Connecting by Name: Security
Users can connect through a gateway by name, with no certificate on their own machine:
ssh -p 2222 <your-name>@<account>@<endpoint>@<gateway>
The gateway sends a push from your organisation's MFA provider. The session opens only after the push is approved. See Connect to an endpoint through a gateway.
Because anyone who can reach port 2222 can type a name, the gateway limits how name logins are used.
Limits
| Limit | Detail |
|---|---|
| Pushes per person | At most 3 pushes per person per 5 minutes |
| After denials | No pushes for 15 minutes after 3 denials |
| Logins per source address | At most 10 name logins per source address per 5 minutes |
The limits stop push flooding. A user who is sent many pushes they did not ask for may approve one by mistake.
Every Refusal Looks the Same
A refused login gets the same message whatever the reason: an unknown name, no matching policy, a denied push, or a limit reached. An attacker cannot use the answer to find valid names or accounts.
When a real user is refused, check the policy, the endpoint and the limits above. Access Logs shows the actual outcome of each attempt.
Recommendation
Keep port 2222 reachable only from your office network or VPN. Do not expose it to the internet.