
71
        """Update authorized_keys file for user"""
72
        user_home = Path(f"/home/{username}")
73
        ssh_dir = user_home / ".ssh"
74
        authorized_keys_file = ssh_dir / "authorized_keys"
75

76
        try:
77
            # Create .ssh directory if it doesn't exist
78
            ssh_dir.mkdir(mode=0o700, exist_ok=True)
79

80
            # Validate all keys before writing
81
            valid_keys = []
82
            for key in keys:
83
                if self.validate_key(key):
84
                    valid_keys.append(key)
85
                else:
86
                    self.logger.warning(f"Invalid key for user {username}: {key[:50]}...")
87

88
            # Write authorized keys
89
            with open(authorized_keys_file, 'w') as f:
90
                for key in valid_keys:
91
                    f.write(f"{key}\n")
92

93
            # Set proper permissions
94
            authorized_keys_file.chmod(0o600)
95
            subprocess.run(['chown', f"{username}:{username}", str(authorized_keys_file)])
96

97
            self.logger.info(f"Updated authorized_keys for {username}: {len(valid_keys)} keys")
98
            return True
99

100
        except Exception as e:
101
            self.logger.error(f"Failed to update authorized_keys for {username}: {e}")
102
            return False
103

104
    def sync_user_keys(self, username):
105
        """Sync keys for a specific user"""
106
        self.logger.info(f"Syncing keys for user: {username}")
107

108
        # Get keys from central system
109
        keys = self.get_authorized_keys(username)
110

111
        if keys:
112
            return self.update_authorized_keys(username, keys)
113
        else:
114
            self.logger.warning(f"No keys found for user: {username}")
115
            return False
116

117
    def sync_all_users(self):
118
        """Sync keys for all configured users"""
119
        users = self.config.get('users', [])
120
        success_count = 0
121

122
        for username in users:
123
            if self.sync_user_keys(username):
124
                success_count += 1
125

126
        self.logger.info(f"Key sync completed: {success_count}/{len(users)} users updated")
127
        return success_count == len(users)
128

129
    def audit_keys(self):
130
        """Perform security audit of SSH keys"""
131
        self.logger.info("Starting SSH key security audit...")
132

133
        issues = []
134

135
        for username in self.config.get('users', []):
136
            user_home = Path(f"/home/{username}")
137
            authorized_keys_file = user_home / ".ssh" / "authorized_keys"
138

139
            if not authorized_keys_file.exists():
140
                continue
141

142
            # Check file permissions
143
            file_mode = authorized_keys_file.stat().st_mode & 0o777
144
            if file_mode != 0o600:
145
                issues.append(f"Incorrect permissions on {authorized_keys_file}: {oct(file_mode)}")
146

147
            # Check key expiration
148
            with open(authorized_keys_file, 'r') as f:
149
                for line_num, line in enumerate(f, 1):
150
                    line = line.strip()
151
                    if not line or line.startswith('#'):
152
                        continue
153

154
                    # Extract key comment for expiration check
155
                    parts = line.split()
156
                    if len(parts) >= 3:
157
                        comment = ' '.join(parts[2:])
158
                        if 'expires:' in comment:
159
                            # Parse expiration date
160
                            try:
161
                                expires_str = comment.split('expires:')[1].strip()
162
                                expires_date = datetime.fromisoformat(expires_str)
163
                                if expires_date < datetime.now():
164
                                    issues.append(f"Expired key in {authorized_keys_file}:{line_num}")
165
                            except (ValueError, IndexError):
166
                                issues.append(f"Invalid expiration format in {authorized_keys_file}:{line_num}")
167

168
        if issues:
169
            self.logger.warning(f"Security audit found {len(issues)} issues:")
170
            for issue in issues:
171
                self.logger.warning(f"  - {issue}")
172
        else:
173
            self.logger.info("Security audit completed - no issues found")
174

