// Module included in the following assemblies:
//
// * edge_computing/day_2_core_cnf_clusters/security/security-host-sec.adoc

:_mod-docs-content-type: CONCEPT
[id="security-command-line-host-access_{context}"]
= Command-line host access

[role="_abstract"]
Configure an external authenticator to restrict direct access and prevent unauthorized modifications. The Machine Config Operator (MCO) manages these logins and maintains consistency across your cluster.

Examples of external authenticators include lightweight directory access protocol (LDAP) and System Security Services Daemon (SSSD). If a node reboot leads to timeout issues, create a node disruption policy. With this policy, you can configure an external authenticator on a host without requiring a node reboot. For more information, see "Using node disruption policies to minimize disruption from machine config changes" in the _Additional resources_ section.

[IMPORTANT]
====
Do not configure direct access to the root ID on any {product-title} cluster server.
====

You can connect to a node in the cluster by using the following methods:

Using debug pod:: Red{nbsp}Hat recommends this method to access a node. To debug or connect to a node, run the following command:
+
[source,terminal]
----
$ oc debug node/<worker_node_name>
----
+
After connecting to the node, run the following command to get access to the root file system:
+
[source,terminal]
----
# chroot /host
----
+
This gives you root access within a debug pod on the node. For more information, see "Starting debug pods with root access".

Direct SSH:: Avoid using the root user. Instead, use the core user ID (or your own ID). To connect to the node by using SSH, run the following command:
+
[source,terminal]
----
$ ssh core@<worker_node_name>
----
+
[IMPORTANT]
====
The core user ID is initially given `sudo` privileges within the cluster.
====
+
If you cannot connect to a node by using SSH, add your SSH key to the core user. For more information, see "How to connect to {product-title} 4.x Cluster nodes using SSH bastion pod" in the _Additional resources_ section.
+
After connecting to the node using SSH, run the following command to get access to the root shell:
+
[source,terminal]
----
$ sudo -i
----

Console Access:: Ensure that consoles are secure. Do not allow direct login with the root ID, instead use individual IDs.
+
[NOTE]
====
Follow the best practices of your organization for securing console access.
====