Background

StrongBox uses a secure, unique system for managing it's authentication and keys. This document describes how this works, and what tools are available to the user to make this process easier.

Public/Private Key Primer:

Public/private certificates and keys are used throughout StrongBox to create a much higher level of OS security. Simply put public/private keys are mathematical constructs that allow people to guarantee the origin and authenticity of data. In StrongBox, your configuration signing key is absolutely required in order to be able to update your configuration.

Other important points about keys:

• Your key is your identity: nobody else should use your key.

• If someone has your key, then they can access your servers and alter them with impunity

• Keys that are lost or corrupted are not recoverable by any means

• Changes made to StrongBox that are not signed with a valid key will be lost.

For a basic understanding of how a public/private key cryptography works, see: http://www.youdzone.com/signature.html. It's simple, illustrated, and explains the basic principles.

Configuration and OS Signing:

Because StrongBox is a cryptographically signed OS, there's more safeguards in place around actually making configuration changes. Each time you save a configuration, the following occurs:

• The current running configuration is compared to the OS version on which it is based.

• A list of changed files is made

• An archive of all those changed files, and differences to the original versions is made

• The user prompting for the save is prompted to add in comments that apply to the configuration being saved

• These comments, a checksum of the archive and a date are put together into an S/MIME formatted file, which is signed by the user with their private key. The user's public certificate is also attached to the file.

• Any verifications of the file are then performed based on the signature of the file, and the certificate included in the file.

There are a few important things to note about this method:

1. You can't change a configuration file after you've saved it, as that would break the cryptographic signature and invalidate the file. Instead, you need to make a new one.

2. The configuration changes are quickly and easily attributable to the user who saved them.

3. If you don't have a certificate, or your certificate is invalid, your changes to configurations will not be acknowledged when the computer is rebooted -> they will be lost.

All this implies that you have a valid certificate and key. Your certificate and key allow you to administer StrongBox servers. Without them, you're locked out like any other would-be hacker.

StrongBox Signing Certificates and Keys:

StrongBox signing keys are very similar to the keys that web servers use for doing SSL. But, whereas these SSL certificates are for organizations, StrongBox certificates and keys are generally for particular people.

Because a key is so important for security, it needs to be kept safe. The recommended way of doing this is to keep it on a pocket USB flash card, a bluetooth phone, or something that you carry with you that your computer can access. This device, plus your encryption password, are both needed in order to access StrongBox based systems.

StrongBox provides services so that you can have your key sitting on your home computer, yet use that key to access and configure a computer half-way around the world. And, while normal unix authentication can work on StrongBox, the recommended way of authenticating is using these keys exclusively.

Using Keys for Authentication:

There are two different ways of using keys for authentication.

1. Local private key authentication

In this method, you have the key available locally. You use the key's encryption passphrase as your authentication password. This is useful, as it allows you to have a secure password that no-one else can change. It allows your password to be stored using very high-grade encryption, not the lower grade provided by the unix shadow file. And it also allows you to have single-sign-on: you can then use the key that you've decrypted to log into other computers using remote public key authentication.

2. Remote public key authentication:

In this method, you have the private keys available on your local computer, but only the public keys stored on the remote system. This allows you, and you alone, to authenticate to the remote system in a secure manner. It's also a zero trust method: you don't have to trust the remote system with your password, as you never have to give your key or password to the remote computer.

Setting up secure remote authentication in StrongBox:

StrongBox provides facilities for managing administrative users based on these keys. In order to administer administrative users and authentication, use “admuser”.

Admuser allows you to add new users and add authentication information for existing users.