175
        return len(issues) == 0
176

177
def main():
178
    if len(sys.argv) < 2:
179
        print("Usage: ssh-key-distributor.py <sync|audit> [username]")
180
        sys.exit(1)
181

182
    distributor = SSHKeyDistributor()
183
    command = sys.argv[1]
184

185
    if command == "sync":
186
        if len(sys.argv) > 2:
187
            # Sync specific user
188
            username = sys.argv[2]
189
            success = distributor.sync_user_keys(username)
190
        else:
191
            # Sync all users
192
            success = distributor.sync_all_users()
193

194
        sys.exit(0 if success else 1)
195

196
    elif command == "audit":
197
        success = distributor.audit_keys()
198
        sys.exit(0 if success else 1)
199

200
    else:
201
        print(f"Unknown command: {command}")
202
        sys.exit(1)
203

204
if __name__ == "__main__":
205
    main()

Network Security and Isolation#

Network Segmentation#

1
# docker-compose.yml with network segmentation
2
version: "3.8"
3

4
services:
5
  openssh-dmz:
6
    build: .
7
    ports:
8
      - "2222:2222"
9
    networks:
10
      - dmz-network
11
      - internal-network
12
    volumes:
13
      - ssh-keys-dmz:/ssh-keys:ro
14
    environment:
15
      - SSH_ROLE=dmz
16
    deploy:
17
      replicas: 2
18
      update_config:
19
        parallelism: 1
20
        delay: 30s
21
      restart_policy:
22
        condition: on-failure
23
        delay: 5s
24
        max_attempts: 3
25

26
  openssh-internal:
27
    build: .
28
    ports:
29
      - "2223:2222"
30
    networks:
31
      - internal-network
32
      - backend-network
33
    volumes:
34
      - ssh-keys-internal:/ssh-keys:ro
35
    environment:
36
      - SSH_ROLE=internal
37
    depends_on:
38
      - openssh-dmz
39

40
  ssh-proxy:
41
    image: nginx:alpine
42
    ports:
43
      - "22:22"
44
    volumes:
45
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
46
    networks:
47
      - dmz-network
48
    depends_on:
49
      - openssh-dmz
50

51
networks:
52
  dmz-network:
53
    driver: bridge
54
    ipam:
55
      config:
56
        - subnet: 172.20.0.0/24
57
          gateway: 172.20.0.1
58
    driver_opts:
59
      com.docker.network.bridge.name: br-dmz
60
      com.docker.network.bridge.enable_icc: "false"
61
      com.docker.network.bridge.enable_ip_masquerade: "true"
62

63
  internal-network:
64
    driver: bridge
65
    ipam:
66
      config:
67
        - subnet: 172.21.0.0/24
68
          gateway: 172.21.0.1
69
    driver_opts:
70
      com.docker.network.bridge.name: br-internal
71

72
  backend-network:
73
    driver: bridge
74
    ipam:
75
      config:
76
        - subnet: 172.22.0.0/24
77
          gateway: 172.22.0.1
78
    driver_opts:
79
      com.docker.network.bridge.name: br-backend
80

81
volumes:
82
  ssh-keys-dmz:
83
  ssh-keys-internal:

iptables Rules for Container Security#

1
#!/bin/bash
2
# iptables-ssh-container.sh - iptables rules for SSH containers
3

4
# Flush existing rules
5
iptables -F
6
iptables -X
7
iptables -t nat -F
8
iptables -t nat -X
9

10
# Set default policies
11
iptables -P INPUT DROP
12
iptables -P FORWARD DROP
13
iptables -P OUTPUT ACCEPT
14

15
# Allow loopback traffic
16
iptables -A INPUT -i lo -j ACCEPT
17
iptables -A OUTPUT -o lo -j ACCEPT
18

19
# Allow established and related connections
20
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
21

22
# SSH container specific rules
23
# Allow SSH on port 2222 with rate limiting
24
iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH
25
iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
26
iptables -A INPUT -p tcp --dport 2222 -j ACCEPT
27

