本页面上的部分或全部信息可能不适用于 Trusted Cloud by S3NS。
审核 SSH 访问的最佳实践
本文档介绍了对通过 SSH 访问 Linux 虚拟机 (VM) 实例进行审核的最佳实践。
借助 Cloud Audit Logs，您可以分析过去的活动，在调查影响Trusted Cloud 资源的可疑活动时，它可以成为重要的信息来源。
以下部分包含最佳实践，可帮助您保留不可否的审核跟踪记录：
本文档重点介绍特定于 Trusted Cloud by S3NS 的实践或在 Trusted Cloud上使用 SSH 时特别重要的实践。本文档未涵盖特定 SSH 客户端或服务器实现的最佳实践。
为 IAP 启用数据访问日志
如需确保每当用户尝试建立 SSH 连接时，IAP 都会向 Cloud Audit Logging 添加条目，请为 Cloud Identity-Aware Proxy API 启用数据访问日志。数据访问日志默认处于停用状态。除非您担心日志数据量，否则请为包含虚拟机实例的所有项目启用数据访问日志。
监控与 SSH 使用相关的审核日志条目
SSH 使用可能会影响虚拟机及其工作负载的安全性，因此为成功的连接尝试和失败的访问尝试保留审核跟踪记录非常重要。在生产环境中，这一点尤为重要，因为SSH 使用在这类环境中应被视为敏感操作。
如需跟踪 SSH 访问并可以发现可疑行为，请务必监控与 SSH 相关的日志条目，包括：
| 服务 |
方法 |
说明 |
| IAP |
AuthorizeUser |
表示通过 IAP TCP 转发进行的连接尝试。
日志条目包含有关用户设备、已满足的访问权限级别和不满足的访问权限级别的详细信息。
|
| OS Login |
google.cloud.oslogin.dataplane.OsLoginDataPlaneService.CheckPolicy |
表示登录尝试。 |
| OS Login |
google.cloud.oslogin.dataplane.OsLoginDataPlaneService.StartSession |
表示 OS Login 2FA 验证的开始 |
| OS Login |
google.cloud.oslogin.dataplane.OsLoginDataPlaneService.ContinueSession |
表示 OS Login 2FA 验证的完成 |
| Compute Engine |
v1.compute.projects.setCommonInstanceMetadata |
如果字段 projectMetadataDelta 包含“ssh-keys”的相应条目，则此日志条目表示在项目元数据中添加、移除或修改了 SSH 密钥。
|
| Compute Engine |
v1.compute.instances.setMetadata |
如果字段 projectMetadataDelta 包含“ssh-keys”或“sshKeys”的相应条目，则此日志条目表示在实例元数据中添加、移除或修改了 SSH 密钥。
|
| Compute Engine |
google.ssh-serialport.v1.connect |
表示对串行控制台的连接尝试 |
| IAM |
beta.compute.instances.setIamPolicy、v1.compute.instances.setIamPolicy
|
表示对虚拟机实例的 IAM 政策的更改。IAM 政策更改可能会影响用户修改实例元数据的能力。
|
| IAM |
SetIamPolicy |
表示对项目的 IAM 政策的更改。IAM 政策更改可能会影响用户修改项目元数据和项目的数据访问审核日志配置的能力。
|
所有审核日志记录都包含 principalEmail 字段，用于标识发起活动的主账号。
如需全面了解虚拟机上的活动，请将虚拟机配置为将 /var/log/messages 和 SSH 服务器日志导出到 Cloud Logging，例如使用 Ops Agent。
请注意，根据您使用的 Linux 发行版，SSH 服务器日志可能会写入不同的日志文件（通常是 /var/log/auth.log 或 /var/log/secure），Ops Agent 使用的默认配置未涵盖这些日志文件。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-19。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eThis document outlines best practices for auditing SSH access to Linux virtual machine (VM) instances on Google Cloud, emphasizing the importance of maintaining a non-repudiable audit trail.\u003c/p\u003e\n"],["\u003cp\u003eEnabling data access logs for the Cloud Identity-Aware Proxy API is crucial to capture all SSH connection attempts via IAP, and should be considered unless log volume is a concern.\u003c/p\u003e\n"],["\u003cp\u003eMonitoring specific audit log entries related to SSH usage, including connection attempts, is important, particularly for sensitive actions in production environments.\u003c/p\u003e\n"],["\u003cp\u003eVarious services and methods within Google Cloud generate audit logs related to SSH, such as IAP's \u003ccode\u003eAuthorizeUser\u003c/code\u003e and Compute Engine's metadata modification methods.\u003c/p\u003e\n"],["\u003cp\u003eFor a comprehensive view of VM activity, exporting \u003ccode\u003e/var/log/messages\u003c/code\u003e and SSH server logs to Cloud Logging, potentially through Ops Agent, is recommended, noting that SSH logs may vary by Linux distribution.\u003c/p\u003e\n"]]],[],null,["*** ** * ** ***\n\nThis document describes best practices for auditing SSH access\nto Linux virtual machine (VM) instances.\n\nCloud Audit Logs let you analyze past activity and can be an important source\nof information when investigating suspicious activity affecting your\nGoogle Cloud resources.\n\nThe following sections contains best practices that can help you maintain a non-repudiable\naudit trail:\n\n- [Enable data access logs for IAP](#enable-iap-access-logs)\n- [Monitor audit log entries related to SSH usage](#monitor-ssh-usage)\n\nThe document focuses on practices that are either specific to Google Cloud or\nof particular relevance when using SSH on Google Cloud. The document doesn't\ncover best practices for specific SSH client or server implementations.