Teleport Parity: The Zero-Standing-Privilege Access Model
Static credentials—such as unrotated SSH private keys scattered across developer laptops and permanent administrator roles—are the primary vector for lateral movement following an account compromise. BlackShield replaces standing access with cryptographically bounded Just-In-Time (JIT) access requests and ephemeral OpenSSH certificates.
1. Zero Standing Privileges (ZSP)
Engineers maintain non-privileged member accounts by default. Elevated production access is granted strictly on-demand for time-boxed windows.
2. Ephemeral OpenSSH Certificate Authority
Eliminate static SSH keys and authorized_keys sprawl across EC2/Linux servers with short-lived OpenSSH certificates (ssh-ed25519-cert-v01).
3. Dual-Authorization JIT Approval
Request access with mandatory ticket references (e.g. INC-9021) and business justifications. Administrators approve in real-time.
4. Automated Revocation & Expiry
Active grants continuously count down. Once the TTL lapses (30m to 8h), privileges expire automatically with zero lingering credentials.
5. Turnkey Host Onboarding
Linux hosts require only a 1-line standard sshd_config directive trusting BlackShield's CA. No proprietary agent daemons required.
6. Tamper-Evident Audit Chains
Cryptographically chained audit logs link every request, review, and certificate minting event directly to SOC 2 CC6.1 and ISO 27001 evidence bundles.
1. Host Configuration (OpenSSH sshd_config)
Unlike legacy PAM solutions requiring heavy client daemons, BlackShield relies on native OpenSSH certificate validation built into every Linux distribution. Add your tenant CA public key to /etc/ssh/blackshield_user_ca.pub:
# 1. Fetch tenant CA public key from the dashboard or API: curl -s https://api.blackshield.chaplau.com/api/v1/identity/access/ssh/ca | jq -r .ca_public_key > /etc/ssh/blackshield_user_ca.pub # 2. Tell sshd to trust user certificates signed by this CA: echo "TrustedUserCAKeys /etc/ssh/blackshield_user_ca.pub" >> /etc/ssh/sshd_config # 3. Reload OpenSSH daemon: systemctl reload sshd
2. Developer Client Configuration (~/.ssh/config)
Developers can configure their OpenSSH client to automatically use signed certificates for all internal hosts:
Host *.internal IdentityFile ~/.ssh/id_ed25519 CertificateFile ~/.ssh/id_ed25519-cert.pub IdentitiesOnly yes
3. Compliance & Control Evidence
| Standard | Control ID | Requirement | BlackShield Automated Control |
|---|---|---|---|
| SOC 2 Type II | CC6.1 / CC6.2 | Logical access restricted to authorized users | Zero standing privileges; dual-authorization required for elevated roles |
| SOC 2 Type II | CC6.3 | Timely revocation of logical access credentials | Time-boxed short-lived certificates (default 60 mins) with automated expiration |
| ISO 27001 | A.9.2.6 / A.9.4.2 | Secure authentication and privileged access control | Hardware-backed cryptographic signing of OpenSSH Ed25519 user certificates |