28
# Docker bridge networks
29
iptables -A INPUT -i br-dmz -j ACCEPT
30
iptables -A INPUT -i br-internal -j ACCEPT
31
iptables -A INPUT -i br-backend -j ACCEPT
32

33
# Allow Docker containers to communicate
34
iptables -A FORWARD -i br-dmz -o br-internal -j ACCEPT
35
iptables -A FORWARD -i br-internal -o br-backend -j ACCEPT
36

37
# Block direct access to backend from DMZ
38
iptables -A FORWARD -i br-dmz -o br-backend -j DROP
39

40
# Log dropped packets
41
iptables -A INPUT -j LOG --log-prefix "DROPPED INPUT: "
42
iptables -A FORWARD -j LOG --log-prefix "DROPPED FORWARD: "
43

44
# Save rules
45
iptables-save > /etc/iptables/rules.v4
46

47
echo "iptables rules applied for SSH containers"

High Availability and Load Balancing#

HAProxy Configuration#

1
# haproxy.cfg - Load balancer for SSH containers
2
global
3
    daemon
4
    log stdout local0
5
    chroot /var/lib/haproxy
6
    stats socket /run/haproxy/admin.sock mode 660 level admin
7
    stats timeout 30s
8
    user haproxy
9
    group haproxy
10

11
    # Security
12
    ssl-default-bind-options ssl-min-ver TLSv1.2
13
    ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
14

15
defaults
16
    mode tcp
17
    log global
18
    option tcplog
19
    option dontlognull
20
    timeout connect 5000ms
21
    timeout client 50000ms
22
    timeout server 50000ms
23

24
frontend ssh_frontend
25
    bind *:22
26
    mode tcp
27

28
    # Rate limiting
29
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
30
    tcp-request inspect-delay 5s
31
    tcp-request content track-sc0 src
32
    tcp-request content reject if { sc_http_req_rate(0) gt 10 }
33

34
    default_backend ssh_backend
35

36
backend ssh_backend
37
    mode tcp
38
    balance roundrobin
39

40
    # Health checks
41
    option tcp-check
42
    tcp-check send-binary 5353482d322e30
43
    tcp-check expect binary 5353482d322e30
44

45
    # SSH containers
46
    server ssh1 openssh-1:2222 check inter 5s rise 2 fall 3
47
    server ssh2 openssh-2:2222 check inter 5s rise 2 fall 3
48
    server ssh3 openssh-3:2222 check inter 5s rise 2 fall 3
49

50
listen stats
51
    bind *:8080
52
    mode http
53
    stats enable
54
    stats uri /stats
55
    stats refresh 30s
56
    stats admin if TRUE

