ISM-0484policyASD Information Security Manual (ISM)

Configure SSH for Secure Server Access

Ensure SSH settings enhance security by limiting access, disabling risky features, and ensuring safe login practices.

Preventative NC OS PASD Information Security ManualGuidelines for cryptography Hardening Configuration Access control

record_voice_over

Plain language

This control is all about setting up a safe digital lock on your servers. If not done, strangers could enter your systems, potentially accessing sensitive information or causing disruptions.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Secure Shell

Topic

Configuring Secure Shell

Official control statement

The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx) - have a suitable login banner (Banner x) - have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60) - disable host-based authentication (HostbasedAuthentication no) - disable rhosts-based authentication (IgnoreRhosts yes) - disable the ability to log in directly as root (PermitRootLogin no) - disable empty passwords (PermitEmptyPasswords no) - disable connection forwarding (AllowTCPForwarding no) - disable gateway ports (GatewayPorts no) - disable X11 forwarding (X11Forwarding no).

policyASD Information Security Manual (ISM)ISM-0484

priority_high

Why it matters

Without secure SSH settings, unauthorised users could exploit server access, leading to data breaches or operational failures.

settings

Operational notes

Regularly review SSH configurations for changes. Ensure security settings stay aligned with evolving threats and best practices.

02 - Implement

build

Implementation tips

Your IT team should ensure that the server only listens for connections on necessary network interfaces. They can do this by editing the SSH configuration file to include the 'ListenAddress' setting with the required IP address.
The IT manager should establish a firm but polite login message. This can be done by creating a text file with a welcome message and updating the SSH 'Banner' setting to point to this file.
IT staff should set a short grace period for logging in, like 60 seconds. They can set this by changing the 'LoginGraceTime' in the SSH settings to prevent potential intruders from taking too long.
Ensure that only authorised users have access by disabling the root login directly. IT can do this by adding 'PermitRootLogin no' to the SSH configuration, forcing users to authenticate as normal users first.
Prevent the use of insecure login methods by turning off host-based and 'rhost' authentication. This is done by setting 'HostbasedAuthentication no' and 'IgnoreRhosts yes' in the configuration.

03 - Audit

fact_check

Audit / evidence tips

Askthe SSH configuration fileLook atdetails like 'ListenAddress' and 'PermitRootLogin'Goodproper settings matching the control requirements
Goodshows a clear message that complies with organisational policies
Askthe SSH service logs to verify the 'LoginGraceTime' is enforced. Check recorded sessions for time limitsGoodlogin attempts have a 60-second window
Look atevidence of 'PermitRootLogin' set to 'no'Goodoutcome shows this practice is documented and implemented
Asksecurity audit reports on SSH settingsLook atconclusions and recommendations. Good reports confirm all insecure practices are disabled or controlled

04 - Mappings

link

Cross-framework mappings

How ISM-0484 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.5	ISM-0484 outlines SSH daemon settings to secure authentication and remote sessions, specifying measures like LoginGraceTime and disabling...
Annex A 8.9	ISM-0484 requires specific secure configuration settings for the SSH daemon, such as interface binding and authentication timeouts
handshakeSupports(1)expand_less
Annex A 5.15	ISM-0484 ensures secure remote access behaviour for SSH by disabling insecure options like direct root login and empty passwords
linkRelated(1)expand_less
Annex A 8.20	Annex A 8.20 requires network devices and the services used to manage them to be secured to prevent unauthorised access and protect infor...