One of the security processes that we are thinking of changing is the way we allow users to access our servers. We have about 20 web servers where the only access is SSH and at the moment we use password authentication. With key-base authentication being more secure I have to consider how best to manage this process.
If we have 8 remote users all using different machines how do we control the key authentication as each of these machines will need the key to the server. Is the management done at the client level or the server level? What happens when the user changes his laptop or tries to remote in from a different machine/location?
Barring this we are looking at:
Changing the SSH port We already have root disabled Looking at google-authenticator using PAM Whitelist IP's for server access? Secure SSH server for server hopping?
Anything else missed?