Hardening SSH Access on Network Devices

May 2014 • 6 min read

Securing SSH access is a foundational step in network hardening. In 2014, enterprises still rely heavily on CLI interfaces to manage network infrastructure, and SSH remains the default protocol for encrypted access. However, poor configurations or default settings can introduce major vulnerabilities.

Disable Password Authentication

One of the most effective ways to harden SSH access is to disable password authentication and enforce key-based login. Passwords are easily brute-forced or phished, especially when systems are exposed to the internet.

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
  

On Cisco devices, use AAA for more granular control:

conf t
username admin secret STRONG_PASSWORD
ip ssh version 2
ip domain-name yourdomain.com
crypto key generate rsa
ip ssh time-out 60
ip ssh authentication-retries 2
line vty 0 4
  login local
  transport input ssh
exit
  

Use ACLs to Restrict SSH Access

Even if SSH is configured securely, unrestricted access to port 22 is still risky. Implementing access control lists (ACLs) limits where management connections can originate from:

access-list 10 permit 192.168.100.0 0.0.0.255
line vty 0 4
  access-class 10 in
  transport input ssh
  

This ensures that only devices from your management subnet can reach SSH on the router or switch.

Enable Logging and Monitor Sessions

Visibility is crucial. Configure logging and session tracking to detect abnormal usage patterns. On network devices, enable syslog and monitor session starts and ends. For example:

logging 192.168.200.10
logging trap informational
  

Implement Login Banners

Although login banners may not enforce security technically, they serve as legal deterrents and make it clear that unauthorized access is prohibited.

banner login ^C
Authorized access only. Disconnect immediately if you are not an authorized user.
^C
  

Use Strong SSH Ciphers and MACs

Older SSH versions and default configurations might still support weak algorithms. Ensure your SSH daemon supports only strong, modern ciphers:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256
  

Audit Configuration Regularly

SSH hardening is not a one-time task. Regular audits help catch drift and newly introduced risk. Use tools like RANCID or Oxidized to track config changes.

Conclusion

SSH access is a gateway to your infrastructure. Harden it with layered controls: key-based auth, access control lists, strong cryptography, and audit mechanisms. These best practices reduce exposure and prepare your environment for modern security expectations.

Eduardo Wnorowski is a network infrastructure consultant and technologist.
With over 19 years of experience in IT and consulting, he brings deep expertise in networking, security, infrastructure, and transformation.
Connect on Linkedin