Eba sets strict frameworks for remote operations. These guidelines define how outsourced teams connect to infrastructure without exposing direct network access. Every SSH session must flow through a controlled proxy. This cuts attack surfaces, logs commands, and enforces multifactor steps before login. The rule is simple—no direct SSH connections. Follow the proxy path.
The requirements start with authentication. Keys are mandatory; passwords are banned. Keys must be rotated on a fixed schedule and stored in hardened vaults. Every outbound request from the proxy is tied to a specific user identity. No shared accounts. This aligns with Eba's identity assurance controls.
Connection flow is next. The SSH access proxy sits between the external engineer and the target host. Traffic is inspected, rate-limited, and filtered. All sessions are recorded for audit. Administrators can revoke access instantly without touching the destination servers. Eba guidelines demand that this proxy layer remain isolated from other network functions, reducing lateral movement risk.