Detections
Analytics

4.2.7 Ensure SSH root login is disabled

Information

The PermitRootLogin parameter specifies if the root user can log in using SSH. The default is prohibit-password.

Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root . This limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

PermitRootLogin no

Note: First occurrence of a option takes precedence, Match set statements withstanding.

See Also

https://workbench.cisecurity.org/benchmarks/13007

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: Unix

Control ID: 1c6972bd52f276693d7af634019566938b55bd5e3f69f05b768a63037267a227