SSH Security Assessment

This guide treats SSH servers, bastions, and administrative access paths as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Map approved administrative source networks and bastion paths.

2. 02

   Record server versions, host-key algorithms, and expected host fingerprints.

3. 03

   Identify permitted authentication methods and privileged access workflow.

4. 04

   Review forwarding, subsystem, and session-recording expectations.

ssh -G admin@example.com | grep -E \
+  "^(hostname|port|user|identityfile|proxyjump|forwardagent) "

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Use a designated test account to verify denied and allowed access paths.

2. 02

   Confirm password login and direct root login match policy.

3. 03

   Review authorized-key ownership, expiry, and forced-command restrictions.

4. 04

   Validate agent, TCP, and X11 forwarding are disabled unless required.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Correlate successful and failed logins with source and identity.
• Alert on new host keys, direct privileged access, and unusual forwarding.
• Retain bastion session metadata and administrative approvals.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Route administration through managed bastions or zero-trust access.
• Prefer short-lived certificates or centrally managed keys.
• Disable unused authentication and forwarding modes.
• Apply least privilege after login and review dormant access.