Detections
Analytics

5.2.7 Ensure SSH root login is disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The PermitRootLogin parameter specifies if the root user can log in using SSH. The default is prohibit-password.

Rationale:

Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root. This limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.

Solution

Edit the /etc/ssh/sshd_config file to set the parameter as follows:

PermitRootLogin no

Default Value:

PermitRootLogin without-password

See Also

https://workbench.cisecurity.org/files/4115

Item Details

References: CSCv7|4.3

Plugin: Unix

Control ID: 34de344e7d478da0f4e7c75fb91b4ac4bc5298abb5b6b5ec5209dc8efa7c55ab