Which SSH best practice helps restrict access to individual users and keys?

Which SSH best practice helps restrict access to individual users and keys?

• A. Share a single SSH key among all users.
• B. Disable two-factor authentication.
• C. Enforce per-user SSH keys with individual restrictions.
• D. Allow root login with password.

Answer: (C)

Using per-user SSH keys with individual restrictions gives each user a unique key tied to their own account, so access can be granted, monitored, and revoked for each person. This setup lets you map a specific public key to a specific user and enforce constraints in the server’s authorization rules, such as limiting which commands can run, from which hosts, or what port forwarding is allowed. If a user leaves or a key is compromised, you can revoke that single key or tighten its restrictions without affecting everyone else, and you gain clear auditing of who logged in and when. Sharing a single key among many users makes accountability and revocation nearly impossible, while disabling two-factor authentication removes a protective layer, and allowing root login with a password is risky and broadest in scope. Per-user keys with individual restrictions therefore provide precise, manageable, and auditable access.

Using per-user SSH keys with individual restrictions gives each user a unique key tied to their own account, so access can be granted, monitored, and revoked for each person. This setup lets you map a specific public key to a specific user and enforce constraints in the server’s authorization rules, such as limiting which commands can run, from which hosts, or what port forwarding is allowed. If a user leaves or a key is compromised, you can revoke that single key or tighten its restrictions without affecting everyone else, and you gain clear auditing of who logged in and when. Sharing a single key among many users makes accountability and revocation nearly impossible, while disabling two-factor authentication removes a protective layer, and allowing root login with a password is risky and broadest in scope. Per-user keys with individual restrictions therefore provide precise, manageable, and auditable access.