[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis document outlines best practices for auditing SSH access to Linux virtual machine (VM) instances on Google Cloud, emphasizing the importance of maintaining a non-repudiable audit trail.\u003c/p\u003e\n"],["\u003cp\u003eEnabling data access logs for the Cloud Identity-Aware Proxy API is crucial to capture all SSH connection attempts via IAP, and should be considered unless log volume is a concern.\u003c/p\u003e\n"],["\u003cp\u003eMonitoring specific audit log entries related to SSH usage, including connection attempts, is important, particularly for sensitive actions in production environments.\u003c/p\u003e\n"],["\u003cp\u003eVarious services and methods within Google Cloud generate audit logs related to SSH, such as IAP's \u003ccode\u003eAuthorizeUser\u003c/code\u003e and Compute Engine's metadata modification methods.\u003c/p\u003e\n"],["\u003cp\u003eFor a comprehensive view of VM activity, exporting \u003ccode\u003e/var/log/messages\u003c/code\u003e and SSH server logs to Cloud Logging, potentially through Ops Agent, is recommended, noting that SSH logs may vary by Linux distribution.\u003c/p\u003e\n"]]],[],null,["# Best practices for auditing SSH access\n\n*** ** * ** ***\n\nThis document describes best practices for auditing SSH access\nto Linux virtual machine (VM) instances.\n\nCloud Audit Logs let you analyze past activity and can be an important source\nof information when investigating suspicious activity affecting your\nGoogle Cloud resources.\n\nThe following sections contains best practices that can help you maintain a non-repudiable\naudit trail:\n\n- [Enable data access logs for IAP](#enable-iap-access-logs)\n- [Monitor audit log entries related to SSH usage](#monitor-ssh-usage)\n\nThe document focuses on practices that are either specific to Google Cloud or\nof particular relevance when using SSH on Google Cloud. The document doesn't\ncover best practices for specific SSH client or server implementations.\n\nEnable data access logs for IAP\n-------------------------------\n\nTo make sure that IAP adds an entry to the Cloud Audit Logs\nwhenever a user attempts to establish an SSH connection, [enable data access logs](/logging/docs/audit/configure-data-access) for the **Cloud Identity-Aware Proxy API**.\nData access logs are disabled by default. Unless you have concerns about log volume,\nenable data access logs for all projects that contain VM instances.\n\nMonitor audit log entries related to SSH usage\n----------------------------------------------\n\nSSH usage can impact the security of VMs and their workloads, so it's important to\nkeep an audit trail for both successful connection attempts and failed access attempts.\nThis is especially important in production environments, where SSH usage should be\nconsidered a sensitive action.\n\nTo track SSH access and possibly to find suspicious behavior, make sure that you\nmonitor log entries related to SSH, including the following:\n\nAll audit log records contain a `principalEmail` field that identifies the principal\nthat initiated the activity.\n\nTo get a complete picture of activity on your VMs, configure your VMs to export\n`/var/log/messages` and SSH server logs to Cloud Logging, for example\nby using [Ops Agent](/logging/docs/agent/ops-agent).\n\nNotice that depending on the Linux distribution you use, SSH server logs might\nbe written to different log files (typically, `/var/log/auth.log` or `/var/log/secure`),\nand that these log files aren't covered by the\n[default configuration used by Ops Agent](/logging/docs/agent/ops-agent/configuration#default)."]]
