What the built-in SSH is
FiveGuardian5 includes a built-in SSH service that lets authorized people open a remote command-line session on devices in the network (usually servers), using their FiveGuardian5 identity instead of manually distributed SSH keys. In the panel it appears as FiveGuardian5 SSH.
Main benefits:
- Access is controlled with the same policies and groups as the rest of the network.
- There is no need to expose the SSH service to the internet or hand out keys.
- When a person is removed from a group or their user is blocked, they lose access.
Enabling the built-in SSH on a device
The built-in SSH must be allowed on the destination device. From the panel, open the device under Peers and review the SSH access option. Some changes may also require configuration on the device itself, which your IT team or the FiveGuardian5 support team performs.
Creating the access policy
- Make sure there is a group with the people or devices that need access (for example, IT administrators) and a group with the destination devices.
- Under Access Control › Policies, create a policy with the administrators group as source and the servers group as destination.
- As protocol, choose FiveGuardian5 SSH.
- Add, if appropriate, posture checks to require the source device to meet security conditions.
- Save and test access with an authorized user.
Connecting
Authorized people connect from their device, which must be connected to FiveGuardian5. Depending on configuration, authentication with their company account may be requested before the session opens. Ask your administrator for the specific instructions for your organization.
Cautions
- Grant SSH access to the smallest possible group and review it often.
- Prefer one-way policies: from administrators to servers.
- SSH sessions give control over the destination device; treat this access as privileged.
- Changes to policies and device configuration are recorded in Audit Events.