Finding SEC-04
HighPassword authentication for SSH remains enabled
- Observation
- Administrative SSH access accepts passwords in addition to key-based authentication.
- Impact
- The externally reachable login increases exposure to automated authentication attempts.
- Recommendation
- Verify existing keys and emergency access, then disable password authentication and document the change.



















