Lock Every Door: How to Implement MFA Across SSH, RDP & Legacy Apps

Credential-based attacks remain one of the most common entry points for attackers. Phishing, brute force attempts, credential stuffing, and password reuse are all threats that exploit weak or single-factor authentication. While organizations often protect cloud services like Office 365 with MFA, the reality is that critical internal systems are frequently left exposed—including SSH servers, RDP hosts, and legacy applications.

Multi-Factor Authentication (MFA) mitigates these risks by requiring two or more proofs of identity. By implementing MFA consistently across all access points, you significantly reduce the likelihood of a breach—even if passwords are compromised. In hybrid enterprise environments, MFA must cover remote administrators, internal users, third-party vendors, and legacy systems to be truly effective.

Understanding the MFA Threat Landscape

Even with strong passwords, attackers can exploit:

• Open RDP ports exposed to the internet
• Privileged SSH accounts on Linux, Unix, or macOS servers
• Forgotten legacy applications running outdated authentication protocols
• Shared service accounts with broad administrative privileges

A single compromised account in any of these areas can lead to data exfiltration, ransomware deployment, or lateral movement across the network. MFA closes this gap by introducing a second layer of verification, often in the form of TOTP codes, push notifications, hardware tokens, or certificate-based authentication.

Core MFA Methods for Enterprise Environments

When choosing MFA methods, consider usability, compliance, and integration capabilities:

• TOTP (Time-based One-Time Passwords): Google Authenticator, Authy
• Push notifications: Duo Mobile, Microsoft Authenticator
• Hardware tokens: YubiKeys, smartcards
• Biometric verification: Fingerprint, facial recognition
• Certificate-based authentication: TPM-backed certificates or smartcards

Each method has trade-offs in cost, scalability, and user adoption, and a unified approach often reduces user friction while enhancing security.

Implementing MFA for SSH

Secure shell (SSH) remains a primary administrative access method for Unix-based systems. MFA options include:

1. PAM-Based MFA

Linux and Unix systems support Pluggable Authentication Modules (PAM), enabling MFA integration:

Steps:

1. Install an MFA solution (e.g., libpam-google-authenticator or Duo Unix)
2. Configure /etc/pam.d/sshd to require MFA
3. Update /etc/ssh/sshd_config to enforce authentication rules
4. Restart SSH and verify the login process

Benefits: Enforces a second factor before granting SSH access without redesigning existing workflows.

2. SSH Certificate Authorities with MFA

Enterprises can deploy SSH Certificate Authorities (CA) to sign user keys. By combining CAs with MFA:

• Users must authenticate using their password + TOTP or push notification
• Centralized key management reduces the risk of stale credentials
• Supports audit logging for compliance reporting

Implementing MFA for RDP

Windows Remote Desktop Protocol (RDP) is frequently targeted by attackers due to exposed endpoints and privileged accounts.

Option 1: Windows Hello for Business

Modern Windows environments support Windows Hello for Business, combining:

• Biometric authentication or PIN tied to a TPM
• Certificate-backed credentials
• Integration with Active Directory or Azure AD

Ideal for enterprise admins and remote workers, Hello for Business ensures device-based MFA without additional agents.

Option 2: Third-Party MFA Agents

Products like Duo, Rublon, or Okta MFA can be installed on RDP hosts to enforce second-factor verification after a successful password entry. These tools often provide:

• Push-based approvals
• Audit logging of failed attempts
• Compatibility with legacy RDP clients

Option 3: RADIUS Integration

Network Policy Servers (NPS) or other RADIUS solutions can act as MFA brokers for RDP. This allows organizations to:

• Integrate on-prem MFA solutions with AD authentication
• Centralize MFA policies across multiple hosts
• Enforce per-user or per-group MFA rules

MFA for Legacy Applications

Legacy apps often lack modern authentication support. Securing them requires creative approaches:

1. MFA Gateways

Reverse proxies or identity-aware gateways can sit in front of legacy applications:

• Authenticate users via MFA before granting access
• Act as an intermediary, injecting credentials into the backend app
• Provide centralized logging and session monitoring

2. OS-Level MFA

If the application cannot be modified:

• Enforce MFA at the operating system level
• Restrict remote access ports
• Use jump servers with MFA to provide controlled access

3. RDP + Application Layer Isolation

Run legacy applications in an isolated Windows session, then protect the session via RDP with MFA. While not ideal, this method is effective in environments where app modifications are impossible.

Securing Shared Accounts and Admin Tools

Shared administrative accounts remain a high-risk vector. MFA strategies include:

• Privileged Access Management (PAM): Assign temporary, just-in-time access
• Replace shared credentials with individual accounts plus elevation tools
• Enforce MFA for network appliances via RADIUS/TACACS+
• Require MFA on jump hosts or bastion servers controlling internal infrastructure

Real-world insight: Many breaches originate from legacy administrative accounts that never required MFA.

Best Practices for Enterprise-Wide MFA

1. Start with high-risk systems: Admin consoles, domain controllers, VPNs, cloud apps
2. Standardize MFA methods: Reduce user confusion and improve compliance
3. Plan for break-glass accounts: Ensure emergency access with temporary MFA overrides
4. Monitor MFA activity: Audit logs for failed attempts and unusual patterns
5. Educate users: Provide clear guidance on MFA workflows and incident reporting
6. Continuous review: Evaluate new applications, endpoints, and services for MFA coverage

Common Pitfalls to Avoid

• Limiting MFA only to cloud apps
• Relying solely on SMS-based verification (vulnerable to SIM swapping)
• Leaving legacy systems unprotected
• Assuming VPNs alone are sufficient
• Allowing local logins that bypass MFA enforcement

Expert opinion: MFA is most effective when implemented consistently across all authentication surfaces, not selectively.

Conclusion

Multi-Factor Authentication is no longer optional—it is a critical security control for modern enterprises. Threat actors frequently exploit SSH, RDP, and legacy application logins, bypassing protections applied only to cloud systems.

A strategic MFA deployment across all authentication vectors—SSH, RDP, legacy apps, shared accounts, and admin consoles—provides:

• Stronger resistance to phishing and credential theft
• Reduced lateral movement opportunities for attackers
• Enhanced auditability and compliance

By enforcing MFA everywhere, you lock every door in your infrastructure, transforming weak points into a robust, resilient defense against credential-based attacks.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.