The access code is the last door on the device: even if an account leaks, nobody connects without it. Use a different code per device.
Setting the code
Set or change the access code in the host security settings. Use at least eight characters mixing letters and numbers, and rotate it periodically.
- A different code per device
- Eight or more characters, mixed types
- Rotate regularly and never reuse
- Do not write it on a note next to the machine
Two-factor authentication
Turn on two-factor authentication (SMS or one-time code) for the account, so new-device sign-ins need extra confirmation — a strong guard against account theft.
- Enable SMS or one-time-code 2FA
- Extra confirmation for new devices
- Store recovery codes offline
- Update your phone number when it changes
Connection policy
Go further: allow only named accounts, restrict which capabilities may be used (file transfer, command line), and set permitted time windows.
- Limit which accounts may connect
- Switch off file transfer and command line as needed
- Set allowed connection hours
- Change codes and revoke authorisations immediately if something looks wrong
FAQ
Is the access code the same as my account password?
No. The access code only unlocks that device and should differ completely from your account password, so one leak does not cascade.
I forgot the code and I am not at the device.
Remove the unattended configuration for that device in your account; the code then has to be set again on the machine itself.