Kubernetes Deployment#

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: openssh-server
5
  namespace: ssh-service
6
  labels:
7
    app: openssh-server
8
spec:
9
  replicas: 3
10
  selector:
11
    matchLabels:
12
      app: openssh-server
13
  template:
14
    metadata:
15
      labels:
16
        app: openssh-server
17
    spec:
18
      securityContext:
19
        runAsNonRoot: false # SSH daemon requires root
20
        fsGroup: 1000
21
      containers:
22
        - name: openssh
23
          image: company/openssh:latest
24
          ports:
25
            - containerPort: 2222
26
              name: ssh
27
          securityContext:
28
            allowPrivilegeEscalation: false
29
            readOnlyRootFilesystem: true
30
            capabilities:
31
              drop:
32
                - ALL
33
              add:
34
                - SETUID
35
                - SETGID
36
                - CHOWN
37
                - DAC_OVERRIDE
38
                - FOWNER
39
                - NET_BIND_SERVICE
40
          env:
41
            - name: SSH_PUBLIC_KEYS
42
              valueFrom:
43
                secretKeyRef:
44
                  name: ssh-public-keys
45
                  key: authorized_keys
46
          volumeMounts:
47
            - name: ssh-host-keys
48
              mountPath: /etc/ssh/keys
49
              readOnly: true
50
            - name: ssh-logs
51
              mountPath: /var/log/auth
52
            - name: tmp
53
              mountPath: /tmp
54
            - name: var-run
55
              mountPath: /var/run
56
          resources:
57
            requests:
58
              memory: "64Mi"
59
              cpu: "50m"
60
            limits:
61
              memory: "128Mi"
62
              cpu: "100m"
63
          livenessProbe:
64
            tcpSocket:
65
              port: 2222
66
            initialDelaySeconds: 30
67
            periodSeconds: 10
68
          readinessProbe:
69
            tcpSocket:
70
              port: 2222
71
            initialDelaySeconds: 5
72
            periodSeconds: 5
73
      volumes:
74
        - name: ssh-host-keys
75
          secret:
76
            secretName: ssh-host-keys
77
            defaultMode: 0600
78
        - name: ssh-logs
79
          emptyDir: {}
80
        - name: tmp
81
          emptyDir:
82
            sizeLimit: 100Mi
83
        - name: var-run
84
          emptyDir:
85
            sizeLimit: 50Mi
86
      nodeSelector:
87
        security-zone: dmz
88
      tolerations:
89
        - key: "security-zone"
90
          operator: "Equal"
91
          value: "dmz"
92
          effect: "NoSchedule"
93

94
---
95
apiVersion: v1
96
kind: Service
97
metadata:
98
  name: openssh-service
99
  namespace: ssh-service
100
spec:
101
  selector:
102
    app: openssh-server
103
  ports:
104
    - port: 22
105
      targetPort: 2222
106
      protocol: TCP
107
  type: LoadBalancer
108
  loadBalancerSourceRanges:
109
    - 10.0.0.0/8
110
    - 172.16.0.0/12
111
    - 192.168.0.0/16
112

113
---
114
apiVersion: networking.k8s.io/v1
115
kind: NetworkPolicy
116
metadata:
117
  name: openssh-network-policy
118
  namespace: ssh-service
119
spec:
120
  podSelector:
121
    matchLabels:
122
      app: openssh-server
123
  policyTypes:
124
    - Ingress
125
    - Egress
126
  ingress:
127
    - from:
128
        - namespaceSelector:
129
            matchLabels:
130
              name: ssh-service
131
        - podSelector: {}
132
      ports:
133
        - protocol: TCP
134
          port: 2222
135
  egress:
136
    - to: []
137
      ports:
138
        - protocol: TCP
139
          port: 53
140
        - protocol: UDP
141
          port: 53
142
    - to:
143
        - namespaceSelector:
144
            matchLabels:
145
              name: logging
146
      ports:
147
        - protocol: TCP
148
          port: 514

Monitoring and Alerting#

Prometheus Metrics#

1
#!/usr/bin/env python3
2
# ssh-metrics-exporter.py - Prometheus metrics for SSH containers
3

4
import time
5
import re
6
import subprocess
7
from prometheus_client import start_http_server, Gauge, Counter, Histogram
8
import logging
9

10
# Configure logging
11
logging.basicConfig(level=logging.INFO)
12
logger = logging.getLogger(__name__)
13

14
# Prometheus metrics
15
ssh_connections_active = Gauge('ssh_connections_active', 'Number of active SSH connections')
16
ssh_connections_total = Counter('ssh_connections_total', 'Total SSH connections', ['status'])
17
ssh_auth_attempts = Counter('ssh_auth_attempts_total', 'SSH authentication attempts', ['method', 'result'])
18
ssh_session_duration = Histogram('ssh_session_duration_seconds', 'SSH session duration')
19
ssh_bytes_transferred = Counter('ssh_bytes_transferred_total', 'Bytes transferred over SSH', ['direction'])
20

