이 문서에서는 Google Cloud 에 한정된 관행이나 Google Cloud에서 SSH를 사용할 때 특별한 관련성이 있는 관행을 집중적으로 설명합니다. 이 문서에서는 특정 SSH 클라이언트 또는 서버 구현을 위한 권장사항을 설명하지 않습니다.
IAP에 데이터 액세스 로그 사용 설정
사용자가 SSH 연결을 설정하려고 시도할 때마다 IAP가 Cloud 감사 로그에 항목을 추가하도록 하려면 Cloud Identity-Aware Proxy API에 대해 데이터 액세스 로그를 사용 설정합니다.
데이터 액세스 로그는 기본적으로 사용 중지되어 있습니다. 로그 볼륨에 대한 문제가 없는 한 VM 인스턴스가 포함된 모든 프로젝트에 대해 데이터 액세스 로그를 사용 설정하세요.
SSH 사용과 관련된 감사 로그 항목 모니터링
SSH 사용은 VM 및 워크로드의 보안에 영향을 미칠 수 있으므로 성공적인 연결 시도와 실패한 액세스 시도 모두를 계속 감사 추적하는 것이 중요합니다.
이는 SSH 사용을 민감한 작업으로 간주해야 하는 프로덕션 환경에서 특히 중요합니다.
SSH 액세스를 추적하고 의심스러운 동작을 찾으려면 다음을 포함하여 SSH와 관련된 로그 항목을 모니터링합니다.
서비스
메서드
설명
IAP
AuthorizeUser
IAP TCP 전달을 통한 연결 시도를 나타냅니다.
로그 항목에는 사용자의 기기, 충족된 액세스 수준, 미충족된 액세스 수준에 관한 세부정보가 포함됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document outlines best practices for auditing SSH access to Linux virtual machine (VM) instances on Google Cloud, emphasizing the importance of maintaining a non-repudiable audit trail.\u003c/p\u003e\n"],["\u003cp\u003eEnabling data access logs for the Cloud Identity-Aware Proxy API is crucial to capture all SSH connection attempts via IAP, and should be considered unless log volume is a concern.\u003c/p\u003e\n"],["\u003cp\u003eMonitoring specific audit log entries related to SSH usage, including connection attempts, is important, particularly for sensitive actions in production environments.\u003c/p\u003e\n"],["\u003cp\u003eVarious services and methods within Google Cloud generate audit logs related to SSH, such as IAP's \u003ccode\u003eAuthorizeUser\u003c/code\u003e and Compute Engine's metadata modification methods.\u003c/p\u003e\n"],["\u003cp\u003eFor a comprehensive view of VM activity, exporting \u003ccode\u003e/var/log/messages\u003c/code\u003e and SSH server logs to Cloud Logging, potentially through Ops Agent, is recommended, noting that SSH logs may vary by Linux distribution.\u003c/p\u003e\n"]]],[],null,["# Best practices for auditing SSH access\n\n*** ** * ** ***\n\nThis document describes best practices for auditing SSH access\nto Linux virtual machine (VM) instances.\n\nCloud Audit Logs let you analyze past activity and can be an important source\nof information when investigating suspicious activity affecting your\nGoogle Cloud resources.\n\nThe following sections contains best practices that can help you maintain a non-repudiable\naudit trail:\n\n- [Enable data access logs for IAP](#enable-iap-access-logs)\n- [Monitor audit log entries related to SSH usage](#monitor-ssh-usage)\n\nThe document focuses on practices that are either specific to Google Cloud or\nof particular relevance when using SSH on Google Cloud. The document doesn't\ncover best practices for specific SSH client or server implementations.\n\nEnable data access logs for IAP\n-------------------------------\n\nTo make sure that IAP adds an entry to the Cloud Audit Logs\nwhenever a user attempts to establish an SSH connection, [enable data access logs](/logging/docs/audit/configure-data-access) for the **Cloud Identity-Aware Proxy API**.\nData access logs are disabled by default. Unless you have concerns about log volume,\nenable data access logs for all projects that contain VM instances.\n\nMonitor audit log entries related to SSH usage\n----------------------------------------------\n\nSSH usage can impact the security of VMs and their workloads, so it's important to\nkeep an audit trail for both successful connection attempts and failed access attempts.\nThis is especially important in production environments, where SSH usage should be\nconsidered a sensitive action.\n\nTo track SSH access and possibly to find suspicious behavior, make sure that you\nmonitor log entries related to SSH, including the following:\n\nAll audit log records contain a `principalEmail` field that identifies the principal\nthat initiated the activity.\n\nTo get a complete picture of activity on your VMs, configure your VMs to export\n`/var/log/messages` and SSH server logs to Cloud Logging, for example\nby using [Ops Agent](/logging/docs/agent/ops-agent).\n\nNotice that depending on the Linux distribution you use, SSH server logs might\nbe written to different log files (typically, `/var/log/auth.log` or `/var/log/secure`),\nand that these log files aren't covered by the\n[default configuration used by Ops Agent](/logging/docs/agent/ops-agent/configuration#default)."]]
