---
title: "Configure the SSH Library Item"
slug: "configure-the-ssh-library-item"
updated: 2025-07-22T19:05:47Z
published: 2025-07-22T19:05:47Z
canonical: "support.kandji.io/configure-the-ssh-library-item"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the SSH Library Item

### What is SSH?

SSH, or Secure Shell, is a network protocol that allows admins to securely access and manage a remote computer over an encrypted connection. It is commonly used by Mac admins to issue remote commands, access important files, and run applications on computers in their fleet.

### How does SSH work?

macOS comes with a built-in SSH client accessible through Terminal. It also includes an SSH server, which is disabled by default, but can be enabled to allow remote access to your Mac. SSH uses cryptographic techniques to secure the connection between the client and server. This includes symmetric encryption, asymmetric encryption, and hashing to ensure data integrity and confidentiality during transmission. Using Kandji, admins can configure SSH according to their organization’s security tolerances under the General section within the SSH Libraryitem.

> [!NOTE]
> The /etc/ssh/ssh_config and /etc/ssh/sshd_config config files may return to their default values upon any update or major upgrade. However, the Kandji Agent will automatically remediate and set the corresponding values defined in the SSH Library item.

### Add an SSH Library Item

Use the guidance below to meet NIST or STIG requirements for SSH in your Mac fleet. For organizations aiming to meet CIS Level 1 requirements without using a CIS Level 1 Blueprint, disabling the SSH server on macOS is recommended.

To add this Library Item to your Kandji Library, follow the steps outlined in the [Library Overview](/kb/library-overview) article.

1. Give the new SSH Library Item a **Name**.
2. Assign to your desired [Blueprints](/v1/docs/getting-started-with-assignment-maps).![](https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/72115033447/original/DCdVJv814pSr-DIcaWZrpQkiglxoNy4__w.png?1726167300)
3. Select **SSH server availability**.
  - Click **On**.
4. Select **Challenge-response authentication**.
  - Click **On**.
5. Select **Root login**.
  - Click **Off**.
6. Select **SSH login banner**.
  - Click **On**.
  - Enter a custom **Banner text** per your organization’s security policy. You may also use the default text.
7. Select **Login attempt grace period**.
  - Ensure that the login attempt timeout is set to **30** seconds.
8. Select **Session timeout**.
  - Ensure that the session timeout is set to **900** seconds.
9. Select **Maximum alive count**.
  - Ensure that the alive count is set to **0** messages.
10. Select **Remove non-FIPS Ciphers**.
11. Select **Remove non-FIPS Message Authentication Codes**.
12. Select **Use secure key exchange algorithms**.
13. Click **Save**.