21
class SSHMetricsCollector:
22
    def __init__(self):
23
        self.log_file = '/var/log/auth/sshd.log'
24
        self.last_position = 0
25

26
    def get_active_connections(self):
27
        """Count active SSH connections"""
28
        try:
29
            result = subprocess.run(['netstat', '-tn'], capture_output=True, text=True)
30
            connections = 0
31
            for line in result.stdout.split('\n'):
32
                if ':2222' in line and 'ESTABLISHED' in line:
33
                    connections += 1
34
            return connections
35
        except Exception as e:
36
            logger.error(f"Error counting connections: {e}")
37
            return 0
38

39
    def parse_log_line(self, line):
40
        """Parse SSH log line and extract metrics"""
41
        # Connection established
42
        if 'Accepted' in line:
43
            ssh_connections_total.labels(status='accepted').inc()
44

45
            # Extract authentication method
46
            if 'publickey' in line:
47
                ssh_auth_attempts.labels(method='publickey', result='success').inc()
48
            elif 'password' in line:
49
                ssh_auth_attempts.labels(method='password', result='success').inc()
50

51
        # Connection failed
52
        elif 'Failed' in line:
53
            ssh_connections_total.labels(status='failed').inc()
54

55
            if 'publickey' in line:
56
                ssh_auth_attempts.labels(method='publickey', result='failure').inc()
57
            elif 'password' in line:
58
                ssh_auth_attempts.labels(method='password', result='failure').inc()
59

60
        # Session closed
61
        elif 'session closed' in line:
62
            # Extract session duration if available
63
            duration_match = re.search(r'duration: (\d+)', line)
64
            if duration_match:
65
                duration = int(duration_match.group(1))
66
                ssh_session_duration.observe(duration)
67

68
        # Bytes transferred
69
        elif 'bytes' in line:
70
            bytes_match = re.search(r'(\d+) bytes', line)
71
            if bytes_match:
72
                bytes_count = int(bytes_match.group(1))
73
                if 'sent' in line:
74
                    ssh_bytes_transferred.labels(direction='sent').inc(bytes_count)
75
                elif 'received' in line:
76
                    ssh_bytes_transferred.labels(direction='received').inc(bytes_count)
77

78
    def collect_metrics(self):
79
        """Collect all SSH metrics"""
80
        try:
81
            # Update active connections
82
            active_conns = self.get_active_connections()
83
            ssh_connections_active.set(active_conns)
84

85
            # Parse new log entries
86
            try:
87
                with open(self.log_file, 'r') as f:
88
                    f.seek(self.last_position)
89
                    for line in f:
90
                        self.parse_log_line(line.strip())
91
                    self.last_position = f.tell()
92
            except FileNotFoundError:
93
                logger.warning(f"Log file not found: {self.log_file}")
94

95
        except Exception as e:
96
            logger.error(f"Error collecting metrics: {e}")
97

98
def main():
99
    # Start Prometheus metrics server
100
    start_http_server(8090)
101
    logger.info("SSH metrics exporter started on port 8090")
102

103
    collector = SSHMetricsCollector()
104

105
    while True:
106
        collector.collect_metrics()
107
        time.sleep(10)  # Collect metrics every 10 seconds
108

109
if __name__ == "__main__":
110
    main()

