> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Disallowed ssh connection

### Event Information

#### Meaning

* Indicates that an SSH connection attempt was made to a Kubernetes pod, which is a security risk as it bypasses the intended container orchestration mechanisms.
* It could suggest a potential security breach or unauthorized access attempt within the cluster.
* Immediate investigation and remediation are necessary to ensure compliance with security best practices and prevent further unauthorized access.

To investigate further:

1. Check the specific pod and node where the SSH connection attempt was made:
   `kubectl get pods --all-namespaces`
   `kubectl describe pod <pod_name> -n <namespace>`

2. Review the pod's security context and network policies to identify any misconfigurations:
   `kubectl get pod <pod_name> -n <namespace> -o yaml`

3. Monitor network traffic and access logs within the cluster to detect any other suspicious activities:
   `kubectl logs <network_policy_controller_pod> -n kube-system`

#### Remediation

* Create a Kubernetes Pod manifest file with a Python container that includes the necessary logic to remediate the Disallowed SSH Connection event.
* Use the Kubernetes Python client library to interact with the Kubernetes API and deploy the remediation Pod.
* Apply the Pod manifest using kubectl apply -f remediation\_pod.yaml to remediate the event.