Detections
Analytics

5.1.1 Ensure access to /etc/ssh/sshd_config is configured

Information

/etc/ssh/sshd_config is the main configuration file for the OpenSSH server daemon (sshd), which manages secure remote logins and other SSH services.

/etc/ssh/sshd_config is the default location for drop-in configuration files used by sshd.

More information about the openSSH server configuration is available in the "Configure SSH Server" section overview.

Configuration specifications for sshd need to be protected from unauthorized changes by non-privileged users.

Solution

Run the following script to set ownership and permissions on /etc/ssh/sshd_config and files ending in .conf in the /etc/ssh/sshd_config.d directory:

#!/usr/bin/env bash

{
 chmod u-x,og-rwx /etc/ssh/sshd_config
 chown root:root /etc/ssh/sshd_config
 while IFS= read -r -d $'\0' l_file; do
 if [ -e "$l_file" ]; then
 chmod u-x,og-rwx "$l_file"
 chown root:root "$l_file"
 fi
 done < <(find /etc/ssh/sshd_config.d -type f -print0 2>/dev/null)
}

Note: If other locations are listed in an Include statement, *.conf files in these locations access should also be modified.

See Also

https://workbench.cisecurity.org/benchmarks/24932

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 4828185736e84390cf2e478fc4e2ecbdd603717945b5b435dc7a8ef766b7242b