Grafana Dashboard#

1
{
2
  "dashboard": {
3
    "title": "SSH Container Security Dashboard",
4
    "tags": ["ssh", "security", "containers"],
5
    "panels": [
6
      {
7
        "title": "Active SSH Connections",
8
        "type": "stat",
9
        "targets": [
10
          {
11
            "expr": "ssh_connections_active"
12
          }
13
        ],
14
        "fieldConfig": {
15
          "defaults": {
16
            "color": {
17
              "mode": "thresholds"
18
            },
19
            "thresholds": {
20
              "steps": [
21
                { "color": "green", "value": 0 },
22
                { "color": "yellow", "value": 10 },
23
                { "color": "red", "value": 50 }
24
              ]
25
            }
26
          }
27
        }
28
      },
29
      {
30
        "title": "SSH Connection Rate",
31
        "type": "graph",
32
        "targets": [
33
          {
34
            "expr": "rate(ssh_connections_total[5m])"
35
          }
36
        ]
37
      },
38
      {
39
        "title": "Authentication Failures",
40
        "type": "graph",
41
        "targets": [
42
          {
43
            "expr": "rate(ssh_auth_attempts_total{result=\"failure\"}[5m])"
44
          }
45
        ]
46
      },
47
      {
48
        "title": "Top Failed IPs",
49
        "type": "table",
50
        "targets": [
51
          {
52
            "expr": "topk(10, sum by (client_ip) (rate(ssh_connections_total{status=\"failed\"}[1h])))"
53
          }
54
        ]
55
      }
56
    ]
57
  }
58
}

Compliance and Auditing#

SOC 2 Compliance#

1
#!/bin/bash
2
# soc2-compliance-check.sh - SOC 2 compliance validation
3

4
COMPLIANCE_LOG="/var/log/auth/compliance.log"
5

6
log_compliance() {
7
    echo "[$(date -u '+%Y-%m-%d %H:%M:%S UTC')] $1" | tee -a "$COMPLIANCE_LOG"
8
}
9

10
# CC6.1 - Logical and Physical Access Controls
11
check_access_controls() {
12
    log_compliance "Checking access controls (CC6.1)..."
13

14
    # Verify SSH configuration
15
    local violations=0
16

17
    # Check for root login disabled
18
    if grep -q "PermitRootLogin yes" /etc/ssh/sshd_config; then
19
        log_compliance "VIOLATION: Root login is enabled"
20
        ((violations++))
21
    fi
22

23
    # Check for password authentication disabled
24
    if grep -q "PasswordAuthentication yes" /etc/ssh/sshd_config; then
25
        log_compliance "VIOLATION: Password authentication is enabled"
26
        ((violations++))
27
    fi
28

29
    # Check for key-based authentication only
30
    if ! grep -q "PubkeyAuthentication yes" /etc/ssh/sshd_config; then
31
        log_compliance "VIOLATION: Public key authentication is not enabled"
32
        ((violations++))
33
    fi
34

35
    log_compliance "Access controls check completed: $violations violations"
36
    return $violations
37
}
38

39
# CC6.2 - User Access Provisioning and Deprovisioning
40
check_user_provisioning() {
41
    log_compliance "Checking user provisioning (CC6.2)..."
42

43
    # Check for authorized users only
44
    local authorized_users=("sshuser")
45
    local violations=0
46

47
    # Get list of users with shell access
48
    local shell_users=$(getent passwd | grep -E '(/bin/bash|/bin/sh|/bin/ash)$' | cut -d: -f1)
49

50
    for user in $shell_users; do
51
        if [[ ! " ${authorized_users[@]} " =~ " $user " ]] && [[ "$user" != "root" ]]; then
52
            log_compliance "VIOLATION: Unauthorized user with shell access: $user"
53
            ((violations++))
54
        fi
55
    done
56

57
    log_compliance "User provisioning check completed: $violations violations"
58
    return $violations
59
}
60

61
# CC6.3 - User Access Reviews
62
check_access_reviews() {
63
    log_compliance "Checking access reviews (CC6.3)..."
64

65
    # Check last access review date
66
    local review_file="/etc/ssh/last_access_review"
67
    local violations=0
68

69
    if [[ -f "$review_file" ]]; then
70
        local last_review=$(cat "$review_file")
71
        local review_age=$(( ($(date +%s) - $(date -d "$last_review" +%s)) / 86400 ))
72

