--- title: SSH Security Best Practices using Certificates, 2FA and... description: A practical guide walks through three industry best practices for hardening SSH access: using SSH certificates instead of raw keys (with separate host and user... canonical: https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH Security Best Practices using Certificates, 2FA and Bastions | daily.dev og:description: A practical guide walks through three industry best practices for hardening SSH access: using SSH certificates instead of raw keys (with separate host and user... og:url: https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr og:image: https://api.daily.dev/og/posts/uIy9WF7rR.png og:image:alt: SSH Security Best Practices using Certificates, 2FA and Bastions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH Security Best Practices using Certificates, 2FA and Bastions **[Teleport](https://daily.dev/sources/teleport)** · 18 min read · 0 upvotes · 0 comments ## Summary A practical guide walks through three industry best practices for hardening SSH access: using SSH certificates instead of raw keys (with separate host and user certificate authorities, signing commands, and sshd configuration), enforcing a bastion host as the sole gateway into infrastructure via SSH config ProxyJump and iptables rules, and adding two-factor authentication using google-authenticator PAM module combined with PAM and sshd_config changes. Each section includes concrete ssh-keygen commands, sshd_config directives, log output examples, and troubleshooting tips. The piece closes by noting that Teleport offers these capabilities (certificates, bastion, 2FA) out of the box as a drop-in OpenSSH replacement. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I set up SSH certificates instead of using plain SSH keys? Generate a certificate authority keypair with ssh-keygen, then use ssh-keygen -s to sign host or user public keys with that CA. Use separate CAs for hosts and users so a compromise of one only requires reissuing certificates for that side. Configure sshd with HostCertificate for host certs or TrustedUserCAKeys for user certs, then restart sshd. _daily.dev surfaces practical guides like this for teams rolling out certificate-based SSH access._ ### How do I force all SSH connections to a domain through a bastion host? Add entries to ~/.ssh/config using ProxyJump: set 'Host *.example.com' with 'ProxyJump bastion.example.com', and a separate 'Host bastion.example.com' block with 'ProxyJump none'. Combine this with iptables rules on backend servers that only accept port 22 traffic from the bastion's public IP, dropping all other inbound SSH. _Engineers locking down SSH access follow setups like this via daily.dev._ ### How do I add two-factor authentication to SSH logins with google-authenticator? Install the google-authenticator PAM module (from EPEL on RHEL/CentOS or as libpam-google-authenticator on Debian/Ubuntu), run google-authenticator to generate a QR code and backup codes, then add 'auth required pam_google_authenticator.so nullok' to /etc/pam.d/sshd. Set ChallengeResponseAuthentication yes and AuthenticationMethods publickey,keyboard-interactive in sshd_config, then restart sshd. _daily.dev helps engineers compare and implement SSH 2FA approaches like this one._ ## Similar posts on daily.dev - [Hardening SSH: Fail2Ban, Nftables & Cloud Firewalls](https://daily.dev/posts/hardening-ssh-fail2ban-nftables-cloud-firewalls-btns6dfx7) · DigitalOcean Community · 1 upvotes · 0 comments - [Jan-Piet Mens :: SSH certificates: the better SSH experience](https://daily.dev/posts/jan-piet-mens-ssh-certificates-the-better-ssh-experience-f1ftumowi) · Jan-Piet Mens · 0 upvotes · 0 comments - [How to Harden Ubuntu SSH: From static keys to cloud identity](https://daily.dev/posts/how-to-harden-ubuntu-ssh-from-static-keys-to-cloud-identity-so5mcvj7i) · Ubuntu · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH Security Best Practices using Certificates, 2FA and Bastions","url":"https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr"},"datePublished":"2026-08-23T12:22:46.791Z","dateModified":"2026-08-23T12:52:02.776Z","description":"A practical guide walks through three industry best practices for hardening SSH access: using SSH certificates instead of raw keys (with separate host and user...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,authentication,ssh","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH Security Best Practices using Certificates, 2FA and Bastions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-security-best-practices-using-certificates-2fa-and-bastions-uiy9wf7rr#faq","mainEntity":[{"@type":"Question","name":"How do I set up SSH certificates instead of using plain SSH keys?","acceptedAnswer":{"@type":"Answer","text":"Generate a certificate authority keypair with ssh-keygen, then use ssh-keygen -s to sign host or user public keys with that CA. Use separate CAs for hosts and users so a compromise of one only requires reissuing certificates for that side. Configure sshd with HostCertificate for host certs or TrustedUserCAKeys for user certs, then restart sshd. daily.dev surfaces practical guides like this for teams rolling out certificate-based SSH access."}},{"@type":"Question","name":"How do I force all SSH connections to a domain through a bastion host?","acceptedAnswer":{"@type":"Answer","text":"Add entries to ~/.ssh/config using ProxyJump: set 'Host *.example.com' with 'ProxyJump bastion.example.com', and a separate 'Host bastion.example.com' block with 'ProxyJump none'. Combine this with iptables rules on backend servers that only accept port 22 traffic from the bastion's public IP, dropping all other inbound SSH. Engineers locking down SSH access follow setups like this via daily.dev."}},{"@type":"Question","name":"How do I add two-factor authentication to SSH logins with google-authenticator?","acceptedAnswer":{"@type":"Answer","text":"Install the google-authenticator PAM module (from EPEL on RHEL/CentOS or as libpam-google-authenticator on Debian/Ubuntu), run google-authenticator to generate a QR code and backup codes, then add 'auth required pam_google_authenticator.so nullok' to /etc/pam.d/sshd. Set ChallengeResponseAuthentication yes and AuthenticationMethods publickey,keyboard-interactive in sshd_config, then restart sshd. daily.dev helps engineers compare and implement SSH 2FA approaches like this one."}}]} ```