\n\nEnable data access logs for IAP\n\nTo make sure that IAP adds an entry to the Cloud Audit Logs\nwhenever a user attempts to establish an SSH connection, [enable data access logs](/logging/docs/audit/configure-data-access) for the **Cloud Identity-Aware Proxy API**.\nData access logs are disabled by default. Unless you have concerns about log volume,\nenable data access logs for all projects that contain VM instances.\n\nMonitor audit log entries related to SSH usage\n\nSSH usage can impact the security of VMs and their workloads, so it's important to\nkeep an audit trail for both successful connection attempts and failed access attempts.\nThis is especially important in production environments, where SSH usage should be\nconsidered a sensitive action.\n\nTo track SSH access and possibly to find suspicious behavior, make sure that you\nmonitor log entries related to SSH, including the following:\n\n| Service | Method | Description |\n|----------------|----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| IAP | `AuthorizeUser` | Indicates a connection attempt through IAP TCP-forwarding. Log entries contain details about the user's device, satisfied access levels, and unsatisfied access levels. |\n| OS Login | `google.cloud.oslogin.dataplane.OsLoginDataPlaneService.CheckPolicy` | [Indicates a login attempt](/compute/docs/oslogin/view-audit-logs). |\n| OS Login | `google.cloud.oslogin.dataplane.OsLoginDataPlaneService.StartSession` | [Indicates the start of a OS Login 2FA challenge](/compute/docs/oslogin/view-audit-logs) |\n| OS Login | `google.cloud.oslogin.dataplane.OsLoginDataPlaneService.ContinueSession` | [Indicates the completion of a OS Login 2FA challenge](/compute/docs/oslogin/view-audit-logs) |\n| Compute Engine | `v1.compute.projects.setCommonInstanceMetadata` | If the field `projectMetadataDelta` contains an entry for \\`ssh-keys\\`, then this log entry indicates that an SSH key was added, removed or modified in project metadata. |\n| Compute Engine | `v1.compute.instances.setMetadata` | If the field `projectMetadataDelta` contains an entry for \\`ssh-keys\\` or \\`sshKeys\\`, then this log entry indicates that an SSH key was added, removed or modified in instance metadata. |\n| Compute Engine | `google.ssh-serialport.v1.connect` | Indicates a connection attempt to the serial console |\n| IAM | `beta.compute.instances.setIamPolicy`, `v1.compute.instances.setIamPolicy` | Indicates a change to the IAM policy of a VM instance. An IAM policy change might affect users' ability to modify instance metadata. |\n| IAM | `SetIamPolicy` | Indicates a change to the IAM policy of a project. An IAM policy change might affect users' ability to modify project metadata and the project's [Data Access audit logs configuration](/logging/docs/audit/configure-data-access#config-api). |\n\nAll audit log records contain a `principalEmail` field that identifies the principal\nthat initiated the activity.\n\nTo get a complete picture of activity on your VMs, configure your VMs to export\n`/var/log/messages` and SSH server logs to Cloud Logging, for example\nby using [Ops Agent](/logging/docs/agent/ops-agent).\n\nNotice that depending on the Linux distribution you use, SSH server logs might\nbe written to different log files (typically, `/var/log/auth.log` or `/var/log/secure`),\nand that these log files aren't covered by the\n[default configuration used by Ops Agent](/logging/docs/agent/ops-agent/configuration#default)."]]
