What are the best practices for CLI SSH authentication?

SSH authentication is a crucial skill for network engineers who need to access remote devices securely and efficiently. SSH, or Secure Shell, is a protocol that encrypts the communication between a client and a server, preventing unauthorized access and data tampering. However, SSH authentication also requires some best practices to ensure its reliability and security. In this article, you will learn about some of these best practices, such as using public key authentication, disabling password authentication, configuring timeouts, limiting access, and logging sessions.

1 Public key authentication

One of the best practices for SSH authentication is to use public key authentication, which is more secure and convenient than password authentication. Public key authentication involves generating a pair of keys, one public and one private, on the client machine. The public key is then copied to the server's authorized_keys file, which grants access to the client. The private key is never shared and is used to verify the identity of the client. To generate and copy the keys, you can use the ssh-keygen and ssh-copy-id commands, respectively.

Add your perspective

Sambhaji Ippar

Founder | Network Engineer | CCNA, AWS Solution Architect & Terraform Certified 🌩️☁️ |
Report contribution
Yes, it's important to use authentication when accessing systems through SSH (Secure Shell). The best way to do this is by using authorized keys. However, it's common for people to make the mistake of storing their public or private keys openly on their PC rather than securely storing them. This is not a best practice. Additionally, it's always recommended to set an expiry on any authentication you create. This ensures that once the timeframe has passed, the keys can be expired.

Like
Rui Roccazzella
Report contribution
Public key authentication is a method used for secure access to systems via SSH. It involves creating a key pair: a public key (which is shared with the server) and a private key (which is kept secure by the user). When a user attempts to connect to the server, the server verifies the user's identity by matching the public key against the private key stored on the server. This method provides a more secure alternative to password-based authentication, as it is less susceptible to brute-force attacks and password guessing.

Like

2 Disable password authentication

Another best practice for SSH authentication is to disable password authentication, which is prone to brute-force attacks and human errors. Password authentication requires entering a password every time you connect to the server, which can be easily guessed, stolen, or forgotten. To disable password authentication, you need to edit the server's sshd_config file and set the PasswordAuthentication option to no . Then, you need to restart the SSH service to apply the changes.

Add your perspective

Rui Roccazzella
Report contribution
Disabling password authentication is a security best practice for SSH. By relying solely on public key authentication, you eliminate the risk of password-based attacks. To disable password authentication, you can configure the SSH server to only allow public key authentication in its configuration file (sshd_config). This prevents users from logging in with passwords and enforces the use of public keys for authentication, enhancing overall security posture.

Like

3 Configure timeouts

A third best practice for SSH authentication is to configure timeouts, which prevent idle or abandoned sessions from consuming resources and posing security risks. Timeouts can be set on both the client and the server side, using the ClientAliveInterval and ServerAliveInterval options, respectively. These options specify the number of seconds between each keepalive message sent by the client or the server. If no response is received after a certain number of messages, the connection is terminated. The number of messages can be set using the ClientAliveCountMax and ServerAliveCountMax options, respectively.

Add your perspective

Rui Roccazzella
Report contribution
Configuring timeouts is crucial for SSH security. Setting idle session timeouts helps mitigate the risk of unauthorized access in case users forget to log out. Additionally, defining connection timeouts ensures that idle connections are terminated promptly, reducing the window of opportunity for potential attackers.

Like

4 Limit access

A fourth best practice for SSH authentication is to limit access, which reduces the attack surface and the potential damage of a compromised account. Limiting access can be done by restricting the users, groups, hosts, or commands that can use SSH. For example, you can use the AllowUsers , AllowGroups , DenyUsers , and DenyGroups options in the server's sshd_config file to specify who can or cannot log in via SSH. You can also use the from , command , and no-agent-forwarding options in the server's authorized_keys file to specify where, how, and what the client can do via SSH.

Add your perspective

Rui Roccazzella
Report contribution
Limiting access is essential for SSH security. You can achieve this by implementing access control lists (ACLs) or firewall rules to restrict SSH connections to specific IP addresses or subnets. Additionally, consider implementing multi-factor authentication (MFA) to add an extra layer of security beyond username and password authentication.

Like

5 Log sessions

A fifth best practice for SSH authentication is to log sessions, which provides visibility and accountability for the SSH activity on the server. Logging sessions can help you monitor, audit, troubleshoot, and investigate SSH connections, as well as detect and respond to any anomalies or incidents. To log sessions, you need to enable the SyslogFacility and LogLevel options in the server's sshd_config file, which determine where and how much information is logged. You can also use the ssh -v option on the client side to see the verbose output of the SSH connection.

Add your perspective

Rui Roccazzella
Report contribution
Logging SSH sessions is crucial for security and auditing purposes. By logging sessions, you can track user activities, detect potential security breaches, and comply with regulatory requirements. Ensure that SSH logging is enabled on your system and configure logging settings to capture relevant information such as user login/logout events, commands executed, and session duration. Regularly review and analyze SSH logs to identify any suspicious or unauthorized activities on your network.

Like

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

What are the best practices for CLI SSH authentication?

1

2

3

4

5

6

1 Public key authentication

2 Disable password authentication

3 Configure timeouts

4 Limit access

5 Log sessions

6 Here’s what else to consider

Network Engineering

Rate this article

Thanks for your feedback

More articles on Network Engineering

More relevant reading

What are the best practices for CLI SSH authentication?

1

2

3

4

5

6

1 Public key authentication

2 Disable password authentication

3 Configure timeouts

4 Limit access

5 Log sessions

6 Here’s what else to consider

Network Engineering

Rate this article

Thanks for your feedback

Explore Other Skills