4.6.4. Targets

Targets offer a wide variety of types, each designed for specific mapping and access control scenarios. Because of this flexibility, it is important to clearly understand the purpose and behavior of each type before selecting it.

4.6.4.1. Static Targets

Static targets are targets that are uniquely identified by their IP address. Because their network identity is explicitly defined and does not change dynamically, they are considered the most reliable and predictable type compared to other target variants. For static targets, one or more IP addresses can be configured along with one or more associated public host keys.

If multiple IP addresses are specified, they must all refer to the same physical or logical host and therefore share the same host key. For this reason, it is recommended to assign multiple IP addresses only when they refer to the same host and use the same host key.

To avoid the need for manual host key import, the Gather public SSH Hostkey from Target button can be used. When this option is selected, suSSHi Chef instructs a suSSHi Gateway to actively retrieve the SSH host key from the specified target system.

This automated process simplifies initial target setup and helps ensure that the correct host key is obtained directly from the source system, reducing the risk of manual entry errors and improving overall configuration efficiency.

Of course, it is essential to ensure in this case that no man-in-the-middle attack has occurred at the time of the retrieval, and that the authenticity of the imported key can be trusted. Proper verification of the host environment and retrieval context is therefore strongly recommended before accepting the key.

In addition, the fingerprint and the key type of the retrieved SSH host key are displayed, providing further information to help validate and confirm its integrity and correctness.

4.6.4.2. Network Target

Network targets can be used to authorize an entire network as a target or, as will be discussed later, to include it in a deny rule. This allows administrators to restrict or permit access to complete network segments in a single, centralized rule—for example, blocking access to entire networks for specific sources and/or user groups.

When a network target is authorized, it is not possible to predefine a public host key for the entire network, since it typically consists of multiple individual hosts with potentially different identities. In such cases, host keys must be learned and stored on a per-host and per-user basis, similar to the standard behavior of an SSH client when connecting to previously unknown systems. Further details on this mechanism will be covered later.

Please create the object using an IPv4 or IPv6 network in CIDR notation. As with other object types, this single network object can also be assigned to a group to simplify management and reuse across multiple rules.

4.6.4.3. Dynamic Target

Dynamic targets are similar to static targets, with the key difference that they are identified by their Fully Qualified Domain Name (FQDN) instead of fixed IP addresses.

For dynamic targets, the suSSHi Gateway performs a DNS lookup at the time a new connection is established and connects to the IP address returned by the DNS resolution. This allows the actual target address to be determined dynamically at runtime, enabling flexible handling of environments where IP addresses may change over time.

Likewise, you can click Gather public SSH Hostkey from Target to manually import the host key.

Warning

Theoretically, this type of target is more vulnerable to man-in-the-middle attacks, as DNS manipulation could potentially redirect the connection to an unintended system instead of the expected target machine. For this reason, verifying the public host key at the time of import is especially important in this scenario, in order to ensure that the identity of the target system is correctly established and trusted.

4.6.4.4. Domain Target

Domain targets are closely related to network targets, particularly in how host keys are handled. However, they differ in their scope of definition: instead of requiring the target IP address to fall within a specific network range, a domain target is based on the Fully Qualified Domain Name (FQDN), which must belong to a defined DNS domain.

This allows access control to be applied at the domain level, making it possible to group and manage targets based on their DNS hierarchy rather than their IP address structure.

4.6.4.5. Group Objects

Group objects are used to combine multiple individual objects into a single logical unit, which can then be referenced in access rules. This simplifies rule management by allowing sets of related objects to be handled collectively rather than individually. Once defined, a group can be reused across multiple access rules, improving consistency and reducing configuration overhead.

However, group objects cannot be nested within other group objects; each group must consist solely of individual objects rather than references to other groups.

4.6.4.6. Scan Network

This menu item does not represent a separate target type. Instead, it provides a scanning function that searches a network range for active hosts offering an SSH service and retrieves their public host keys.

This feature is particularly useful for initial discovery, as it produces a structured list of all detected hosts, including their public host key fingerprints and the corresponding FQDNs obtained via reverse DNS lookup.

Within this result list, individual entries can be reviewed and deselected if necessary before creating all selected objects in a single operation. Additionally, it is possible to assign the newly created targets directly to an existing group or to create a new group during the process.

All generated target objects from this scan are created as Static Target.

Please specify either an IPv4 network with a maximum prefix length of /20 or an IPv6 network with a maximum prefix length of /116. This limitation serves as a safety measure to prevent scans from covering excessively large address spaces, which could otherwise lead to very long execution times or unnecessary system load.

If an IP address within the specified range is unreachable, the gateway will attempt to connect for up to 3 seconds per host. As a result, scanning a full range of 254 individual IPv4 addresses can take up to approximately 13 minutes in total under worst-case conditions.

Once the scan has been completed, you will be automatically redirected to the results overview page, where all discovered hosts and their associated details are displayed.

To add, create, or update the scanned targets in suSSHi Chef, click Create & Update hosts!.

4.6.4.7. Target Hostkeys

Host keys may change over time, and previously discovered targets can become outdated or obsolete.

This menu provides functionality to view, update, and remove stored host keys, ensuring that the system remains consistent with the current state of the target environment.