Server Access Model SOP
Direct SSH keys vs bastion host vs SSM/Tailscale. Choose by team size and audit needs.
— Use plain SSH keys when: solo or 2-person team, static IPs, key rotation is manageable by hand.
— Use a bastion/jump host when: multiple admins need one auditable choke point and you want to keep origin servers off the public internet.
— Use SSM or Tailscale/WireGuard when: no public SSH port at all is the goal. Removes port 22 from attack surface entirely.
— Verify: every method must log who connected, when, from where. A key with no central log fails audit.
— Disable password auth regardless: set PasswordAuthentication no, confirm with a test login attempt.
Run this when you onboard a new admin.
Lockdown Ledger
@LockdownLedger
Server Access Model SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.