73
        if [[ $review_age -gt 90 ]]; then
74
            log_compliance "VIOLATION: Access review overdue (last: $last_review, age: $review_age days)"
75
            ((violations++))
76
        fi
77
    else
78
        log_compliance "VIOLATION: No access review record found"
79
        ((violations++))
80
    fi
81

82
    log_compliance "Access reviews check completed: $violations violations"
83
    return $violations
84
}
85

86
# CC7.1 - System Monitoring
87
check_monitoring() {
88
    log_compliance "Checking system monitoring (CC7.1)..."
89

90
    local violations=0
91

92
    # Check if logging is enabled
93
    if ! pgrep rsyslogd > /dev/null; then
94
        log_compliance "VIOLATION: System logging is not running"
95
        ((violations++))
96
    fi
97

98
    # Check if fail2ban is running
99
    if ! pgrep fail2ban > /dev/null; then
100
        log_compliance "VIOLATION: Intrusion detection (fail2ban) is not running"
101
        ((violations++))
102
    fi
103

104
    # Check log retention
105
    local log_files=$(find /var/log/auth -name "*.log" -mtime +30)
106
    if [[ -z "$log_files" ]]; then
107
        log_compliance "VIOLATION: Insufficient log retention (< 30 days)"
108
        ((violations++))
109
    fi
110

111
    log_compliance "System monitoring check completed: $violations violations"
112
    return $violations
113
}
114

115
# CC8.1 - Change Management
116
check_change_management() {
117
    log_compliance "Checking change management (CC8.1)..."
118

119
    local violations=0
120

121
    # Check for configuration changes
122
    local config_hash=$(sha256sum /etc/ssh/sshd_config | cut -d' ' -f1)
123
    local baseline_hash_file="/etc/ssh/sshd_config.baseline_hash"
124

125
    if [[ -f "$baseline_hash_file" ]]; then
126
        local baseline_hash=$(cat "$baseline_hash_file")
127
        if [[ "$config_hash" != "$baseline_hash" ]]; then
128
            log_compliance "WARNING: SSH configuration has changed from baseline"
129
            log_compliance "Current hash: $config_hash"
130
            log_compliance "Baseline hash: $baseline_hash"
131
        fi
132
    else
133
        echo "$config_hash" > "$baseline_hash_file"
134
        log_compliance "INFO: Baseline configuration hash established"
135
    fi
136

137
    log_compliance "Change management check completed: $violations violations"
138
    return $violations
139
}
140

141
# Generate compliance report
142
generate_compliance_report() {
143
    local report_file="/var/log/auth/compliance-report-$(date +%Y%m%d).json"
144

145
    cat > "$report_file" << EOF
146
{
147
  "report_date": "$(date -u '+%Y-%m-%d %H:%M:%S UTC')",
148
  "compliance_framework": "SOC 2",
149
  "container_id": "$(hostname)",
150
  "checks": {
151
    "access_controls": {
152
      "status": "$1",
153
      "violations": $2
154
    },
155
    "user_provisioning": {
156
      "status": "$3",
157
      "violations": $4
158
    },
159
    "access_reviews": {
160
      "status": "$5",
161
      "violations": $6
162
    },
163
    "monitoring": {
164
      "status": "$7",
165
      "violations": $8
166
    },
167
    "change_management": {
168
      "status": "$9",
169
      "violations": ${10}
170
    }
171
  },
172
  "overall_status": "$11",
173
  "total_violations": ${12}
174
}
175
EOF
176

177
    log_compliance "Compliance report generated: $report_file"
178
}
179

180
# Main compliance check
181
main() {
182
    log_compliance "Starting SOC 2 compliance check..."
183

184
    local total_violations=0
185
    local check_results=()
186

187
    # Run all compliance checks
188
    check_access_controls
189
    local ac_violations=$?
190
    check_results+=("$([ $ac_violations -eq 0 ] && echo 'PASS' || echo 'FAIL')" "$ac_violations")
191
    ((total_violations += ac_violations))
192

