Detections
Analytics

1.195 ALMA-09-024770

Information

The SSH daemon must perform strict mode checking of home directory configuration files.

GROUP ID: V-269299
RULE ID: SV-269299r1050181

If other users have access to modify user-specific SSH configuration files or read keys, they may be able to log into the system as another user.

Solution

To configure the SSH daemon to perform strict mode checking of home directory configuration files, add or modify the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":

StrictModes yes

Alternatively, add the setting to an include file if the line "Include /etc/ssh/sshd_config.d/*.conf" is found at the top of the "/etc/ssh/sshd_config" file:

$ echo "StrictModes yes" > /etc/ssh/sshd_config.d/strictmodes.conf

Restart the SSH daemon for the settings to take effect:

$ systemctl restart sshd.service

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-269299r1050181_rule, STIG-ID|ALMA-09-024770, Vuln-ID|V-269299

Plugin: Unix

Control ID: 1dfd175bf460876ed5f1b05c85aa5336d05c928c568900521ed6b58455e2aed3