6.5.2. Procedure – Enabling SSH access to the PSM host

Purpose: 

Exclusively for troubleshooting purposes, you can access the PSM host using SSH.

Completing the Welcome Wizard automatically disables SSH access to PSM. Re-enabling it allows you to connect remotely to the PSM host and login using the root user. The password of the root user is the one you provided in the Welcome Wizard. For details on how to change the root password from the web interface, see Procedure 6.5.3, Changing the root password of PSM.

Warning

Accessing the PSM host directly using SSH is not recommended or supported, except for troubleshooting purposes. In such case, the Balabit Support Team will give you exact instructions on what to do to solve the problem.

For security reasons, disable SSH access to PSM when it is not needed. For details, see Procedure 6.5.2, Enabling SSH access to the PSM host.

The following encryption algorithms are configured on the local SSH service of PSM:

  • Key exchange (KEX) algorithms:

    diffie-hellman-group-exchange-sha256
  • Ciphers:

    aes256-ctr,aes128-ctr
  • Message authentication codes:

    hmac-sha2-512,hmac-sha2-256

SSH access is, by default, protected against brute-force attacks: after 20 unsuccessful login attempts, the offending IP is blocked from accessing the SSH service for ten minutes.

You can turn off brute force protection by unselecting the Protect against brute-force attacks option for the SSH server.

Steps: 

  1. Navigate to Basic Settings > Local Services > SSH server.

    Figure 6.12. Basic Settings > Local Services > SSH server — Enabling remote SSH access to PSM

    Basic Settings > Local Services > SSH server — Enabling remote SSH access to PSM
  2. Select the Enable option.

    Note

    Remote SSH access is automatically disabled if Sealed mode is enabled. For details, see Section 6.6, Sealed mode.

  3. Choose the authentication method for the remote SSH connections.

    • To enable password-based authentication, select the Enable password authentication option.

    • To enable public-key authentication, click in the Authorized keys field, click and upload the private keys of the users who can access and manage PSM remotely via SSH.

      Balabit recommends using 2048-bit RSA keys (or stronger).

  4. Choose an address and a port for the SSH server in the Listening addresses section.

    The available addresses correspond to the interface addresses configured in Basic Settings > Network > Interfaces. Only IPv4 addresses can be selected.

    To add multiple addresses, click .

  5. Optional step: To permit SSH acces only from selected subnets or IP addresses, select Restrict clients, click and enter the IP address and netmask of the allowed clients.

    Use an IPv4 address.

    To add multiple addresses, click .

  6. Click .