RFC 4252 — SSH Authentication
The Secure Shell (SSH) Authentication Protocol — defines methods for authenticating SSH users including public key, password, and host-based authentication over the SSH transport layer.
1. Introduction
▶The SSH Authentication Protocol runs on top of the SSH Transport Layer (RFC 4253) and provides methods for client user authentication. It is the gatekeeper for remote administrative access to servers and network infrastructure.
ISO 27001 Relevance: A.8.5 (Secure Authentication) — SSH auth methods must be appropriately strong. A.8.2 (Privileged Access) — controls who can access systems via SSH. A.5.17 (Authentication Information) — management of SSH keys and credentials.
2. Authentication Methods
▶| Method | Description | ISO Strength |
|---|---|---|
| publickey | RSA/ECDSA/Ed25519 key pair | RECOMMENDED — strongest |
| password | Username + password | Acceptable with MFA only |
| keyboard-interactive | Challenge-response (PAM, MFA) | RECOMMENDED for MFA |
| hostbased | Host key of client machine | Limited use cases |
| none | No authentication | MUST NOT allow |
3. Public Key Authentication
▶The recommended authentication method:
- Client sends public key algorithm + public key to server
- Server checks if key is authorized (authorized_keys file or certificate CA)
- If accepted, client proves possession of private key by signing a session-specific challenge
| Key Type | Status | Notes |
|---|---|---|
| ssh-ed25519 | RECOMMENDED | Modern, fast, small keys |
| ecdsa-sha2-nistp256 | Acceptable | NIST curve |
| rsa-sha2-512 | Acceptable | RSA 4096-bit minimum |
| ssh-rsa (SHA-1) | DEPRECATED | SHA-1 is weak — disable |
| ssh-dss | MUST NOT | DSA is deprecated |
4. SSH Certificates
▶SSH certificates extend public key auth with CA-based trust and expiration:
- User certificates: CA signs user's public key with validity period and principals list
- Host certificates: CA signs host keys — eliminates TOFU problem
- Short-lived: Issue certificates valid for hours/days, not keys valid indefinitely
- Advantages: Centralized revocation, automatic expiry, principal-based authorization
5. Security Considerations
▶- Disable password auth: Set PasswordAuthentication no — enforce key/certificate auth (A.8.5)
- Key management: Audit authorized_keys files regularly — remove stale keys (A.5.17)
- MFA: Enable keyboard-interactive + PAM for multi-factor authentication
- Root login: Set PermitRootLogin no — use sudo with individual accounts (A.8.2)
- Session recording: Log authentication attempts and session activity (A.8.15)