> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the SSH Library Item

> Configure the SSH Library Item in Iru Endpoint to manage secure shell access on Mac computers. Enable or disable remote login and set allowed users.

<Callout icon="apple" color="#B84A7A" iconType="regular">This Library Item is available for Mac computers</Callout>

### What is SSH?

SSH, or Secure Shell, is a network protocol that lets you securely access and manage a remote computer over an encrypted connection. It's commonly used by Mac admins to issue remote commands, access important files, and run applications on computers in their fleet.

### How does SSH work?

macOS comes with a built-in SSH client accessible through Terminal. It also includes an SSH server, which is disabled by default, but can be enabled to allow remote access to your Mac. SSH uses cryptographic techniques to secure the connection between the client and server. This includes symmetric encryption, asymmetric encryption, and hashing to ensure data integrity and confidentiality during transmission. Using Iru, you can configure SSH according to your organization's security tolerances under the General section within the SSH Library item.

<Note>
  The /etc/ssh/ssh\_config and /etc/ssh/sshd\_config config files may return to their default values upon any update or major upgrade. However, the Iru Agent will automatically remediate and set the corresponding values defined in the SSH Library item.
</Note>

### Add an SSH Library Item

Use the guidance below to meet NIST or STIG requirements for SSH in your Mac fleet. For organizations aiming to meet CIS Level 1 requirements without using a CIS Level 1 Blueprint, disabling the SSH server on macOS is recommended.

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Name the Library Item">
    Give the new SSH Library Item a **Name**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign to your desired [Blueprints](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints).
  </Step>
</Steps>

<Steps>
  <Step title="Enable SSH server">
    Select **SSH server availability**.

    * Click **On**.
  </Step>

  <Step title="Enable Challenge-response authentication">
    Select **Challenge-response authentication**.

    * Click **On**.
  </Step>

  <Step title="Disable Root login">
    Select **Root login**.

    * Click **Off**.
  </Step>

  <Step title="Configure SSH login banner">
    Select **SSH login banner**.

    * Click **On**.
    * Enter a custom **Banner text** per your organization's security policy. You can also use the default text.
  </Step>

  <Step title="Set Login attempt grace period">
    Select **Login attempt grace period**.

    * Ensure that the login attempt timeout is set to **30** seconds.
  </Step>

  <Step title="Set Session timeout">
    Select **Session timeout**.

    * Ensure that the session timeout is set to **900** seconds.
  </Step>

  <Step title="Set Maximum alive count">
    Select **Maximum alive count**.

    * Ensure that the alive count is set to **0** messages.
  </Step>

  <Step title="Remove non-FIPS Ciphers">
    Select **Remove non-FIPS Ciphers**.
  </Step>

  <Step title="Remove non-FIPS Message Authentication Codes">
    Select **Remove non-FIPS Message Authentication Codes**.
  </Step>

  <Step title="Use secure key exchange algorithms">
    Select **Use secure key exchange algorithms**.
  </Step>

  <Step title="Save configuration">
    Click **Save**.
  </Step>
</Steps>