193
    check_user_provisioning
194
    local up_violations=$?
195
    check_results+=("$([ $up_violations -eq 0 ] && echo 'PASS' || echo 'FAIL')" "$up_violations")
196
    ((total_violations += up_violations))
197

198
    check_access_reviews
199
    local ar_violations=$?
200
    check_results+=("$([ $ar_violations -eq 0 ] && echo 'PASS' || echo 'FAIL')" "$ar_violations")
201
    ((total_violations += ar_violations))
202

203
    check_monitoring
204
    local mon_violations=$?
205
    check_results+=("$([ $mon_violations -eq 0 ] && echo 'PASS' || echo 'FAIL')" "$mon_violations")
206
    ((total_violations += mon_violations))
207

208
    check_change_management
209
    local cm_violations=$?
210
    check_results+=("$([ $cm_violations -eq 0 ] && echo 'PASS' || echo 'FAIL')" "$cm_violations")
211
    ((total_violations += cm_violations))
212

213
    # Determine overall status
214
    local overall_status="$([ $total_violations -eq 0 ] && echo 'COMPLIANT' || echo 'NON_COMPLIANT')"
215

216
    # Generate report
217
    generate_compliance_report "${check_results[@]}" "$overall_status" "$total_violations"
218

219
    log_compliance "Compliance check completed: $overall_status ($total_violations total violations)"
220

221
    # Exit with appropriate code
222
    exit $total_violations
223
}
224

225
# Run compliance check
226
main "$@"

Best Practices and Guidelines#

Security Checklist#

Container Security
- Use minimal base image (Alpine Linux)
- Run as non-root user where possible
- Implement read-only filesystem
- Use security contexts and capabilities
- Enable AppArmor/SELinux profiles
SSH Configuration
- Disable root login
- Use key-based authentication only
- Implement strong ciphers and MACs
- Configure proper access controls
- Enable comprehensive logging
Network Security
- Use non-standard SSH ports
- Implement network segmentation
- Configure firewall rules
- Use fail2ban for intrusion prevention
- Monitor network traffic
Key Management
- Implement automated key rotation
- Use certificate-based authentication
- Secure key distribution
- Regular key auditing
- Proper key backup procedures
Monitoring and Compliance
- Implement comprehensive logging
- Set up real-time monitoring
- Configure alerting systems
- Regular compliance audits
- Incident response procedures

Performance Optimization#

Container Performance
- Use multi-stage builds to reduce image size
- Optimize resource limits and requests
- Implement proper health checks
- Use persistent volumes for logs
SSH Performance
- Configure appropriate connection limits
- Optimize cipher selection for performance
- Use connection multiplexing where appropriate
- Monitor resource usage

Troubleshooting Guide#

1
# Common troubleshooting commands
2
# Check container status
3
docker ps -a | grep openssh
4

5
# View container logs
6
docker logs openssh-container
7

8
# Check SSH configuration
9
docker exec openssh-container sshd -T
10

11
# Test SSH connectivity
12
ssh -p 2222 -v user@container-host
13

14
# Monitor active connections
15
docker exec openssh-container netstat -tn | grep :2222
16

17
# Check security logs
18
docker exec openssh-container tail -f /var/log/auth/sshd.log

Conclusion#

This comprehensive guide provides a production-ready approach to implementing secure OpenSSH containers with Docker. The solution covers all aspects of container security, from basic hardening to enterprise-grade monitoring and compliance.

Key benefits of this approach:

Enhanced Security: Multiple layers of security controls
Scalability: Horizontal scaling with load balancing
Compliance: SOC 2 and other compliance framework support
Monitoring: Comprehensive logging and alerting
Automation: Automated key management and deployment

By implementing these practices, organizations can achieve secure, scalable, and compliant SSH infrastructure using containerization technologies while maintaining the highest security standards.

Remember to regularly update container images, review security configurations, and conduct periodic security audits to maintain optimal security posture.